fix(scripts): say what drifted when the notices check fails

[Joob1n]

Problem

npm run check:third-party-notices compares a 15k-line generated file byte-for-byte and, on a mismatch, says only:

Error: Production dependency notices are stale. Run npm run generate:third-party-notices.

Two different causes produce that message, and the suggested command only fixes one of them:

• the dependency closure changed — regenerating is the fix;
• the same packages are listed but their notice text moved — regenerating will also silently absorb it, without anyone seeing what changed or why.

Whoever hits this is usually reading a CI log for an OS they are not sitting in front of, so there is nothing to act on but a guess.

Change

The check now names the drift.

Changed closure — packages on each side, capped at ten with a count:

Error: Production dependency notices are stale. Run npm run generate:third-party-notices.
  present in the closure but missing from the committed file (1):
    mermaid@11.16.1

Same packages, different text — the first differing line, both versions quoted:

Error: Production dependency notices are stale. Run npm run generate:third-party-notices.
  the same packages are listed, so the difference is in the notice text itself
  first difference at line 430:
    committed:  "================================================================================"
    generated:  ""

A missing output file also gets its own message instead of sharing the stale one, since "run the generator" is the whole answer there.

No dependencies added; the comparison itself is unchanged.

How I know it works

Both branches were exercised against the real file: deleting one package's section produced the first output above, and the second is the actual current output on main.

That second one is not hypothetical. It localized a real failure in one line — same packages, line 430 — which pointed at LICENSE content rather than a dependency change, and from there to #3140 having landed without the notices file being regenerated. The Windows package job that runs this check does not list LICENSE in its trigger paths, so that PR never ran it. I will send the regeneration separately, since it is a different concern from the diagnostics.

Verified with npm ci rather than an incremental install, so the closure matches what CI resolves.

AI use

• No generative tool made a substantive contribution
• Generative tooling made a substantive contribution

Tool and scope: Claude Code assisted with the implementation and diagnostics. The human contributor reviewed the work and accepts responsibility for the contribution.

Checklist

• Tests cover the change and fail without it
• Required CI checks pass

Does this PR entail a change in behavior?

• Yes — check-mode diagnostics only; notice generation and comparison semantics are unchanged
• No

[coderabbitai]

📝 Walkthrough

Summary

This PR improves check:third-party-notices diagnostics when the generated notices file differs from the committed file.

• It reports packages missing from either dependency closure.
• It caps package details at ten and reports the total count.
• It reports the first differing notice-text line when package sets match.
• It reports both package versions for notice-text differences.
• It reports a separate error when the generated file is missing.

Design and scope

The change extends the existing notice-generation and comparison path. It does not create a parallel source of truth or add dependencies.

The implementation is a small, focused change. The added describeNoticeDrift logic is necessary to distinguish dependency-closure drift from notice-text drift and to provide actionable diagnostics. The existing dependency comparison remains unchanged.

No public or exported declarations changed. No code or tests are identified for deletion or simplification without reducing diagnostic coverage.

Risks and validation

The main behavior change affects check-mode error output. It does not change notice generation or dependency resolution.

Validation used npm ci and the real notices file. Tests covered both dependency-closure drift and notice-text drift scenarios.

The final status of required checks is unverified from the available evidence.

Review-relevant risks

No protected-area effect was identified in the current diff. The person performing the merge must review the final diff, and a maintainer makes the final determination.

Walkthrough

The notice generator now explains stale third-party notice files. Check mode separately reports missing files and content drift, including package differences or the first differing line.

Changes

Third-party notice validation

Layer / File(s)	Summary
Notice drift reporting scripts/generate-third-party-notices.mjs	Adds describeNoticeDrift for package-set and first-line comparisons. Check mode distinguishes missing files from stale content and includes the drift details.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: 🔵 Low · up to 4db0c

On CRLF-formatted notice files, the new check can misclassify unchanged packages and report misleading closure drift instead of the actual text difference. The fix is localized and does not affect notice generation, so the PR is mergeable with explicit owner follow-up to normalize line endings.

Suggested reviewers: astro-han, m4n5ter

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Ai Use Disclosure	⚠️ Warning	The PR description selects neither required AI-use declaration. The sole commit has no valid Generated-by trailer, so the disclosure is incomplete.	Add one explicit declaration and follow the “Human ownership and AI attribution” section of CONTRIBUTING.md; if AI authored material content, name the tool/scope and add a trailer that survives squash or amend.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly identifies the main change: improved diagnostics for third-party notice drift failures.
Description check	✅ Passed	The description explains the problem, implementation, verification evidence, AI use, checklist status, and behavior change.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests

---

_{Comment @coderabbitai help to get the list of available commands.}

[Copilot]

Pull request overview

Improves the developer/CI experience for npm run check:third-party-notices by enriching failure diagnostics so mismatches in the generated third-party notices file explain what drifted (dependency closure vs notice text), rather than reporting a generic “stale” error.

Changes:

• Adds a drift-description helper that reports missing/extra packages (capped list) or the first differing line when the package set is unchanged.
• Splits “missing output file” into a dedicated error message with an appropriate remediation.
• Keeps the underlying byte-for-byte comparison behavior unchanged while improving the error output.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[coderabbitai]

Actionable comments posted: 1

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: c274ba61-3f1b-40ad-82ca-14d349976554

📥 Commits

Reviewing files that changed from the base of the PR and between 48e95e1 and 4db0c65.

📒 Files selected for processing (1)

• scripts/generate-third-party-notices.mjs

Included review availability: Your plan includes up to 3 reviews per rolling hour; 1 remains after this review.

[Joob1n]

Both bots landed on the same defect and both were right — fixed in 315b8f6f.

I reproduced it before changing anything:

CRLF committed → {'a@1\r', 'b@2\r'}
LF   generated → {'a@1', 'b@2'}
only in generated: {'a@1', 'b@2'}
only in committed: {'a@1\r', 'b@2\r'}

Every package reported as both added and removed, which also means the text-drift branch never runs. So under CRLF the diagnostic would have misdescribed exactly the environment-specific failure it exists to explain — the worst possible case for this particular tool.

Both sides now split on either ending and trim the extracted name.

While there I added a third outcome. If every line matches once endings are normalized, the difference is the endings, and saying "regenerate" is wrong — the repository already forces LF through .gitattributes, so a CRLF checkout means that rule did not take effect:

  the same packages are listed, so the difference is in the notice text itself
  every line matches once line endings are normalized:
    committed uses CRLF: true
    generated uses CRLF: false
  check .gitattributes and the checkout, not the dependency closure

All three paths exercised against the real file: a deleted package section reports mermaid@11.16.1; a CRLF-converted copy of otherwise-current output produces the block above; and the actual drift on main still reports the same-packages case at line 430.

Note this PR's package job fails for a reason outside it — main's notices file has been stale since #3140, which #3155 fixes. This PR is what localized that, and it goes green once #3155 lands.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[Copilot]

Pull request overview

Copilot reviewed 1 out of 1 changed files in this pull request and generated no new comments.

[jackwener]

Fast-path determination on head 1c14c53: this is a low-impact, easy-to-revert diagnostics-only change. It does not alter notice generation, dependency resolution, or the byte-exact comparison; it only explains a failing check. CRLF handling is present, the AI-use disclosure is now explicit, and every required hosted check is terminal green on this head. I reviewed the final diff and found no blocking correctness issue.