[PR] ci: add Apache RAT licence-header check with SPDX stamping for Markdown [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk opened a new pull request, #777:
URL: https://github.com/apache/magpie/pull/777

   ## Summary
   
   - Add an Apache RAT (Release Audit Tool) gate on every PR / push to `main`,
     verifying every source file carries an approved licence header — the ASF
     Infra release check, caught before merge instead of at release time.
   - Markdown carries no header by convention, so add `tools/dev/add-license-headers.py`
     (+ a prek hook) that stamps an SPDX Apache-2.0 identifier into Markdown, and
     stamp the 1767 files that lacked one (271 already had a header, skipped).
   - List intentional header-less files in `.rat-excludes`; add the ASF header to
     six comment-bearing config files.
   
   ## Type of change
   
   - [x] CI / dev loop (`prek`, workflows, validators)
   - [x] Documentation (`docs/`, `README.md`, `CONTRIBUTING.md`) — SPDX header stamping
   
   ## Test plan
   
   - [x] `prek run --all-files` passes (add-license-headers, markdownlint, doctoc,
         skill-and-tool-validate, check-placeholders, vendor-neutrality all green)
   - [x] Apache RAT 0.18 reports **0 unapproved** over the tree
   - [x] New script passes `ruff check` / `ruff format --check` / `mypy`
   - [x] Hook verified idempotent (no-op on stamped tree; stamps new files; never
         double-stamps a pre-existing header)
   
   ## RFC-AI-0004 compliance
   
   - [x] **Vendor neutrality** — `check-placeholders` prek hook passes
   
   ## Linked issues
   
   <!-- none -->
   
   ## Notes for reviewers
   
   - The reviewable core is 9 files: `.github/workflows/rat.yml`, `.rat-excludes`,
     `tools/dev/add-license-headers.py`, `.pre-commit-config.yaml`, and 5 config
     files given ASF headers. The remaining ~1767 files are the mechanical SPDX
     stamp (`<!-- SPDX-License-Identifier: Apache-2.0 / URL -->`, or the same as a
     YAML comment inside front matter so line 1 stays `---`).
   - RAT 0.18 is pulled from `archive.apache.org` (permanent, version-pinned) with
     a pinned sha512; bump instructions are in the workflow header.
   - `.rat-excludes` covers generated lockfiles, empty package/PEP-561 markers,
     sync-state, and the third-party-licence detection fixtures under
     `step-4-third-party-license/` — those deliberately contain GPL/EPL text as eval
     input, so they are neither stamped nor RAT-scanned.
   
   Generated-by: Claude Code (Claude Opus 4.8)
   


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org

Re: [PR] ci: add Apache RAT licence-header check with SPDX stamping for Markdown [magpie]

["potiuk (via GitHub)" <gi...@apache.org>]

potiuk merged PR #777:
URL: https://github.com/apache/magpie/pull/777


-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org