chore: set up 3rd-party license generation

[jcfranco]

Related Issue: #11546

Summary

This adds a utility script that generates 3rd-party license information for each package.

Notes

• file name is THIRD-PARTY-LICENSES.md (TPL)
• TPL is referenced in each package's README
• all packages are set up to generate a TPL (except the internal @esri/eslint-config-calcite package)
  • if there are no 3rd-party dependencies, it will display an appropriate message
• relies on https://www.npmjs.com/package/generate-license-file
• packages will now include TPL when published
• util script (util:update-3rd-party-licenses) can be called from the monorepo root or from individual packages
  • to ensure generate-license-file generates licenses correctly, this script installs node_modules and package-lock.json locally in each package (removed when finished)
  • I’ve created Add support for monorepos with root-level dependencies TobyAndToby/generate-license-file#597 to add support for root-level monorepo setups, which would eliminate the need for the above step.

[benelan]

Nice this looks good! So we have to remember to rerun that script whenever a dependency gets added to any of the packages, right?

I wonder if we should automatically run the script before publishing just in case we forget at some point. At least that way the package's license will be included.

You could run the script and git add **/THIRD-PARTY-LICENSES.md before committing here:

calcite-design-system/.github/workflows/deploy-latest.yml

Lines 75 to 89 in c88a31f

	# The "|| true" prevents failure if there are no changes
	git add package-lock.json || true
	# The release-please PR only updates when there are new deployable
	# commits, e.g., fixes, features, or breaking changes. This is fine
	# but it means autogenerated files can become outdated.
	#
	# Lerna will only publish when the working tree is clean, so changes
	# to autogenerated files cause the release to fail.
	#
	# The workaround is to commit the files before releasing so everything
	# will be up to date in the dists. The commit will be discarded once
	# the container is destroyed, and then the autogenerated files will be
	# updated in a subsequent PR.
	git commit -m "build(deps): update package-lock" || true

[benelan]

Should this be "./package.json" or "package.json"?

[jcfranco]

Oh, good catch. 🎣 It seems that generate-license-file's file path logic was unintentionally handling this case.

[jcfranco]

You could run the script and git add **/THIRD-PARTY-LICENSES.md before committing here:

Great idea. I've updated the deploy-next action to run the script and stage the license files as suggested. LMK if further tweaks are needed.