feat(ci): auto-regenerate license files on dependabot PRs

[olexii4]

What does this PR do?

Inspired by devfile/devworkspace-generator#387, which introduced the same pattern for the devworkspace-generator project.

Adds .github/workflows/dependabot-license.yml — a GitHub Actions workflow that automatically regenerates license dependency files whenever Dependabot opens or updates a PR against main.

Previously, every Dependabot bump required a manual follow-up commit to re-run yarn license:generate and update .deps/prod.md, .deps/dev.md, and the EXCLUDED files. This workflow eliminates that manual step.

How it works

The workflow runs only on PRs authored by dependabot[bot] targeting main:

1. Runs yarn license:generate (license-tool --harvest) — requests ClearlyDefined to harvest any packages it does not yet know about, and classifies transitive unresolved deps automatically.
2. If unresolved deps remain (exit code ≠ 0 and .deps/problems.md exists):
   • Parses problems.md to identify each unresolved package and whether it belongs to the production or development section.
   • Constructs the ClearlyDefined URL for each package:
     • Scoped (@scope/name@ver) → https://clearlydefined.io/definitions/npm/npmjs/@scope/name/ver
     • Unscoped (name@ver) → https://clearlydefined.io/definitions/npm/npmjs/-/name/ver
   • Appends the entry to .deps/EXCLUDED/prod.md or .deps/EXCLUDED/dev.md (skipping duplicates):

     | `@isaacs/brace-expansion@5.0.1` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/@isaacs/brace-expansion/5.0.1) |
     | `cronstrue@3.13.0` | [clearlydefined](https://clearlydefined.io/definitions/npm/npmjs/-/cronstrue/3.13.0) |
     

3. Retries yarn license:generate — up to 3 attempts total.
4. Commits and pushes the updated .deps/ files back to the Dependabot branch (chore(deps): regenerate license dependency files). If .deps/ is unchanged the commit step is skipped.

---

Screenshot/screencast of this PR

N/A — CI-only change.

---

What issues does this PR fix or reference?

• Eliminates the manual yarn license:generate follow-up commit required after every Dependabot dependency bump.
• Ensures .deps/prod.md, .deps/dev.md, and the EXCLUDED files are always up to date before the dash-licenses check in pr.yml runs.
• Inspired by devfile/devworkspace-generator#387.

---

Is it tested? How?

1. Workflow syntax validated with actionlint (no errors).
2. The pkg_to_cd_url bash function was tested locally against the known-good examples from the existing EXCLUDED files:
   • @isaacs/brace-expansion@5.0.1 → https://clearlydefined.io/definitions/npm/npmjs/@isaacs/brace-expansion/5.0.1 ✓
   • cronstrue@3.13.0 → https://clearlydefined.io/definitions/npm/npmjs/-/cronstrue/3.13.0 ✓
3. End-to-end: trigger by opening a test Dependabot PR against main and confirm the workflow commits the updated .deps/ files.

---

[che-bot]

Click here to review and test in web IDE:

[github-actions]

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1585 (linux/amd64, linux/arm64)

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1585", name: che-dashboard}]}}]"

[github-actions]

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1585 (linux/amd64, linux/arm64)

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1585", name: che-dashboard}]}}]"

[github-actions]

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1585 (linux/amd64, linux/arm64)

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1585", name: che-dashboard}]}}]"

[github-actions]

Docker image build succeeded: quay.io/eclipse/che-dashboard:pr-1585 (linux/amd64, linux/arm64)

kubectl patch command

kubectl patch -n eclipse-che "checluster/eclipse-che" --type=json -p="[{"op": "replace", "path": "/spec/components/dashboard/deployment", "value": {containers: [{image: "quay.io/eclipse/che-dashboard:pr-1585", name: che-dashboard}]}}]"

[olexii4]

/retest

[svor]

lgtm, let's see how it works )

[openshift-ci]

[APPROVALNOTIFIER] This PR is NOT APPROVED

This pull-request has been approved by: olexii4, svor

The full list of commands accepted by this bot can be found here.

Details

Needs approval from an approver in each of these files:

• OWNERS

Approvers can indicate their approval by writing /approve in a comment
Approvers can cancel approval by writing /approve cancel in a comment

[tolusha]

Hi! I'm che-ai-assistant — I help with your pull requests.

Available commands:

• /che-ai-assistant generate-che-doc — Generate a documentation PR based on this PR's changes
• /che-ai-assistant ok-pr-review — Run a comprehensive PR review (summary, code review, deep review, impact analysis)
• /che-ai-assistant help — Show this help message

[svor]

/retest

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 92.49%. Comparing base (f87012b) to head (e547efa).
⚠️ Report is 7 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #1585   +/-   ##
=======================================
  Coverage   92.49%   92.49%           
=======================================
  Files         563      563           
  Lines       56254    56254           
  Branches     4267     4267           
=======================================
  Hits        52030    52030           
  Misses       4174     4174           
  Partials       50       50           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.