Skip to content

Add SPDX license header checker and missing headers - #22863

Draft
shreyah963 wants to merge 2 commits into
opensearch-project:mainfrom
shreyah963:add-spdx-license-header-checker
Draft

Add SPDX license header checker and missing headers#22863
shreyah963 wants to merge 2 commits into
opensearch-project:mainfrom
shreyah963:add-spdx-license-header-checker

Conversation

@shreyah963

@shreyah963 shreyah963 commented Aug 26, 2026

Copy link
Copy Markdown
Contributor

Description

Add SPDX license header validation to PR/push workflows using @kt3k/license-checker.

Changes:

  • Add .github/workflows/license-header-checker.yml
  • Add .licenserc.json
  • Add missing SPDX-License-Identifier: Apache-2.0 headers to source files

Related Issues

#6445

Check List

  • Functionality includes testing.
  • API changes companion pull request created, if applicable.
  • Public documentation issue/PR created, if applicable.

By submitting this pull request, I confirm that my contribution is made under the terms of the Apache 2.0 license.
For more information on following Developer Certificate of Origin and signing off your commits, please check here.

Signed-off-by: shreyah963 <shreyab963@gmail.com>
@github-actions github-actions Bot added bug Something isn't working flaky-test Random test failure that succeeds on second run labels Aug 26, 2026
@github-actions

github-actions Bot commented Aug 26, 2026

Copy link
Copy Markdown
Contributor

PR Code Analyzer ❗

AI-powered 'Code-Diff-Analyzer' found issues on commit 2696e10.

Hard block: Issues at Medium severity or above will block this PR from merging.

PathLineSeverityDescription
.github/workflows/license-header-checker.yml12highNew npm package dependency introduced in CI pipeline: `npx @kt3k/license-checker@3.2.2`. This executes an external npm package directly in the CI environment on every push and pull_request. Per mandatory supply chain rules, any new package/dependency addition must be flagged regardless of apparent legitimacy. Maintainers should verify the package `@kt3k/license-checker` at version 3.2.2 is the intended artifact and consider pinning via a lockfile or integrity hash.

The table above displays the top 10 most important findings.

Total: 1 | Critical: 0 | High: 1 | Medium: 0 | Low: 0


Pull Requests Author(s): Please update your Pull Request according to the report above.

Repository Maintainer(s): You can bypass diff analyzer by adding label skip-diff-analyzer after reviewing the changes carefully, then re-run failed actions. To re-enable the analyzer, remove the label, then re-run all actions.


⚠️ Note: The Code-Diff-Analyzer helps protect against potentially harmful code patterns. Please ensure you have thoroughly reviewed the changes beforehand.

Thanks.

Signed-off-by: shreyah963 <shreyab963@gmail.com>
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

bug Something isn't working flaky-test Random test failure that succeeds on second run

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant