Skip to content

chore(license): put the SPDX identifier first in the NamedParametersSniff @license tag - #22

Merged
rubenvdlinde merged 1 commit into
developmentfrom
chore/eupl-license-normalisation-2026-08-05
Aug 5, 2026
Merged

chore(license): put the SPDX identifier first in the NamedParametersSniff @license tag#22
rubenvdlinde merged 1 commit into
developmentfrom
chore/eupl-license-normalisation-2026-08-05

Conversation

@rubenvdlinde

Copy link
Copy Markdown
Contributor

What

phpcs-custom-sniffs/CustomSniffs/Sniffs/Functions/NamedParametersSniff.php declared:

 * @license   https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12 EUPL-1.2

URL first, SPDX identifier second. Hydra gate-28 (license-triangle) extracts the
licence with awk '{print $3}' — the first token after @license — so this shape
resolves to the URL and compares unequal to composer.json's "EUPL-1.2".

Swapped to the fleet shape:

 * @license   EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12

The licence named is unchanged. This is a field-order fix, not a relicence.

Honest note on the gate

This repo has no lib/ directory, so gate-28 iterates zero files and emits PASS
without examining anything — its PASS is vacuous and is not evidence that this header
was correct. I verified the defect is real with a synthetic control: the identical
URL-first shape placed under lib/ produces

lib/UrlFirst.php file_license=https://joinup.ec.europa.eu/... composer_license=EUPL-1.2 rule=license-triangle-drift

and passes once swapped. Fixed here because it is the right declaration regardless of
whether the gate can currently see it.

Deliberately NOT changed

  • analysis-bootstrap.php — already @license EUPL-1.2 (SPDX first). Correct; not churned
    to add the URL.
  • LICENSE:177 — "GNU Affero General Public License (AGPL) v. 3" is an entry in the
    EUPL-1.2's own Appendix of compatible licences, not a declaration.
  • ex_app/lib/main.py — the actual Python application carries no licence header at all.
    Adding one is out of scope for a normalisation sweep; flagged for the repo owners.
  • All @copyright / SPDX-FileCopyrightText lines.

Verification

This repo has no test suitecomposer.json states this explicitly. The nearest
equivalent, run identically before and after under PHP 8.5 in a container (host PHP is
8.2, below this repo's ^8.3):

check before after
php -l (all PHP) clean clean
phpcs clean clean
phpmd clean clean
psalm No errors found No errors found
phpstan OK, no errors OK, no errors
gate-28 PASS (vacuous) PASS (vacuous)

…niff @license tag

The tag read `@license   <eupl-url> EUPL-1.2` — URL first, SPDX identifier
second. Hydra gate-28 (license-triangle) reads the licence with
`awk '{print $3}'`, i.e. the FIRST token after @license, so this shape
resolves to the URL and compares unequal to composer.json's "EUPL-1.2".

Swapped to the fleet shape:
  * @license   EUPL-1.2 https://joinup.ec.europa.eu/collection/eupl/eupl-text-eupl-12

The licence named is unchanged — this is a field-order fix, not a relicence.

Note: this repo has no lib/ directory, so gate-28 examines zero files here and
its PASS is vacuous. Verified against a synthetic control that the URL-first
shape does fail gate-28 when the same file sits under lib/.

Static analysis (lint, phpcs, phpmd, psalm, phpstan) clean before and after.
This repo has no test suite.
@github-actions

github-actions Bot commented Aug 5, 2026

Copy link
Copy Markdown

Quality Report — ConductionNL/opentalk @ 9f27cdf

Check PHP Vue Security License Tests
lint
phpcs
phpmd
psalm
phpstan
phpmetrics
eslint ⏭️
stylelint ⏭️
build ⏭️
composer ✅ 69/69
npm
PHPUnit ⏭️
Newman ⏭️
Playwright ⏭️
Hydra gates ⏭️

Quality workflow — 2026-08-05 18:12 UTC

Download the full PDF report from the workflow artifacts.

@rubenvdlinde
rubenvdlinde merged commit 44727aa into development Aug 5, 2026
26 checks passed
@rubenvdlinde
rubenvdlinde deleted the chore/eupl-license-normalisation-2026-08-05 branch August 14, 2026 09:45
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant