You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@magpie.apache.org by "justinmclean (via GitHub)" <gi...@apache.org> on 2026/07/11 07:52:56 UTC
[PR] feat(repo-health): add dependency-license-audit skill with eval suite [magpie]
justinmclean opened a new pull request, #814:
URL: https://github.com/apache/magpie/pull/814
## Summary
- Adds the **`magpie-dependency-license-audit`** skill (Triage mode): a read-only audit of a project's direct and transitive dependency tree. It detects the dependency manager(s), resolves each dependency's declared license from ecosystem metadata, classifies each against a configured policy (the ASF three-category A/B/X model or a custom allowlist), and surfaces incompatible, forbidden, and unknown-license dependencies for maintainer review. It never modifies manifests or lock files.
- Supports pip, npm, cargo, maven, gradle, and trivy; policy selectable via `--policy asf|allowlist`; scope via `--repo owner/name` or `--path`.
- Ships a four-step eval suite (scope-selection, license-normalization, license-classification, license-report) with 19 cases, including a prompt-injection case and ambiguous / unknown-license cases.
- Updates the `tools/spec-loop/specs/repo-health-family.md` spec to describe the new skill.
## Type of change
- [X] Skill change (`.claude/skills/<name>/`) — eval fixtures updated below
- [ ] Tool / bridge contract (`tools/<system>/*.md`)
- [ ] Python package (`tools/*/` with `pyproject.toml`)
- [ ] Groovy reference impl
- [ ] Cross-cutting (RFC, AGENTS.md, sandbox, privacy-LLM)
- [ ] Documentation (`docs/`, `README.md`, `CONTRIBUTING.md`)
- [ ] Project template (`projects/_template/`)
- [ ] CI / dev loop (`prek`, workflows, validators)
- [ ] Other:
## Test plan
- [X] `prek run --all-files` passes
- [ ] For Python packages touched: `uv run pytest` / `ruff check` / `mypy` passes
- [ ] For Groovy bridges touched: command-line invocation tested end-to-end
- [X] For skill changes: eval suite passes for the affected skill
(`PYTHONPATH=tools/skill-evals/src python3 -m skill_evals.runner tools/skill-evals/evals/<skill>/`)
- [ ] For skill *behaviour* changes: a new or updated eval fixture is included in this PR
(a regression test for the bug fixed / the behaviour added — see CONTRIBUTING.md)
- [ ] Other:
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(repo-health): add dependency-license-audit skill with eval suite [magpie]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk merged PR #814:
URL: https://github.com/apache/magpie/pull/814
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(repo-health): add dependency-license-audit skill with eval suite [magpie]
Posted by "potiuk (via GitHub)" <gi...@apache.org>.
potiuk commented on PR #814:
URL: https://github.com/apache/magpie/pull/814#issuecomment-4947001725
Reviewed and merging — the skill and eval suite are solid. I pushed one small doc-only reconciliation on top: the PR shipped the skill but `docs/repo-health/README.md`, the spec-loop spec, and the config template still described it as "planned / not yet built," and category B was worded three ways. Flipped those to "shipped/experimental" and aligned category-B on the SKILL's own "binary/convenience-binary only" wording. No changes to the skill or evals. Thanks for the skill!
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] feat(repo-health): add dependency-license-audit skill with eval suite [magpie]
Posted by "justinmclean (via GitHub)" <gi...@apache.org>.
justinmclean commented on PR #814:
URL: https://github.com/apache/magpie/pull/814#issuecomment-4946165232
@sebbASF you might be interested in taking a look at this
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@magpie.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org