From 83df500364dcc308c01684ec3c642191877fdee4 Mon Sep 17 00:00:00 2001 From: Martin Vogel Date: Sat, 8 Aug 2026 04:18:01 +0200 Subject: [PATCH] fix(build,ci): make the integrations-hash generator runnable and quiet a JSON-license false positive MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Two CI failures on the integration-asset change, both build/gate plumbing, not the architecture: 1. scripts/gen-integrations-hash.sh was committed 100644 while Makefile.cbm invoked it directly, so a fresh CI checkout died with "Permission denied" building the hash header — which failed EVERY test leg at step 0, since the contract step builds first. It passed locally only because the generated header was already cached, so make never re-ran the generator. Fixed both ways: the recipe now runs it via `sh` (mode-independent, cannot regress from a checkout mode), and the file is committed 100755 to match its siblings. Note: test_script_exec_bit_contract.sh scans shell call sites, not Makefile recipes, so it did not catch this — the `sh` prefix is the durable guard. 2. The license gate (ScanCode) flagged scripts/package-release.sh with the SPDX 'JSON' license. The archive member lists place 'cbm-integrations.json' and 'LICENSE' adjacently, and ScanCode reads the '.json LICENSE' token adjacency as a JSON-license reference. The order is not free to change — the Windows single-binary contract locks the exact member sequence — so this is a genuine false positive on a first-party MIT build script. Added it to the policy's ignored_paths with the same justification the six existing first-party entries carry (the gate scripts, provenance auditor, and discover.c all name licenses for legitimate reasons). No allow-listed SPDX id was added; the JSON license is NOT now permitted anywhere else. Signed-off-by: Martin Vogel --- Makefile.cbm | 2 +- scripts/gen-integrations-hash.sh | 0 scripts/license-policy.json | 5 +++-- 3 files changed, 4 insertions(+), 3 deletions(-) mode change 100644 => 100755 scripts/gen-integrations-hash.sh diff --git a/Makefile.cbm b/Makefile.cbm index 56bd92379..d42116714 100644 --- a/Makefile.cbm +++ b/Makefile.cbm @@ -699,7 +699,7 @@ BUILD_DIR = build/c # Integration-asset hash header (variables defined next to PROJECT_HDRS; the # rule lives here because target lines expand $(BUILD_DIR) immediately). $(INTEGRATIONS_HASH_HDR): $(INTEGRATIONS_ASSET) scripts/gen-integrations-hash.sh | $(BUILD_DIR) - scripts/gen-integrations-hash.sh $(INTEGRATIONS_ASSET) $@ + sh scripts/gen-integrations-hash.sh $(INTEGRATIONS_ASSET) $@ # ── Object file compilation (grammars need relaxed warnings) ───── diff --git a/scripts/gen-integrations-hash.sh b/scripts/gen-integrations-hash.sh old mode 100644 new mode 100755 diff --git a/scripts/license-policy.json b/scripts/license-policy.json index a4430c189..a8490d6ec 100644 --- a/scripts/license-policy.json +++ b/scripts/license-policy.json @@ -16,13 +16,14 @@ "LicenseRef-scancode-public-domain", "LicenseRef-scancode-public-domain-disclaimer" ], - "_ignored_paths_comment": "Path prefixes (relative to the staged scan tree) excluded from the gate. Use ONLY for documented false positives. Justifications: the license tooling itself (gate scripts + this policy file) necessarily names prohibited licenses; gen-third-party-notices.sh echoes license terminology; audit-license-provenance.py names licenses in its verdict maps; src/discover/discover.c contains a license-FILENAME classification list (LICENSE-MIT, LICENSE-APACHE, ...) for file discovery, which ScanCode reads as license references.", + "_ignored_paths_comment": "Path prefixes (relative to the staged scan tree) excluded from the gate. Use ONLY for documented false positives. Justifications: the license tooling itself (gate scripts + this policy file) necessarily names prohibited licenses; gen-third-party-notices.sh echoes license terminology; audit-license-provenance.py names licenses in its verdict maps; src/discover/discover.c contains a license-FILENAME classification list (LICENSE-MIT, LICENSE-APACHE, ...) for file discovery, which ScanCode reads as license references; package-release.sh lists the archive members 'cbm-integrations.json LICENSE ...' adjacently (an order the Windows single-binary contract locks), and ScanCode reads the '.json LICENSE' token adjacency as a reference to the SPDX 'JSON' license — a first-party MIT build script, not vendored code.", "ignored_paths": [ "tree/scripts/license-policy.json", "tree/scripts/license-gate-check.py", "tree/scripts/license-gate.sh", "tree/scripts/gen-third-party-notices.sh", "tree/src/discover/discover.c", - "tree/scripts/audit-license-provenance.py" + "tree/scripts/audit-license-provenance.py", + "tree/scripts/package-release.sh" ] }