mirror of
https://github.com/DeusData/codebase-memory-mcp.git
synced 2026-11-10 09:13:53 +08:00
Martin Vogel
faf08a0743
Round 2's smoke fix added the archive member list 'cbm-integrations.json LICENSE
install.sh ...' to scripts/smoke-local.sh (mirroring package-release.sh), which
reintroduced the exact ScanCode false positive that commit 83df500 quieted for
package-release.sh: the '.json LICENSE' token adjacency reads as the SPDX 'JSON'
license. Same class, same fix — smoke-local.sh is a first-party MIT build
script listing its own archive members, added to the license policy's
ignored_paths with the shared justification.
Swept every ScanCode-scanned file (src/pkg/scripts, the gate's own file set) for
the adjacency: the only three carrying it — package-release.sh, smoke-local.sh,
and license-policy.json itself — are all now in ignored_paths, so this closes it
rather than trading one flagged file for another.
Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
31 lines
1.8 KiB
JSON
31 lines
1.8 KiB
JSON
{
|
|
"_comment": "License allow-list for the CI license gate (scripts/license-gate.sh). A single detected SPDX id outside this list fails the pipeline. Additions to this list are deliberate, reviewed changes \u2014 never add copyleft (GPL/LGPL/AGPL/EPL/SSPL) without a maintainer decision.",
|
|
"allowed_spdx_ids": [
|
|
"MIT",
|
|
"MIT-0",
|
|
"Apache-2.0",
|
|
"BSD-2-Clause",
|
|
"BSD-3-Clause",
|
|
"0BSD",
|
|
"ISC",
|
|
"Zlib",
|
|
"Unlicense",
|
|
"CC0-1.0",
|
|
"blessing",
|
|
"LLVM-exception",
|
|
"LicenseRef-scancode-public-domain",
|
|
"LicenseRef-scancode-public-domain-disclaimer"
|
|
],
|
|
"_ignored_paths_comment": "Path prefixes (relative to the staged scan tree) excluded from the gate. Use ONLY for documented false positives. Justifications: the license tooling itself (gate scripts + this policy file) necessarily names prohibited licenses; gen-third-party-notices.sh echoes license terminology; audit-license-provenance.py names licenses in its verdict maps; src/discover/discover.c contains a license-FILENAME classification list (LICENSE-MIT, LICENSE-APACHE, ...) for file discovery, which ScanCode reads as license references; package-release.sh and smoke-local.sh list the archive members 'cbm-integrations.json LICENSE ...' adjacently (the order the Windows single-binary contract locks, mirrored by the smoke fixture), and ScanCode reads the '.json LICENSE' token adjacency as a reference to the SPDX 'JSON' license — first-party MIT build scripts, not vendored code.",
|
|
"ignored_paths": [
|
|
"tree/scripts/license-policy.json",
|
|
"tree/scripts/license-gate-check.py",
|
|
"tree/scripts/license-gate.sh",
|
|
"tree/scripts/gen-third-party-notices.sh",
|
|
"tree/src/discover/discover.c",
|
|
"tree/scripts/audit-license-provenance.py",
|
|
"tree/scripts/package-release.sh",
|
|
"tree/scripts/smoke-local.sh"
|
|
]
|
|
}
|