vscode oss-third-party-notices.instructions.md

VS Code OSS Third-Party-Notices pipeline

This directory contains the thin VS Code-specific layer around Component Governance (CG) for producing OSS third-party notices. It replaces the legacy custom OSS tool with CG plus a gap-filling scanner, so release owners do not need to babysit ThirdPartyNotices.txt every release. The generated output should be at least as good as the legacy tool: CG provides the base NOTICE, the local scanner fills known CG gaps, and human-authored overrides cover the small set that automation cannot safely resolve.

The pipeline has two halves: generation (this oss/ directory — CG + scanner + merge, producing the notice_output artifact) and application (the cutover that swaps the merged notice into the shipped product — see "Applying the NOTICE (cutover)" below).

Architecture

The product-quality pipeline in build/azure-pipelines/product-quality-checks.yml is the main CI entry point.

1. notice@0 generates the CG base NOTICE at ThirdPartyNotices.generated.txt.
2. scan-licenses.ts scans local sources CG misses and writes ThirdPartyNotices.extensions.txt, plus sibling index files used by the merge step.
3. merge-notices.ts merges the CG output and scanner output, then applies cglicenses.json overrides through apply-overrides.ts.
4. check-pr-dependencies.ts is used by pr-oss-check.yml as a PR-time gate. It blocks dependency additions that have no license source.
5. If CG is down or notice@0 emits an empty/non-trivial failure output, the pipeline substitutes the last good ThirdPartyNotices.generated.txt artifact from the same branch, then from main. Only the CG portion is cached; local scanning and overrides still run fresh against the current commit.

Final merge output is uploaded as ThirdPartyNotices.new.txt in the notice_output artifact.

Pipeline flow in CI

In product-quality-checks.yml:

1. Component Detection runs with ComponentGovernanceComponentDetection@0.
2. notice@0 writes $(Build.SourcesDirectory)/ThirdPartyNotices.generated.txt and is continueOnError: true.
3. The cache fallback checks whether the CG file exists and is larger than 1 KB. If not, it downloads the latest notice_output artifact for the current branch, then main, and copies the cached ThirdPartyNotices.generated.txt into place.
4. TypeScript compiles the OSS scripts into .oss-build-out:
   • apply-overrides.ts
   • scan-licenses.ts
   • parse-notices.ts
   • merge-notices.ts
5. scan-licenses.js runs with --repo, --cg, and --output.
6. merge-notices.js runs with --cg, --extensions, --cglicenses, and --output.
7. The generated CG file, scanner file, final merged file, and optional cache metadata are uploaded under notice_output.