Add support for vendored dependencies

Author: watson

.github/scripts/update-3rdparty-licenses.sh

@@ -35,8 +35,10 @@ else
     echo "     --no-scancode-strategy \\"
     echo "     --no-github-sbom-strategy \\"
     echo "     https://github.com/datadog/dd-trace-js > LICENSE-3rdparty.csv"
-    echo "3. Commit the updated LICENSE-3rdparty.csv file"
-    echo "4. Push your changes"
+    echo "3. Append vendored dependencies:"
+    echo "   cat .github/vendored-dependencies.csv >> LICENSE-3rdparty.csv"
+    echo "4. Commit the updated LICENSE-3rdparty.csv file"
+    echo "5. Push your changes"
     echo ""
     echo "This helps keep the 3rd-party license information accurate."
     exit 1

.github/vendored-dependencies.csv

@@ -0,0 +1,2 @@
+"aws-lambda-nodejs-runtime-interface-client","https://github.com/aws/aws-lambda-nodejs-runtime-interface-client/blob/v2.1.0/src/utils/UserFunction.ts","['Apache-2.0']","['Amazon.com Inc. or its affiliates']"
+"is-git-url","https://github.com/jonschlinkert/is-git-url/blob/396965ffabf2f46656c8af4c47bef1d69f09292e/index.js#L9C15-L9C87","['MIT']","['Jon Schlinkert']"

.github/workflows/update-3rdparty-licenses.yml

@@ -36,7 +36,7 @@ jobs:
         uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
         with:
           repository: DataDog/dd-license-attribution
-          ref: 848797a26d0cfd009482976d05af7f492bb5242c
+          ref: 8a4624fd08a16717ffbf92d389e65fa609a4f067
           path: dd-license-attribution
 
       - name: Install dd-license-attribution
@@ -71,6 +71,10 @@ jobs:
             --no-github-sbom-strategy \
             "${REPOSITORY_URL}" > LICENSE-3rdparty.csv
 
+      - name: Append vendored dependencies
+        run: |
+          cat .github/vendored-dependencies.csv >> LICENSE-3rdparty.csv
+
       - name: Run LICENSE-3rdparty.csv update check
         env:
           PR_AUTHOR: ${{ github.event.pull_request.user.login }}

LICENSE-3rdparty.csv

@@ -70,4 +70,5 @@
 "ttl-set","https://github.com/watson/ttl-set","['MIT']","['Thomas Watson']"
 "undici-types","https://github.com/nodejs/undici","['MIT']","['nodejs']"
 "yocto-queue","https://github.com/sindresorhus/yocto-queue","['MIT']","['Sindre Sorhus']"
-
+"aws-lambda-nodejs-runtime-interface-client","https://github.com/aws/aws-lambda-nodejs-runtime-interface-client/blob/v2.1.0/src/utils/UserFunction.ts","['Apache-2.0']","['Amazon.com Inc. or its affiliates']"
+"is-git-url","https://github.com/jonschlinkert/is-git-url/blob/396965ffabf2f46656c8af4c47bef1d69f09292e/index.js#L9C15-L9C87","['MIT']","['Jon Schlinkert']"

packages/dd-trace/src/lambda/runtime/ritm.js

@@ -3,7 +3,7 @@
  * Modifications copyright 2022 Datadog, Inc.
  *
  * Some functions are part of aws-lambda-nodejs-runtime-interface-client
- * https://github.com/aws/aws-lambda-nodejs-runtime-interface-client/blob/main/src/utils/UserFunction.ts
+ * https://github.com/aws/aws-lambda-nodejs-runtime-interface-client/blob/v2.1.0/src/utils/UserFunction.ts
  */
 'use strict'
 

scripts/check_licenses.js

@@ -1,7 +1,7 @@
 /* eslint-disable no-console */
 'use strict'
 
-const { createReadStream } = require('node:fs')
+const { createReadStream, existsSync } = require('node:fs')
 const { join } = require('node:path')
 const readline = require('node:readline')
 const { execSync } = require('node:child_process')
@@ -55,6 +55,9 @@ function getProdDeps () {
     }
   }
 
+  // Add vendored dependencies
+  addVendoredDeps(deps)
+
   return deps
 }
 
@@ -71,6 +74,29 @@ function collectFromTrees (trees, deps) {
   }
 }
 
+function addVendoredDeps (deps) {
+  const vendoredDepsPath = join(__dirname, '..', '.github', 'vendored-dependencies.csv')
+
+  // If the vendored dependencies file doesn't exist, skip
+  if (!existsSync(vendoredDepsPath)) {
+    return
+  }
+
+  const fs = require('node:fs')
+  const content = fs.readFileSync(vendoredDepsPath, 'utf8')
+
+  for (const line of content.split('\n')) {
+    const trimmed = line.trim()
+    if (!trimmed) continue // Skip empty lines
+
+    const columns = line.split(',')
+    const component = columns[0]
+
+    // Strip quotes from the component name and add to deps
+    deps.add(component.replaceAll(/^"|"$/g, ''))
+  }
+}
+
 function checkLicenses (typeDeps) {
   const missing = []
   const extraneous = []