scripts: ci: check_compliance: Warn on missing Apache-2.0 license

[pdgendt]

Print a compliance warning if a modified file is not licensed under Apache-2.0.

Missing license files are now turned into compliance errors.

[kartben]

this seems like an unrelated change? We'd first need to add all okay-ish license to /LICENSES until we can turn this into an error?

[pdgendt]

Yeah, the PR was a draft for that reason, the intention is to add the allowed licenses alongside that change.

But I wanted to get some feedback first 🙂

EDIT: License files added

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud

[fabiobaltieri]

Ok so now if any file that does not have an apache spdx header gets modified it'll fail compliance, right? Meaning that to merge it we'll have to bypass the check.

[pdgendt]

Ok so now if any file that does not have an apache spdx header gets modified it'll fail compliance, right? Meaning that to merge it we'll have to bypass the check.

Not really, if it has a compliant license header (from the LICENSES directory), but misses the apache one, it will put a non-blocking warning annotation (similar to the generic missing one currently).
If it has a non-compliant license header (missing from the LICENSES directory), it will be an error annotation and (presumably) block the merge.

[nashif]

what is the rationale behind this? This is just going to be generating noise and might trigger someone to take unnecessary action, i.e. I change checkpatch, I get:

File:scripts/checkpatch.pl
Line:1
WARNING : Test LicenseAndCopyrightCheck warning:
No Apache-2.0 license:File is not licensed under Apache-2.0
File:scripts/checkpatch.pl
Line:1
ERROR   : Test LicenseAndCopyrightCheck failed:
License may not be allowed:License file for 'GPL-2.0' not found in /LICENSES. Please check https://docs.zephyrproject.org/latest/contribute/guidelines.html#components-using-other-licenses.
File:scripts/checkpatch.pl

so now we will error on this as well?

[nashif]

errors on modified files that are GPL for example, checkpatch.pl

[pdgendt]

errors on modified files that are GPL for example, checkpatch.pl

Should we list and exclude these files explicitly?

what is the rationale behind this? This is just going to be generating noise

We currently have the same "noise" as the reuse tool won't find the license. The warning message is just more specific.

[fabiobaltieri]

Should we list and exclude these files explicitly?

They are kindof already listed in doc/LICENSING.rst, maybe we can list them in a structured way and generate that doc instead?

[nashif]

They are kindof already listed in doc/LICENSING.rst, maybe we can list them in a structured way and generate that doc instead?

yeah, that is something we should do, all exceptions in some yaml file, use it to generate the LICENSING.rst file and then apply exclusions when runnning reuse if that is possible. everyone will be happy.