ci: license-consistency check + finish AGPLv3 relicense on stale surfaces#152
Merged
Conversation
The v2.6.0 relicense (ADR-0009) left two more declarations on the old MIT terms, beyond the ca manifest + README callout fixed in #151: - plugins/ca-sandbox/.claude-plugin/plugin.json declared "license": "MIT" -- the sibling plugin's machine-readable field. Now AGPL-3.0-only (the repo LICENSE is AGPLv3 and ADR-0009 carves out no exception for ca-sandbox). 0.1.1 is untagged, so no version bump is required. - .codearbiter/coding-standards.md still stated "License is MIT; copyright holder codeArbiter contributors". Corrected to AGPL-3.0-only / SUaDtL per ADR-0009. CHANGELOG: ca-sandbox's plugin manifest now declares AGPL-3.0-only (was a stale MIT). Claude-Session: https://claude.ai/code/session_015tNUy37dx7DJGDzmVUB8Wf
A relicense must update several surfaces (both plugin manifests, LICENSE, the README badge + notice) and human review keeps missing some -- the v2.6.0 AGPLv3 relicense left three stale (the ca manifest + README callout fixed in #151, the ca-sandbox manifest fixed in the preceding commit). This adds a mechanical CI guard so a partial relicense fails the build instead of shipping. check_license_consistency.py is stdlib-only with pure functions that degrade to a finding rather than raise. It reads ONLY the enumerated surfaces -- never a repo-wide grep -- so third-party (package-lock) and historical (CHANGELOG/ADR) license mentions can't false-positive. ca's plugin.json `license` is the canonical SPDX; a LICENSE_FAMILIES table maps it to each surface's identifying markers, so the check is license-agnostic (a future relicense adds an entry, not a rewrite). A fixed forbidden-phrase set guards retired commercial-offering prose. Wired as a repo-wide, always-on ci.yml job in the required-checks aggregation. security-reviewer PASS (no untrusted-input / secret / privilege concerns). Spec: .codearbiter/specs/license-consistency-check.md. 23 unit tests cover AC-1..10. Claude-Session: https://claude.ai/code/session_015tNUy37dx7DJGDzmVUB8Wf
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds the license-consistency CI guard you asked for, and fixes the two more stale-relicense surfaces it surfaced. Built test-first through
/ca:feature(spec → tdd). Two commits.fix(license)— finish the AGPLv3 relicense (4326cf0)The v2.6.0 relicense left two declarations beyond #151's still on MIT:
plugins/ca-sandbox/.claude-plugin/plugin.jsondeclared"license": "MIT"→AGPL-3.0-only(the repo LICENSE is AGPLv3; ADR-0009 carves out no exception). 0.1.1 is untagged, so no version bump..codearbiter/coding-standards.mdstill said "License is MIT; copyright holder 'codeArbiter contributors'" → corrected to AGPL-3.0-only / SUaDtL.ci— license-consistency check (762376c).github/scripts/check_license_consistency.pyasserts every project license-declaration surface agrees with the canonical SPDX (ca'splugin.json):licensefields,available separately,offers the same code).Robust by design: reads only the enumerated surfaces (never a repo-wide grep), so
package-lockand historical CHANGELOG/ADR "MIT" mentions can't false-positive; pure stdlib helpers that degrade to a finding rather than raise; license-agnostic via aLICENSE_FAMILIESmap (a future relicense adds an entry, not a rewrite). Wired as a repo-wide, always-onci.ymljob in the required-checks aggregation.Verification
test_license_consistency.py) cover AC-1..10 of the approved spec (.codearbiter/specs/license-consistency-check.md); full.github/scripts/test_*.pysuite green;py_compileclean;ci.ymlvalid YAML.python-versionand tag-pinned actions).Deliberately out of scope
coding-standards.md(internal doc) is corrected here but not added to the check's scope (reading internal docs widens false-positive risk). Flagging in case you want it guarded later.docs-site-product-redesign.*files were left untouched.https://claude.ai/code/session_015tNUy37dx7DJGDzmVUB8Wf