feat(TEA-71): implement automated SPDX header management#36
Merged
Mohamed-Elshesheny merged 3 commits intomainfrom Apr 16, 2026
Merged
feat(TEA-71): implement automated SPDX header management#36Mohamed-Elshesheny merged 3 commits intomainfrom
Mohamed-Elshesheny merged 3 commits intomainfrom
Conversation
…ense-check workflow - Introduced a new script for managing SPDX license headers across source files. - Added configuration files for license checking and formatting. - Updated CONTRIBUTING.md to reflect automated license management processes. - Integrated pre-commit hooks for automatic header addition and checks. - Created a GitHub Actions workflow to verify SPDX headers on push and pull requests. - Added SPDX headers to relevant source files to ensure compliance.
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: defaults Review profile: CHILL Plan: Pro Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughAdds repository-wide SPDX header tooling: a GitHub Actions workflow, pre-commit hooks, a config/template, package scripts, a Node CLI that filters applicable source files and invokes license-check-and-add, and inserted headers into several source files. Documentation updated with applicability and exclusions. Changes
Sequence Diagram(s)sequenceDiagram
actor Dev as Developer
participant Git as Git
participant Hook as Pre-commit Hook
participant CLI as spdx-license-cli
participant Tool as license-check-and-add
participant CI as GitHub Actions
Dev->>Git: git add (staged files)
Git->>Hook: trigger pre-commit
Hook->>CLI: run license:fix {staged_files}
CLI->>CLI: resolve targets (args or git ls-files) and filter by path/extension/excludes
CLI->>Tool: run add mode with temp config/ignore
Tool-->>CLI: modify files / exit status
CLI->>Git: stage fixed files (if any)
Hook->>CLI: run license:check {staged_files}
CLI->>Tool: run check mode
Tool-->>Hook: report success/failure
alt commit allowed
Dev->>Git: commit & push
Git->>CI: trigger license-header workflow (push/PR)
CI->>CLI: run pnpm license:check (full-repo)
CLI->>Tool: verify repository files
Tool-->>CI: report compliance
else commit blocked
Hook-->>Dev: block commit (fix required)
end
Estimated Code Review Effort🎯 3 (Moderate) | ⏱️ ~25 minutes Possibly related PRs
Poem
🚥 Pre-merge checks | ✅ 2 | ❌ 1❌ Failed checks (1 warning)
✅ Passed checks (2 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Comment |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 3
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Inline comments:
In `@apps/backend/src/utils/test.ts`:
- Around line 5-6: The file apps/backend/src/utils/test.ts contains temporary
debug/demo code (the constant x and console.log) that should not be in the
backend source; remove the file or relocate it to a test fixtures folder (e.g.,
tests/fixtures) if it's intentionally required, and delete the lines defining
the constant x and the console.log('x', x) call to keep production code clean.
In `@CONTRIBUTING.md`:
- Around line 87-88: Update the wording for the two npm scripts pnpm license:fix
and pnpm license:check to clarify they operate on both tracked and untracked
applicable files when running full-repo mode; replace the phrase "tracked
applicable files" with "tracked and untracked applicable files (full-repo mode
uses git ls-files --cached --others --exclude-standard)" so contributors
understand untracked files are included.
In `@scripts/spdx-license-cli.mjs`:
- Around line 54-63: The current target filter computes isSourceFile using
SOURCE_ROOTS, "/src/" presence, and hasSupportedExtension(filePath) but doesn't
exclude config/tooling filenames (e.g., drizzle.config.ts), so add an explicit
negative check before returning isSourceFile: detect filenames matching common
config/tooling patterns (for example filePath matching /\.config\.(t|j)sx?$/ or
known tooling names like /^drizzle\.config\./, and other dot-config patterns
such as /\.rc\.(t|j)sx?$/) and return false for those; update the logic around
filePath and isSourceFile so config/tooling files are filtered out even if under
apps/**/src or packages/**/src and have a supported extension.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 62533bc1-e6ca-443e-89f8-629cff086205
⛔ Files ignored due to path filters (1)
pnpm-lock.yamlis excluded by!**/pnpm-lock.yaml
📒 Files selected for processing (11)
.github/workflows/license-header.yml.license-check-and-add.base.json.license-header.txtCONTRIBUTING.mdapps/backend/src/scripts/run-migrations.mjsapps/backend/src/utils/test.tsapps/web/src/components/Layout/tabs/useTabMetadata.tslefthook.ymlpackage.jsonpackages/ui/src/components/hover-card.tsxscripts/spdx-license-cli.mjs
…g config handling - Modified CONTRIBUTING.md to clarify that license commands now operate on both tracked and untracked files. - Updated lefthook.yml to remove staged-only flags from license commands for broader application. - Removed outdated staged license commands from package.json. - Enhanced spdx-license-cli.mjs to exclude tooling configuration files from license checks.
There was a problem hiding this comment.
