Migrate to REUSE.toml and update GitHub Actions

[woocheol-lge]

Summary by CodeRabbit

• Chores
  • Updated automated build, release, and pull request checks to use newer third-party action versions.
  • Refreshed repository compliance metadata for clearer license tracking.
• Documentation
  • Simplified the pull request template by removing an unused placeholder section.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR upgrades GitHub Actions versions across CI workflows (checkout, push-action, setup-python, reuse-action, release-drafter), migrates REUSE license/copyright metadata from .reuse/dep5 to a new REUSE.toml, and removes a description placeholder from the PR template.

Changes

CI Workflow and REUSE Metadata Updates

Layer / File(s)	Summary
publish-release workflow upgrades .github/workflows/publish-release.yml	Bumps actions/checkout from v3 to v7, ad-m/github-push-action from @master to v1.3.0, actions/setup-python from v4 to v6, and adjusts the changelog step name casing.
pull-request workflow upgrades .github/workflows/pull-request.yml	Bumps actions/checkout to v7 in build and reuse jobs, and updates fsfe/reuse-action from v1 to v6.
release-drafter version bump .github/workflows/release-drafter-config.yml	Updates release-drafter/release-drafter from v5 to v7.
REUSE metadata migration REUSE.toml, .reuse/dep5, .github/PULL_REQUEST_TEMPLATE.md	Replaces .reuse/dep5 with REUSE.toml containing SPDX package metadata and file-pattern annotations, and removes the description placeholder block from the PR template.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• fosslight/fosslight_util#257: Both PRs modify .github/PULL_REQUEST_TEMPLATE.md by removing different sections of the PR template content.

Suggested reviewers: soimkim

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes: migrating REUSE metadata to REUSE.toml and updating GitHub Actions.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch git_t

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

🧹 Nitpick comments (2)

.github/workflows/publish-release.yml (1)

14-16: 🔒 Security & Privacy | 🔵 Trivial | ⚡ Quick win

Consider disabling credential persistence on checkout.

Both checkout steps in this file (update-changelog and deploy jobs) leave the git credential persisted in the local git config by default, which zizmor flags (artipacked). Since neither job needs to push using the checkout's own credential (the push step uses a separate PAT via ad-m/github-push-action, and the deploy job only builds/publishes to PyPI), setting persist-credentials: false reduces the window where a leaked credential from a later step could be abused.

🔒️ Suggested fix

     - uses: actions/checkout@v7
       with:
         fetch-depth: 0
+        persist-credentials: false

and

     - uses: actions/checkout@v7
       with:
         ref: main
+        persist-credentials: false

Also applies to: 57-59

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/publish-release.yml around lines 14 - 16, The checkout
steps in the workflow are persisting Git credentials by default, which is
unnecessary here and should be disabled. Update each uses of actions/checkout in
the update-changelog and deploy jobs to set persist-credentials to false,
keeping fetch-depth as needed. Reference the checkout steps and related
publish-release workflow jobs so the change is applied consistently in both
places.

Source: Linters/SAST tools

.github/workflows/pull-request.yml (1)

39-42: 🔒 Security & Privacy | 🔵 Trivial | 💤 Low value

Harden checkout with persist-credentials: false.

Static analysis flags credential persistence (artipacked) on both checkout steps. The reuse job only needs read access for linting and doesn't need the token persisted to disk afterward.

🔒️ Suggested fix

   reuse:
     runs-on: ubuntu-latest
     steps:
     - uses: actions/checkout@v7
+      with:
+        persist-credentials: false
     - name: REUSE Compliance Check
       uses: fsfe/reuse-action@v6

Same applies to the build job's checkout at line 21.

🤖 Prompt for AI Agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

In @.github/workflows/pull-request.yml around lines 39 - 42, The checkout steps
in both the build job and the REUSE Compliance Check job should not persist
credentials to disk. Update the actions/checkout usage in the workflow to set
persist-credentials to false for each checkout step, since these jobs only need
repository read access and do not require the token after checkout.

Source: Linters/SAST tools

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Nitpick comments:
In @.github/workflows/publish-release.yml:
- Around line 14-16: The checkout steps in the workflow are persisting Git
credentials by default, which is unnecessary here and should be disabled. Update
each uses of actions/checkout in the update-changelog and deploy jobs to set
persist-credentials to false, keeping fetch-depth as needed. Reference the
checkout steps and related publish-release workflow jobs so the change is
applied consistently in both places.

In @.github/workflows/pull-request.yml:
- Around line 39-42: The checkout steps in both the build job and the REUSE
Compliance Check job should not persist credentials to disk. Update the
actions/checkout usage in the workflow to set persist-credentials to false for
each checkout step, since these jobs only need repository read access and do not
require the token after checkout.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro

Run ID: 3cacaa1e-cd52-44c8-8861-1f6d081c2727

📥 Commits

Reviewing files that changed from the base of the PR and between c295cb5 and 85b4652.

📒 Files selected for processing (6)

• .github/PULL_REQUEST_TEMPLATE.md
• .github/workflows/publish-release.yml
• .github/workflows/pull-request.yml
• .github/workflows/release-drafter-config.yml
• .reuse/dep5
• REUSE.toml

💤 Files with no reviewable changes (2)

• .reuse/dep5
• .github/PULL_REQUEST_TEMPLATE.md