Promote staging -> main (2026-08-03)

[0xPlayerOne]

Environment promotion

Promote the validated staging environment into main.
This is a deployment-promotion PR, not the version-release PR.

• Source: staging
• Target: main
• Changes: 1 change
• Created: 2026-08-03

Commit summary

• feat: support Apache 2.0 license sync (9cf965b)

Validation

• Required CI, test, security, and CodeQL checks must pass before merge.
• Merge using the repository's configured merge_strategy (rebase).
• The promotion topology requires rebase; never merge a promotion PR with a merge commit.
• After merge, Release Please opens a separate versioned release PR with the changelog.

[kilo-code-bot]

Code Review Summary

Status: No Issues Found | Recommendation: Merge

Overview

Severity	Count
CRITICAL	0
WARNING	0
SUGGESTION	0

Files Reviewed (4 files)

• .github/licenses/APACHE-2.0.txt - new file; standard Apache 2.0 license text, verified complete
• docs/CONFIGURATION.md - added apache-2.0 to license policy options; consistent with code
• src/commands/sync.mjs - added apache-2.0 to licenseFiles map; moved license validation before any sync writes to fail fast without partial files
• test/cli.test.mjs - added tests for Apache 2.0 license installation and unsupported license rejection with no partial writes

Review Notes

• licenseFiles map (sync.mjs:37-42) includes all 4 supported licenses; apache-2.0 correctly maps to APACHE-2.0.txt.
• License validation (sync.mjs:73-76) was moved before any sync writes (commit 2), ensuring unsupported policies fail fast without leaving partially generated files.
• The licenseFile const declared at sync.mjs:72 remains accessible at the license copy block (sync.mjs:190); the early validation prevents reaching that block with an undefined licenseFile.
• legacyFiles (sync.mjs:44-53) correctly excludes APACHE-2.0.txt since Apache 2.0 is new and license templates are only read from the source runtime, never written to consumer .github/licenses/.
• Default license remains gpl-3.0-or-later (sync.mjs:478), matching the docs statement that new repositories default to GPLv3.
• Error message order matches Object.keys(licenseFiles) insertion order, consistent with the test regex.

---

_{Reviewed by laguna-s-2.1:free · Input: 133.6K · Output: 24.5K · Cached: 884.7K}