Add license validation for repositories by ludeeus · Pull Request #5343 · hacs/integration

ludeeus · 2026-07-03T07:50:22Z

Summary

This PR adds a new license validation check for repositories that verifies they have an OSI-approved license according to the SPDX license list.

Key Changes

New validator: Added custom_components/hacs/validate/license.py that:
- Checks if a repository has a license defined
- Fetches the official SPDX license list (v3.28.0) from GitHub
- Validates that the repository's license has a valid SPDX ID
- Ensures the license is OSI-approved
- Provides helpful error messages for various failure scenarios
Comprehensive test coverage: Added tests/validate/test_license.py with tests for:
- Missing license
- Unrecognized license (NOASSERTION)
- Missing SPDX ID
- Non-OSI-approved licenses (e.g., CC0-1.0)
- SPDX list fetch failures
- Valid OSI-approved licenses (MIT, GPL-3.0)
Test fixtures: Added mock SPDX license list data for testing
Integration: Updated existing integration test snapshots to reflect the new 9th validation check (previously 8)

Implementation Details

Uses the official SPDX license list from commit c4a7237ec8f4654e867546f9f409749300f1bf4c (v3.28.0)
Filters licenses by the isOsiApproved flag to determine validity
Handles network failures gracefully by raising validation exceptions
Includes debug logging for successful validations
Documentation PR: Document license check requirement for repository publishing documentation#687

https://claude.ai/code/session_01G9QQsoXZefeSfniDY9utsk

Add a license validation check that verifies the repository has an OSI-approved open source license, using the SPDX identifier reported by the GitHub API. The set of OSI-approved licenses is fetched on each invocation from the SPDX license list (spdx/license-list-data), pinned to the v3.28.0 release commit, filtering on isOsiApproved. Deprecated SPDX IDs (such as GPL-3.0) are kept since GitHub still reports them for many repositories. The pin carries a renovate annotation comment so a custom manager can keep it updated later. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G9QQsoXZefeSfniDY9utsk

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G9QQsoXZefeSfniDY9utsk

Copilot

Pull request overview

This pull request introduces a new HACS Action validator that enforces repositories to have an OSI-approved license by validating the repo’s detected SPDX ID against the official SPDX license list, and updates tests/snapshots to reflect the added check.

Changes:

Added a new license validator that downloads the SPDX license list and enforces isOsiApproved.
Added unit tests and a mocked SPDX license-list fixture for validation scenarios.
Updated action/integration snapshots and “checks passed” totals to account for the 9th validator.

Reviewed changes

Copilot reviewed 16 out of 21 changed files in this pull request and generated 3 comments.

Show a summary per file

File	Description
custom_components/hacs/validate/license.py	New validator that fetches SPDX license data and validates OSI approval.
tests/validate/test_license.py	New tests covering missing/unrecognized/non-OSI licenses and fetch failures.
tests/fixtures/proxy/raw.githubusercontent.com/spdx/license-list-data/c4a7237ec8f4654e867546f9f409749300f1bf4c/json/licenses.json	Mock SPDX license list used by tests.
tests/action/test_hacs_action_integration.py	Updates expected “checks passed/failed” counts from 8 to 9.
tests/snapshots/api-usage/tests/validate/test_licensetest-spdx-license-list-fetch-failure.json	New API-usage snapshot for SPDX fetch-failure test.
tests/snapshots/api-usage/tests/validate/test_licensetest-repository-unrecognized-license.json	New API-usage snapshot for unrecognized license test.
tests/snapshots/api-usage/tests/validate/test_licensetest-repository-osi-approved-license-mit.json	New API-usage snapshot for MIT OSI-approved license test.
tests/snapshots/api-usage/tests/validate/test_licensetest-repository-osi-approved-license-gpl-3-0.json	New API-usage snapshot for GPL-3.0 OSI-approved license test.
tests/snapshots/api-usage/tests/validate/test_licensetest-repository-non-osi-license.json	New API-usage snapshot for non-OSI license test.
tests/snapshots/api-usage/tests/validate/test_licensetest-repository-no-license.json	New API-usage snapshot for no-license test.
tests/snapshots/api-usage/tests/validate/test_licensetest-repository-missing-spdx-id.json	New API-usage snapshot for missing SPDX ID test.
tests/snapshots/api-usage/tests/action/test_hacs_action_integrationtest-hacs-action-integration-valid-manifest.json	Adds SPDX license list URL to action API-usage snapshot.
tests/snapshots/api-usage/tests/action/test_hacs_action_integrationtest-hacs-action-integration-releases-without-assets.json	Adds SPDX license list URL to action API-usage snapshot.
tests/snapshots/api-usage/tests/action/test_hacs_action_integrationtest-hacs-action-integration-no-releases.json	Adds SPDX license list URL to action API-usage snapshot.
tests/snapshots/api-usage/tests/action/test_hacs_action_integrationtest-hacs-action-integration-bad-issue-tracker.json	Adds SPDX license list URL to action API-usage snapshot.
tests/snapshots/api-usage/tests/action/test_hacs_action_integrationtest-hacs-action-integration-bad-documentation.json	Adds SPDX license list URL to action API-usage snapshot.
tests/snapshots/action/test_hacs_action_integration/valid_manifest.log	Adds `<Validation license>` line and updates total checks to 9.
tests/snapshots/action/test_hacs_action_integration/releases_without_assets.log	Adds `<Validation license>` line and updates total checks to 9.
tests/snapshots/action/test_hacs_action_integration/no_releases.log	Adds `<Validation license>` line and updates total checks to 9.
tests/snapshots/action/test_hacs_action_integration/bad_issue_tracker.log	Adds `<Validation license>` line and updates total checks to 9.
tests/snapshots/action/test_hacs_action_integration/bad_documentation.log	Adds `<Validation license>` line and updates total checks to 9.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Fail immediately when the license has no usable SPDX ID (missing or NOASSERTION) instead of downloading the SPDX license list first, since the check can never pass in those cases. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G9QQsoXZefeSfniDY9utsk

