ci: enrich check_binary_deps failure report with license + target file

[Ma77Ball]

What changes were proposed in this PR?

Enrich the failure output of bin/licensing/check_binary_deps.py with two pieces of context that previously required manual lookup for every offending package: the dep's declared license string (read from 3rdpartylicenses.json for npm/agent-npm or pip-licenses.csv for python) and the per-module LICENSE-binary file to edit. Each bullet now renders as + name@version (license: X) → add to <file> for new packages, → remove from <file> for stale, and → update in <file> for drift, with the ACTION REQUIRED block naming the same file. Transitive deps are covered the same way because the input files already list everything bundled. No CI workflow changes; The script's exit semantics and aggregation behavior are unchanged.

Any related issues, documentation, or discussions?

Closes: #5056

How was this PR tested?

Added five unit tests in bin/licensing/test_check_binary_deps.py covering license rendering, target-file rendering, the jar no-license case, stale and drift hints, and the no-target-file fallback. Full suite of 34 tests passes locally via python3 -m unittest discover -s bin/licensing -p "test_*.py". Also smoke-tested by running the script against a synthetic 3rdpartylicenses.json and confirming the enriched bullets render correctly for new, stale, and drifted entries.

Was this PR authored or co-authored using generative AI tooling?

Co-authored with Claude Opus 4.7 in compliance with ASF

[codecov-commenter]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 43.07%. Comparing base (e4ec881) to head (7a70197).

Additional details and impacted files

@@             Coverage Diff              @@
##               main    #5057      +/-   ##
============================================
+ Coverage     43.06%   43.07%   +0.01%     
- Complexity     2206     2211       +5     
============================================
  Files          1045     1045              
  Lines         40220    40218       -2     
  Branches       4244     4243       -1     
============================================
+ Hits          17319    17325       +6     
+ Misses        21830    21827       -3     
+ Partials       1071     1066       -5     

Flag	Coverage Δ		*Carryforward flag
access-control-service	39.53% <ø> (ø)		Carriedforward from 1ea368d
agent-service	33.72% <ø> (ø)		Carriedforward from 1ea368d
amber	43.81% <ø> (+0.03%)	⬆️	Carriedforward from 1ea368d
computing-unit-managing-service	0.00% <ø> (ø)		Carriedforward from 1ea368d
config-service	0.00% <ø> (ø)		Carriedforward from 1ea368d
file-service	32.18% <ø> (ø)		Carriedforward from 1ea368d
frontend	33.93% <ø> (ø)		Carriedforward from 1ea368d
python	90.42% <ø> (ø)
workflow-compiling-service	47.72% <ø> (ø)		Carriedforward from 1ea368d

*This pull request uses carry forward flags. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[Ma77Ball]

/request-review @aicam

[aicam]

LGTM. Big quality-of-life improvement for the failure report — now tells contributors exactly which per-module LICENSE-binary to edit and what license the dep declares, so they can verify ASF Category A/B compatibility without leaving the CI log.

Verified locally

Unit tests:

$ python -m unittest test_check_binary_deps -v
Ran 34 tests in 0.005s
OK

All 34 tests pass, including the 4 new tests covering license parsing and report rendering (CollectNpmReturnsLicenses, CollectPythonReturnsLicenses, ReportRendersLicenseAndTargetFile).

Smoke test against a synthetic npm input:

$ python bin/licensing/check_binary_deps.py npm /tmp/test_npm.json
NEW npm packages not claimed by LICENSE-binary:
  + fake-new-pkg@1.0.0  (license: MIT) → add to frontend/LICENSE-binary

ACTION REQUIRED
  1. Verify each dep's license is ASF Category A or B.
  2. Add a bullet for each dep above to frontend/LICENSE-binary
     under the matching license section (see existing
     'npm-compatible token' bullets for format).
  ...

Exactly the actionable hint that was missing before. Cross-checked DEFAULT_TARGET_FILE against the CI invocations in .github/workflows/build.yml (lines 125, 218, 533, 608, 708) — paths line up with each module's actual LICENSE-binary location. The collect_npm / collect_python signature change from set → (set, dict) is consistently propagated to the single call site each.

Backward-compatible: explicit --license-binary <path> invocations (jar CI steps) still work — the target file shown becomes the explicit path.