🧹 Nitpick comments (1)
CONTRIBUTING.md (1)
70-82: Consider clarifying the config file exclusion patterns.Line 80 mentions "tool/config files such as
drizzle.config.ts" but the implementation excludes several common patterns (based on TOOLING_CONFIG_PATTERNS in context snippet 2):
*.config.ts/js/tsx/jsx(e.g.,vite.config.ts,tailwind.config.js)*.rc.ts/js/tsx/jsx(e.g.,foo.rc.ts).foorc.ts/js/tsx/jsx(e.g.,.eslintrc.ts)Contributors might be confused if their
vite.config.tsor.eslintrc.tsfiles are skipped without being mentioned.📝 Suggested clarification
-- `*.mjs`, `*.cjs`, and tool/config files such as `drizzle.config.ts` +- `*.mjs`, `*.cjs`, and tool/config files (e.g., `drizzle.config.ts`, `*.config.{ts,js,tsx,jsx}`, `*.rc.{ts,js,tsx,jsx}`, `.eslintrc.*`)🤖 Prompt for AI Agents
Verify each finding against the current code and only fix it if needed. In `@CONTRIBUTING.md` around lines 70 - 82, Update the "Coverage and exclusions" section to explicitly list the config/tooling filename patterns that are skipped (use the same patterns as TOOLING_CONFIG_PATTERNS): include glob patterns like *.config.{ts,js,tsx,jsx}, *.rc.{ts,js,tsx,jsx}, and dot-prefixed forms like .*.rc.{ts,js,tsx,jsx} (examples: vite.config.ts, tailwind.config.js, foo.rc.ts, .eslintrc.ts) so contributors understand why those files are excluded; keep the wording concise and add a parenthetical note that these mirror the TOOLING_CONFIG_PATTERNS used by the automation.
🤖 Prompt for all review comments with AI agents
Verify each finding against the current code and only fix it if needed.
Nitpick comments:
In `@CONTRIBUTING.md`:
- Around line 70-82: Update the "Coverage and exclusions" section to explicitly
list the config/tooling filename patterns that are skipped (use the same
patterns as TOOLING_CONFIG_PATTERNS): include glob patterns like
*.config.{ts,js,tsx,jsx}, *.rc.{ts,js,tsx,jsx}, and dot-prefixed forms like
.*.rc.{ts,js,tsx,jsx} (examples: vite.config.ts, tailwind.config.js, foo.rc.ts,
.eslintrc.ts) so contributors understand why those files are excluded; keep the
wording concise and add a parenthetical note that these mirror the
TOOLING_CONFIG_PATTERNS used by the automation.
ℹ️ Review info
⚙️ Run configuration
Configuration used: defaults
Review profile: CHILL
Plan: Pro
Run ID: 331fc463-9cba-4207-bb6c-0338976e5615
📒 Files selected for processing (5)
CONTRIBUTING.mdapps/backend/src/scripts/run-migrations.mjslefthook.ymlpackage.jsonscripts/spdx-license-cli.mjs
✅ Files skipped from review due to trivial changes (3)
- apps/backend/src/scripts/run-migrations.mjs
- lefthook.yml
- scripts/spdx-license-cli.mjs
🚧 Files skipped from review as they are similar to previous changes (1)
- package.json
… automation - Clarified the list of excluded tooling/config filename patterns in CONTRIBUTING.md to enhance understanding of the SPDX automation process.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
SPDX Header Automation
Executive Summary
This change introduces automated SPDX license-header enforcement across the monorepo, with pre-commit auto-remediation and CI verification.
The goal is to eliminate manual header policing during review and make compliance deterministic for all applicable source files.
Problem Statement
SPDX coverage was previously a manual convention documented in
CONTRIBUTING.md, which created drift risk:Objectives
Final Scope (Intentionally Narrowed)
SPDX automation applies to source files under:
apps/**/src/**/*.{ts,tsx,js,jsx}packages/**/src/**/*.{ts,tsx,js,jsx}Explicitly excluded:
*.mjs,*.cjsdrizzle.config.ts, ESLint config files)*.d.ts*.gen.tsnode_modules,dist,.turbo,coverage)Architecture and Control Flow
Tooling
license-check-and-add.license-header.txt.license-check-and-add.base.jsonscripts/spdx-license-cli.mjsWhy a Wrapper Exists
The wrapper provides a stable monorepo command interface and enforces project-specific targeting rules:
Pre-commit Sequence
Configured in
lefthook.yml:spdx-fix(pnpm license:fix:staged {staged_files})format(pnpm format {staged_files})spdx-check(pnpm license:check:staged {staged_files})stage_fixed: trueensures auto-added headers are re-staged automatically.Key Deliverables
package.json:license:fixlicense:checklicense:fix:stagedlicense:check:staged.github/workflows/license-header.ymlpnpm license:checkonpull_requestandpushtomainCONTRIBUTING.mdto document:Verification Evidence
Validated during implementation:
pnpm license:checkpasses.mjsand config files are ignored by staged/full commands.mjs/cjsclasses.Performance Characteristics
Measured locally:
This keeps pre-commit overhead low while preserving enforcement guarantees.
Summary by CodeRabbit
New Features
Documentation
Chores