balloob · 2026-07-04T19:37:00Z

+                "The repository license could not be identified (SPDX: NOASSERTION)"
+            )
+
+        result = await self.hacs.async_download_file(SPDX_LICENSE_LIST_URL, handle_rate_limit=True)


Is this cached?

Not currently, but we can store a set of IDs.

balloob · 2026-07-04T19:38:05Z

+            raise ValidationException("Could not fetch the SPDX license list")
+
+        try:
+            licenses = json_loads(result).get("licenses", [])


Same thing. Is this running for all repos or just one? Should we cache the json loading

This validator is for the HACS Github action.
There would be little benefit caching this between runs.
However if the fetch is cached this load will not be here.

HACS added SPDX license validation (hacs/integration#5343); custom proprietary text resolves to NOASSERTION and fails validate. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>

claude added 3 commits July 3, 2026 07:09

Trim SPDX license list test fixture to minimum

24b7110

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G9QQsoXZefeSfniDY9utsk

Use proxy fixture instead of inline SPDX payload in license tests

b0318e6

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01G9QQsoXZefeSfniDY9utsk

Copilot AI review requested due to automatic review settings July 3, 2026 07:50

Copilot started reviewing on behalf of ludeeus July 3, 2026 07:50 View session

ludeeus added the pr: action Changes to actions label Jul 3, 2026

ludeeus mentioned this pull request Jul 3, 2026

Add license validator for HACS action #5219

Closed

Copilot AI reviewed Jul 3, 2026

View reviewed changes

Comment thread custom_components/hacs/validate/license.py

Comment thread custom_components/hacs/validate/license.py Outdated

Comment thread custom_components/hacs/validate/license.py

ludeeus and others added 3 commits July 3, 2026 10:01

Apply suggestions from code review

2a0d92e

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

Merge branch 'main' into claude/osi-license-validation-5tnyi2

fe5e2eb

ludeeus mentioned this pull request Jul 3, 2026

Document license check requirement for repository publishing hacs/documentation#687

Open

Merge branch 'main' into claude/osi-license-validation-5tnyi2

76b6347

balloob reviewed Jul 4, 2026

View reviewed changes

balloob approved these changes Jul 4, 2026

View reviewed changes

balloob merged commit e12e591 into main Jul 4, 2026
26 checks passed

balloob deleted the claude/osi-license-validation-5tnyi2 branch July 4, 2026 20:23

hacs-bot Bot added this to the next milestone Jul 4, 2026

github-actions Bot locked and limited conversation to collaborators Jul 5, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

Add license validation for repositories#5343

Add license validation for repositories#5343
balloob merged 7 commits into
mainfrom
claude/osi-license-validation-5tnyi2

ludeeus commented Jul 3, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

balloob Jul 4, 2026

Uh oh!

ludeeus Jul 4, 2026

Uh oh!

balloob Jul 4, 2026

Uh oh!

ludeeus Jul 4, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Uh oh!

Uh oh!

Conversation

ludeeus commented Jul 3, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Key Changes

Implementation Details

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

balloob Jul 4, 2026

Choose a reason for hiding this comment

Uh oh!

ludeeus Jul 4, 2026

Choose a reason for hiding this comment

Uh oh!

balloob Jul 4, 2026

Choose a reason for hiding this comment

Uh oh!

ludeeus Jul 4, 2026

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

ludeeus commented Jul 3, 2026 •

edited

Loading