ci: license report from a clean venv, not the runner's site-packages

2026-09-11 23:54:44 +02:00
parent 7b31d4d0dd
commit 0ec675e9c5
1 changed files with 9 additions and 4 deletions
@@ -84,17 +84,22 @@ jobs:
          cache: pip
          cache-dependency-path: requirements.txt

-      - name: Install
+      # A fresh venv, not the runner's site-packages: the report must list the
+      # project's runtime deps, not whatever the runner image or a previous
+      # workflow happened to leave installed (semgrep once showed up here).
+      - name: Install into a clean venv
        run: |
-          python -m pip install --upgrade pip --root-user-action=ignore
+          python -m venv .lic && . .lic/bin/activate
+          pip install --upgrade pip --root-user-action=ignore
          pip install --root-user-action=ignore -r requirements.txt pip-licenses

      - name: Report
        run: |
+          . .lic/bin/activate
          pip-licenses --format=markdown --with-urls --output-file=licenses.md
          pip-licenses --format=json --output-file=licenses.json
-          echo "Copyleft licenses among runtime deps (informational):"
-          pip-licenses --format=plain | grep -iE 'GPL|AGPL|LGPL' || echo "  none"
+          echo "Copyleft licenses among runtime deps (informational; LGPL is fine to link from MIT):"
+          pip-licenses --format=plain --ignore-packages pip-licenses | grep -iE 'GPL|AGPL|LGPL' || echo "  none"

      - uses: actions/upload-artifact@v3
        with: