From 93af079137534f4be34ae1f0be4433d2a022ae90 Mon Sep 17 00:00:00 2001
From: Sudheendra Gopinath <sudheendra_g@yahoo.com>
Date: Wed, 3 Jun 2026 14:12:51 +0000
Subject: [PATCH] chore(ci): add PR lint workflow and SPDX header pre-commit
 hook

Add pr-lint.yml to enforce conventional commit PR titles and run
check-license-headers.sh on all tracked Rust, shell, and Dockerfile
sources. Add scripts/check-license-headers.sh and opt-in .githooks/pre-commit
(cargo fmt + staged header check). Apply AMD Apache-2.0 SPDX headers across
the codebase so the new checks pass.
---
 .githooks/pre-commit                          | 27 ++++++++
 .github/workflows/pr-lint.yml                 | 37 +++++++++++
 crates/spur-cloud-api/src/auth/github.rs      |  3 +
 crates/spur-cloud-api/src/auth/jwt.rs         |  3 +
 crates/spur-cloud-api/src/auth/middleware.rs  |  3 +
 crates/spur-cloud-api/src/auth/mod.rs         |  3 +
 crates/spur-cloud-api/src/auth/oidc_common.rs |  3 +
 crates/spur-cloud-api/src/auth/okta.rs        |  3 +
 crates/spur-cloud-api/src/auth/principal.rs   |  3 +
 crates/spur-cloud-api/src/config.rs           |  3 +
 crates/spur-cloud-api/src/db/billing_repo.rs  |  3 +
 crates/spur-cloud-api/src/db/migrations.rs    |  3 +
 crates/spur-cloud-api/src/db/mod.rs           |  3 +
 crates/spur-cloud-api/src/db/session_repo.rs  |  3 +
 crates/spur-cloud-api/src/db/ssh_key_repo.rs  |  3 +
 crates/spur-cloud-api/src/db/user_repo.rs     |  3 +
 crates/spur-cloud-api/src/main.rs             |  3 +
 crates/spur-cloud-api/src/models/mod.rs       |  3 +
 crates/spur-cloud-api/src/models/session.rs   |  3 +
 crates/spur-cloud-api/src/models/user.rs      |  3 +
 crates/spur-cloud-api/src/routes/admin.rs     |  3 +
 crates/spur-cloud-api/src/routes/auth.rs      |  3 +
 crates/spur-cloud-api/src/routes/billing.rs   |  3 +
 crates/spur-cloud-api/src/routes/gpus.rs      |  3 +
 crates/spur-cloud-api/src/routes/health.rs    |  3 +
 crates/spur-cloud-api/src/routes/mod.rs       |  3 +
 crates/spur-cloud-api/src/routes/sessions.rs  |  3 +
 crates/spur-cloud-api/src/routes/users.rs     |  3 +
 crates/spur-cloud-api/src/routes/ws.rs        |  3 +
 crates/spur-cloud-api/src/spur_client.rs      |  3 +
 crates/spur-cloud-api/src/ssh/mod.rs          |  3 +
 .../spur-cloud-api/src/ssh/service_manager.rs |  3 +
 crates/spur-cloud-api/src/state.rs            |  3 +
 crates/spur-cloud-api/src/terminal/mod.rs     |  3 +
 .../spur-cloud-api/src/terminal/ws_handler.rs |  3 +
 crates/spur-cloud-api/src/update.rs           |  3 +
 crates/spur-cloud-common/src/gpu_types.rs     |  3 +
 crates/spur-cloud-common/src/lib.rs           |  3 +
 crates/spur-cloud-common/src/session_types.rs |  3 +
 deploy/docker/Dockerfile.api                  |  3 +
 deploy/docker/Dockerfile.frontend             |  3 +
 deploy/docker/Dockerfile.session              |  3 +
 deploy/docker/gpuaas-entrypoint.sh            |  3 +
 scripts/check-license-headers.sh              | 61 +++++++++++++++++++
 44 files changed, 248 insertions(+)
 create mode 100755 .githooks/pre-commit
 create mode 100644 .github/workflows/pr-lint.yml
 create mode 100755 scripts/check-license-headers.sh

diff --git a/.githooks/pre-commit b/.githooks/pre-commit
new file mode 100755
index 0000000..cb3fad4
--- /dev/null
+++ b/.githooks/pre-commit
@@ -0,0 +1,27 @@
+#!/usr/bin/env bash
+#
+# Pre-commit checks:
+#   1. cargo fmt --check
+#   2. SPDX license headers on staged source files
+#
+# Bypass with: git commit --no-verify
+
+if command -v cargo >/dev/null 2>&1; then
+  if ! cargo fmt --all --check 2>/dev/null; then
+    echo "pre-commit: cargo fmt found unformatted code."
+    echo ""
+    echo "  Run: cargo fmt --all"
+    echo "  Bypass with: git commit --no-verify"
+    exit 1
+  fi
+fi
+
+# Check SPDX license headers on staged source files
+mapfile -t staged < <(
+    git diff --cached --name-only --diff-filter=d -- '*.rs' '*.proto' '*.py' '*.sh' '**/Dockerfile*'
+)
+
+if [ ${#staged[@]} -gt 0 ]; then
+  REPO_ROOT="$(git rev-parse --show-toplevel)"
+  "$REPO_ROOT/scripts/check-license-headers.sh" "${staged[@]}" || exit 1
+fi
diff --git a/.github/workflows/pr-lint.yml b/.github/workflows/pr-lint.yml
new file mode 100644
index 0000000..c63d048
--- /dev/null
+++ b/.github/workflows/pr-lint.yml
@@ -0,0 +1,37 @@
+name: PR Lint
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize]
+
+permissions:
+  contents: read
+
+jobs:
+  validate-pr-title:
+    runs-on: ubuntu-latest
+    env:
+      PATTERN: "^(feat|fix|docs|style|refactor|perf|test|build|ci|chore|revert)(\\([a-zA-Z0-9_-]+\\))?!?: .+$"
+
+    steps:
+      - name: Validate PR title
+        env:
+          PR_TITLE: ${{ github.event.pull_request.title }}
+        run: |
+          echo "Checking PR title: '$PR_TITLE'"
+          if ! echo "$PR_TITLE" | grep -Eq "$PATTERN"; then
+            echo "FAIL: PR title does not match conventional commits format."
+            echo "Expected: type(scope): description  (e.g. 'feat(spur-cloud-api): add session API')"
+            echo "Valid types: feat fix docs style refactor perf test build ci chore revert"
+            exit 1
+          fi
+          echo "PASS: PR title is valid."
+
+  license-headers:
+    name: SPDX License Headers
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Check SPDX license headers
+        run: ./scripts/check-license-headers.sh
diff --git a/crates/spur-cloud-api/src/auth/github.rs b/crates/spur-cloud-api/src/auth/github.rs
index cd93507..09171b2 100644
--- a/crates/spur-cloud-api/src/auth/github.rs
+++ b/crates/spur-cloud-api/src/auth/github.rs
@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use axum::{
     extract::{Query, State},
     http::StatusCode,
diff --git a/crates/spur-cloud-api/src/auth/jwt.rs b/crates/spur-cloud-api/src/auth/jwt.rs
index 2f66bb2..0420589 100644
--- a/crates/spur-cloud-api/src/auth/jwt.rs
+++ b/crates/spur-cloud-api/src/auth/jwt.rs
@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use chrono::{Duration, Utc};
 use jsonwebtoken::{decode, encode, DecodingKey, EncodingKey, Header, Validation};
 use serde::{Deserialize, Serialize};
diff --git a/crates/spur-cloud-api/src/auth/middleware.rs b/crates/spur-cloud-api/src/auth/middleware.rs
index cfc3ab1..6a8fb75 100644
--- a/crates/spur-cloud-api/src/auth/middleware.rs
+++ b/crates/spur-cloud-api/src/auth/middleware.rs
@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use axum::{
     extract::{Request, State},
     http::StatusCode,
diff --git a/crates/spur-cloud-api/src/auth/mod.rs b/crates/spur-cloud-api/src/auth/mod.rs
index d40a44a..360a552 100644
--- a/crates/spur-cloud-api/src/auth/mod.rs
+++ b/crates/spur-cloud-api/src/auth/mod.rs
@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 pub mod github;
 pub mod jwt;
 pub mod middleware;
diff --git a/crates/spur-cloud-api/src/auth/oidc_common.rs b/crates/spur-cloud-api/src/auth/oidc_common.rs
index 164a4bc..77f44cf 100644
--- a/crates/spur-cloud-api/src/auth/oidc_common.rs
+++ b/crates/spur-cloud-api/src/auth/oidc_common.rs
@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use axum::http::HeaderMap;
 use serde::Deserialize;
 use tracing::debug;
diff --git a/crates/spur-cloud-api/src/auth/okta.rs b/crates/spur-cloud-api/src/auth/okta.rs
index 7d95ecb..18795c8 100644
--- a/crates/spur-cloud-api/src/auth/okta.rs
+++ b/crates/spur-cloud-api/src/auth/okta.rs
@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use axum::{
     extract::{Query, State},
     http::StatusCode,
diff --git a/crates/spur-cloud-api/src/auth/principal.rs b/crates/spur-cloud-api/src/auth/principal.rs
index 20d7af7..c7affd6 100644
--- a/crates/spur-cloud-api/src/auth/principal.rs
+++ b/crates/spur-cloud-api/src/auth/principal.rs
@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use uuid::Uuid;
 
 /// Authenticated caller normalized at the application boundary.
diff --git a/crates/spur-cloud-api/src/config.rs b/crates/spur-cloud-api/src/config.rs
index 8e6e5fe..fb42ccd 100644
--- a/crates/spur-cloud-api/src/config.rs
+++ b/crates/spur-cloud-api/src/config.rs
@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use serde::Deserialize;
 
 #[derive(Debug, Clone, Deserialize, Default, PartialEq)]
diff --git a/crates/spur-cloud-api/src/db/billing_repo.rs b/crates/spur-cloud-api/src/db/billing_repo.rs
index ea70daa..2b9580a 100644
--- a/crates/spur-cloud-api/src/db/billing_repo.rs
+++ b/crates/spur-cloud-api/src/db/billing_repo.rs
@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use chrono::{DateTime, Utc};
 use serde::Serialize;
 use sqlx::PgPool;
diff --git a/crates/spur-cloud-api/src/db/migrations.rs b/crates/spur-cloud-api/src/db/migrations.rs
index 0cc321c..bf7a0e3 100644
--- a/crates/spur-cloud-api/src/db/migrations.rs
+++ b/crates/spur-cloud-api/src/db/migrations.rs
@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use sqlx::PgPool;
 use tracing::info;
 
diff --git a/crates/spur-cloud-api/src/db/mod.rs b/crates/spur-cloud-api/src/db/mod.rs
index ab0b607..9ad0d6f 100644
--- a/crates/spur-cloud-api/src/db/mod.rs
+++ b/crates/spur-cloud-api/src/db/mod.rs
@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 pub mod billing_repo;
 pub mod migrations;
 pub mod session_repo;
diff --git a/crates/spur-cloud-api/src/db/session_repo.rs b/crates/spur-cloud-api/src/db/session_repo.rs
index 69e89e4..35d991f 100644
--- a/crates/spur-cloud-api/src/db/session_repo.rs
+++ b/crates/spur-cloud-api/src/db/session_repo.rs
@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use chrono::Utc;
 use sqlx::PgPool;
 use uuid::Uuid;
diff --git a/crates/spur-cloud-api/src/db/ssh_key_repo.rs b/crates/spur-cloud-api/src/db/ssh_key_repo.rs
index af2db57..1e5d7c0 100644
--- a/crates/spur-cloud-api/src/db/ssh_key_repo.rs
+++ b/crates/spur-cloud-api/src/db/ssh_key_repo.rs
@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use sqlx::PgPool;
 use uuid::Uuid;
 
diff --git a/crates/spur-cloud-api/src/db/user_repo.rs b/crates/spur-cloud-api/src/db/user_repo.rs
index 1b45931..8a6f98e 100644
--- a/crates/spur-cloud-api/src/db/user_repo.rs
+++ b/crates/spur-cloud-api/src/db/user_repo.rs
@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use sqlx::PgPool;
 use uuid::Uuid;
 
diff --git a/crates/spur-cloud-api/src/main.rs b/crates/spur-cloud-api/src/main.rs
index 74249d5..ac2758f 100644
--- a/crates/spur-cloud-api/src/main.rs
+++ b/crates/spur-cloud-api/src/main.rs
@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 mod auth;
 mod config;
 mod db;
diff --git a/crates/spur-cloud-api/src/models/mod.rs b/crates/spur-cloud-api/src/models/mod.rs
index f950c0f..677b880 100644
--- a/crates/spur-cloud-api/src/models/mod.rs
+++ b/crates/spur-cloud-api/src/models/mod.rs
@@ -1,2 +1,5 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 pub mod session;
 pub mod user;
diff --git a/crates/spur-cloud-api/src/models/session.rs b/crates/spur-cloud-api/src/models/session.rs
index 3ecb73f..3b4b84d 100644
--- a/crates/spur-cloud-api/src/models/session.rs
+++ b/crates/spur-cloud-api/src/models/session.rs
@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use chrono::{DateTime, Utc};
 use serde::Serialize;
 use uuid::Uuid;
diff --git a/crates/spur-cloud-api/src/models/user.rs b/crates/spur-cloud-api/src/models/user.rs
index 9c66006..355bc36 100644
--- a/crates/spur-cloud-api/src/models/user.rs
+++ b/crates/spur-cloud-api/src/models/user.rs
@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use chrono::{DateTime, Utc};
 use serde::{Deserialize, Serialize};
 use uuid::Uuid;
diff --git a/crates/spur-cloud-api/src/routes/admin.rs b/crates/spur-cloud-api/src/routes/admin.rs
index 8841f71..60448d5 100644
--- a/crates/spur-cloud-api/src/routes/admin.rs
+++ b/crates/spur-cloud-api/src/routes/admin.rs
@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use axum::extract::State;
 use axum::{http::StatusCode, response::IntoResponse, Extension, Json};
 use serde::Deserialize;
diff --git a/crates/spur-cloud-api/src/routes/auth.rs b/crates/spur-cloud-api/src/routes/auth.rs
index 3fbb7d7..581c6fd 100644
--- a/crates/spur-cloud-api/src/routes/auth.rs
+++ b/crates/spur-cloud-api/src/routes/auth.rs
@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use axum::{extract::State, http::StatusCode, response::IntoResponse, Json};
 use serde::{Deserialize, Serialize};
 
diff --git a/crates/spur-cloud-api/src/routes/billing.rs b/crates/spur-cloud-api/src/routes/billing.rs
index 28c530d..9a6f099 100644
--- a/crates/spur-cloud-api/src/routes/billing.rs
+++ b/crates/spur-cloud-api/src/routes/billing.rs
@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use axum::{
     extract::{Query, State},
     http::StatusCode,
diff --git a/crates/spur-cloud-api/src/routes/gpus.rs b/crates/spur-cloud-api/src/routes/gpus.rs
index 3f056ba..ff662d4 100644
--- a/crates/spur-cloud-api/src/routes/gpus.rs
+++ b/crates/spur-cloud-api/src/routes/gpus.rs
@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use axum::{extract::State, http::StatusCode, response::IntoResponse, Json};
 use tracing::error;
 
diff --git a/crates/spur-cloud-api/src/routes/health.rs b/crates/spur-cloud-api/src/routes/health.rs
index 39e8d1f..589827d 100644
--- a/crates/spur-cloud-api/src/routes/health.rs
+++ b/crates/spur-cloud-api/src/routes/health.rs
@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use axum::{extract::State, http::StatusCode, response::IntoResponse};
 
 use crate::state::AppState;
diff --git a/crates/spur-cloud-api/src/routes/mod.rs b/crates/spur-cloud-api/src/routes/mod.rs
index 949368a..1a80fc2 100644
--- a/crates/spur-cloud-api/src/routes/mod.rs
+++ b/crates/spur-cloud-api/src/routes/mod.rs
@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 pub mod admin;
 pub mod auth;
 pub mod billing;
diff --git a/crates/spur-cloud-api/src/routes/sessions.rs b/crates/spur-cloud-api/src/routes/sessions.rs
index 756fab7..2de6907 100644
--- a/crates/spur-cloud-api/src/routes/sessions.rs
+++ b/crates/spur-cloud-api/src/routes/sessions.rs
@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use axum::{
     extract::{Path, Query, State},
     http::StatusCode,
diff --git a/crates/spur-cloud-api/src/routes/users.rs b/crates/spur-cloud-api/src/routes/users.rs
index c4afdd4..01c4cdc 100644
--- a/crates/spur-cloud-api/src/routes/users.rs
+++ b/crates/spur-cloud-api/src/routes/users.rs
@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use axum::{
     extract::{Path, State},
     http::StatusCode,
diff --git a/crates/spur-cloud-api/src/routes/ws.rs b/crates/spur-cloud-api/src/routes/ws.rs
index ac9e3e6..0fa35ce 100644
--- a/crates/spur-cloud-api/src/routes/ws.rs
+++ b/crates/spur-cloud-api/src/routes/ws.rs
@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use axum::{
     extract::{Path, State, WebSocketUpgrade},
     http::StatusCode,
diff --git a/crates/spur-cloud-api/src/spur_client.rs b/crates/spur-cloud-api/src/spur_client.rs
index d6e4495..083c27f 100644
--- a/crates/spur-cloud-api/src/spur_client.rs
+++ b/crates/spur-cloud-api/src/spur_client.rs
@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use std::collections::{BTreeMap, HashMap};
 
 use kube::api::{Api, DeleteParams, PostParams};
diff --git a/crates/spur-cloud-api/src/ssh/mod.rs b/crates/spur-cloud-api/src/ssh/mod.rs
index e39b809..b5fe2de 100644
--- a/crates/spur-cloud-api/src/ssh/mod.rs
+++ b/crates/spur-cloud-api/src/ssh/mod.rs
@@ -1 +1,4 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 pub mod service_manager;
diff --git a/crates/spur-cloud-api/src/ssh/service_manager.rs b/crates/spur-cloud-api/src/ssh/service_manager.rs
index d0ceaf8..4b76158 100644
--- a/crates/spur-cloud-api/src/ssh/service_manager.rs
+++ b/crates/spur-cloud-api/src/ssh/service_manager.rs
@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use k8s_openapi::api::core::v1::{Service, ServicePort, ServiceSpec};
 use k8s_openapi::apimachinery::pkg::util::intstr::IntOrString;
 use kube::api::{Api, DeleteParams, ObjectMeta, PostParams};
diff --git a/crates/spur-cloud-api/src/state.rs b/crates/spur-cloud-api/src/state.rs
index 97c646a..319d3de 100644
--- a/crates/spur-cloud-api/src/state.rs
+++ b/crates/spur-cloud-api/src/state.rs
@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use std::sync::Arc;
 
 use sqlx::PgPool;
diff --git a/crates/spur-cloud-api/src/terminal/mod.rs b/crates/spur-cloud-api/src/terminal/mod.rs
index 39e80e6..8c864c6 100644
--- a/crates/spur-cloud-api/src/terminal/mod.rs
+++ b/crates/spur-cloud-api/src/terminal/mod.rs
@@ -1 +1,4 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 pub mod ws_handler;
diff --git a/crates/spur-cloud-api/src/terminal/ws_handler.rs b/crates/spur-cloud-api/src/terminal/ws_handler.rs
index 6c1607b..fe91e8a 100644
--- a/crates/spur-cloud-api/src/terminal/ws_handler.rs
+++ b/crates/spur-cloud-api/src/terminal/ws_handler.rs
@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use axum::extract::ws::{Message, WebSocket};
 use futures_util::{SinkExt, StreamExt};
 use k8s_openapi::api::core::v1::Pod;
diff --git a/crates/spur-cloud-api/src/update.rs b/crates/spur-cloud-api/src/update.rs
index 7861c25..f016bfb 100644
--- a/crates/spur-cloud-api/src/update.rs
+++ b/crates/spur-cloud-api/src/update.rs
@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 //! Auto-update check for spur-cloud-api.
 //!
 //! On startup, queries the GitHub releases API for ROCm/spur-cloud
diff --git a/crates/spur-cloud-common/src/gpu_types.rs b/crates/spur-cloud-common/src/gpu_types.rs
index f7befef..212b7b0 100644
--- a/crates/spur-cloud-common/src/gpu_types.rs
+++ b/crates/spur-cloud-common/src/gpu_types.rs
@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use serde::{Deserialize, Serialize};
 
 #[derive(Debug, Clone, Serialize, Deserialize)]
diff --git a/crates/spur-cloud-common/src/lib.rs b/crates/spur-cloud-common/src/lib.rs
index db2f85e..95f432f 100644
--- a/crates/spur-cloud-common/src/lib.rs
+++ b/crates/spur-cloud-common/src/lib.rs
@@ -1,2 +1,5 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 pub mod gpu_types;
 pub mod session_types;
diff --git a/crates/spur-cloud-common/src/session_types.rs b/crates/spur-cloud-common/src/session_types.rs
index 7570eb7..cb7a056 100644
--- a/crates/spur-cloud-common/src/session_types.rs
+++ b/crates/spur-cloud-common/src/session_types.rs
@@ -1,3 +1,6 @@
+// Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+// SPDX-License-Identifier: Apache-2.0
+
 use chrono::{DateTime, Utc};
 use serde::{Deserialize, Serialize};
 use uuid::Uuid;
diff --git a/deploy/docker/Dockerfile.api b/deploy/docker/Dockerfile.api
index 3f124a4..3efed51 100644
--- a/deploy/docker/Dockerfile.api
+++ b/deploy/docker/Dockerfile.api
@@ -1,3 +1,6 @@
+# Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 # Multi-stage build for spur-cloud-api
 FROM rust:1.88-bookworm AS builder
 
diff --git a/deploy/docker/Dockerfile.frontend b/deploy/docker/Dockerfile.frontend
index 023693f..7ad32de 100644
--- a/deploy/docker/Dockerfile.frontend
+++ b/deploy/docker/Dockerfile.frontend
@@ -1,3 +1,6 @@
+# Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 # Multi-stage build for spur-cloud frontend
 FROM node:20-alpine AS builder
 
diff --git a/deploy/docker/Dockerfile.session b/deploy/docker/Dockerfile.session
index cd9dbee..e78793c 100644
--- a/deploy/docker/Dockerfile.session
+++ b/deploy/docker/Dockerfile.session
@@ -1,3 +1,6 @@
+# Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 # Base GPU session image with sshd
 # Build for AMD ROCm GPUs
 FROM rocm/pytorch:latest
diff --git a/deploy/docker/gpuaas-entrypoint.sh b/deploy/docker/gpuaas-entrypoint.sh
index 8e86217..f77ab3a 100644
--- a/deploy/docker/gpuaas-entrypoint.sh
+++ b/deploy/docker/gpuaas-entrypoint.sh
@@ -1,4 +1,7 @@
 #!/bin/bash
+# Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
 set -e
 
 # Inject SSH keys from environment variable
diff --git a/scripts/check-license-headers.sh b/scripts/check-license-headers.sh
new file mode 100755
index 0000000..dc8cc57
--- /dev/null
+++ b/scripts/check-license-headers.sh
@@ -0,0 +1,61 @@
+#!/bin/bash
+
+# Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+# Checks that source files contain the SPDX license header.
+# Used by both the pre-commit hook and CI workflow.
+#
+# Usage:
+#   scripts/check-license-headers.sh          # check all tracked source files
+#   scripts/check-license-headers.sh file...  # check specific files only
+
+set -euo pipefail
+
+SPDX_TAG="SPDX-License-Identifier: Apache-2.0"
+
+check_file() {
+    local file="$1"
+    # Read enough lines to find the header (shebangs push it down a line or two)
+    if ! head -5 "$file" | grep -qF "$SPDX_TAG"; then
+        echo "  $file"
+        return 1
+    fi
+    return 0
+}
+
+# If arguments were passed, check only those files; otherwise check all tracked files.
+if [ $# -gt 0 ]; then
+    files=("$@")
+else
+    mapfile -t files < <(git ls-files -- '*.rs' '*.proto' '*.py' '*.sh' '**/Dockerfile*')
+fi
+
+failed=0
+missing=()
+
+for f in "${files[@]}"; do
+    [ -f "$f" ] || continue
+    if ! check_file "$f"; then
+        missing+=("$f")
+        failed=1
+    fi
+done
+
+if [ "$failed" -ne 0 ]; then
+    echo ""
+    echo "ERROR: ${#missing[@]} file(s) missing SPDX license header."
+    echo "Each source file (.rs, .proto, .py, .sh, Dockerfile) must contain:"
+    echo "  SPDX-License-Identifier: Apache-2.0"
+    echo ""
+    echo "For .rs and .proto files, add these lines at the top:"
+    echo "  // Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved."
+    echo "  // SPDX-License-Identifier: Apache-2.0"
+    echo ""
+    echo "For .py and .sh files (after the shebang, if any):"
+    echo "  # Copyright (c) 2026 Advanced Micro Devices, Inc. All rights reserved."
+    echo "  # SPDX-License-Identifier: Apache-2.0"
+    exit 1
+fi
+
+echo "All source files have SPDX license headers."