Repository navigation
chore(licence): PMPL-1.0-or-later → MPL-2.0 in the last SPDX header - #339
Merged
Merged
Conversation
Owner code is MPL-2.0; documentation CC-BY-SA-4.0. Flips the remaining PMPL SPDX header(s) on the default branch. .a2ml / 6a2 descriptor files are left to the A2ML retirement work. Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_01SJGZgoR9ArMgxKcqG7ChW8
Contributor
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configuration
📒 Files selected for processing (1)
Included review availability: This review used your included allowance. Your plan provides up to 1 included review per hour; 0 remain after this review. 📜 Recent review details⏰ Context from checks skipped due to timeout. (21)
|
| Layer / File(s) | Summary |
|---|---|
SPDX identifier update elixir/test/backend_assurance/prim_eq_char_test.exs |
The SPDX identifier changed from PMPL-1.0-or-later to MPL-2.0. Test logic did not change. |
Priority: ⬇️ Low
Estimated code review effort: 1 (Trivial) | ~2 minutes
Change: Other
Merge Risk: ⚪ Minimal · up to e0d2d
The test file’s MPL-2.0 identifier matches the owner-authored licensing statement, and no test behavior changed. No material merge risk remains.
Architecture Summary
Architecture risk: 🔵 Low · up to e0d2d
The change affects 1 system.
Changed systems: elixir
Architecture concerns
No architecture-level concerns identified.
Review details
Systems and components
- observed — elixir (service) was modified; 1 changed file maps to changed impact.
Before / after behavior
- observed — Modified behavior in elixir/test/backend_assurance/prim_eq_char_test.exs: The SPDX identifier changed from
PMPL-1.0-or-latertoMPL-2.0.
🚥 Pre-merge checks | ✅ 5
✅ Passed checks (5 passed)
| Check name | Status | Explanation |
|---|---|---|
| Docstring Coverage | ✅ Passed | No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check. Docstring coverage is scoped to functions touched by this diff. Analyzed 0 functions across 1… |
| Linked Issues check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
| Out of Scope Changes check | ✅ Passed | Check skipped because no linked issues were found for this pull request. |
| Title check | ✅ Passed | The title clearly identifies the SPDX licence change in the final header. It is concise and directly related to the main change. |
| Description check | ✅ Passed | The description includes the required Summary, Changes, checklist, Testing and Screenshots sections. It explains the change and states that tests were not run locally, with a reason. Some checklist it… |
✨ Finishing Touches 💡 1
🛠️ Fix failing CI checks 💡
- Commit to this branch
- Create a new PR
📝 Generate docstrings
- 🤖 Coding Agent task started for docstring generation.
- Create a new PR
- Autopilot · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.
A rabbit reads the header line
One licence tag now shines
No tests changed their quiet tune
The burrow welcomes MPL
Then hops beneath the moon
Comment @coderabbitai help to get the list of available commands.
🔍 Hypatia Security ScanFindings: 114 issues detected
View findings[
{
"reason": "Job `sonarqube` in build.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
"type": "missing_timeout_minutes",
"file": ".github/workflows/build.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium",
"recipe_id": "recipe-add-workflow-timeout-minutes",
"job": "sonarqube"
},
{
"reason": "Job `triage` in label-triage.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
"type": "missing_timeout_minutes",
"file": ".github/workflows/label-triage.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium",
"recipe_id": "recipe-add-workflow-timeout-minutes",
"job": "triage"
},
{
"reason": "Job `sync` in labels.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
"type": "missing_timeout_minutes",
"file": ".github/workflows/labels.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium",
"recipe_id": "recipe-add-workflow-timeout-minutes",
"job": "sync"
},
{
"reason": "Job `deploy` in pages-deploy.yml has no `timeout-minutes:` declaration. Default is 6 hours — a stuck codeload fetch or runner hang can burn budget. Add `timeout-minutes: 10` (or proportional).",
"type": "missing_timeout_minutes",
"file": ".github/workflows/pages-deploy.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium",
"recipe_id": "recipe-add-workflow-timeout-minutes",
"job": "deploy"
},
{
"reason": "Step uses `peter-evans/repository-dispatch` with `token: ${{ secrets.FARM_DISPATCH_TOKEN }}` but has no `if: secrets.FARM_DISPATCH_TOKEN != ''` gate. On repos where the secret hasn't been propagated the action fails on every push, red-maining the repo. Add the step-level gate (or env+if pattern) so the missing-secret path is a clean skip instead of a red.",
"type": "secret_action_without_presence_gate",
"file": ".github/workflows/instant-sync.yml",
"action": "peter-evans/repository-dispatch",
"rule_module": "workflow_audit",
"severity": "high",
"fix_recipe": "add_secret_presence_gate"
},
{
"reason": "codeql.yml does not list `language: actions` in its matrix, but the repo has workflow files. CodeQL's `actions` language scans workflow YAML for injection and other CI/CD-specific weaknesses — every repo with workflows benefits. Add an entry to `matrix.include` with `language: actions` + `build-mode: none`.",
"type": "codeql_missing_actions_language",
"file": ".github/workflows/codeql.yml",
"action": "flag",
"rule_module": "workflow_audit",
"severity": "medium",
"fix_recipe": "add_codeql_actions_language"
},
{
"line": 39,
"reason": "job in .github/workflows/labels.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
"type": "RE001",
"file": ".github/workflows/labels.yml",
"action": "report",
"rule_module": "research_extensions",
"severity": "medium"
},
{
"line": 46,
"reason": "job in .github/workflows/push-email-notify.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
"type": "RE001",
"file": ".github/workflows/push-email-notify.yml",
"action": "report",
"rule_module": "research_extensions",
"severity": "medium"
},
{
"line": 32,
"reason": "job in .github/workflows/build.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
"type": "RE001",
"file": ".github/workflows/build.yml",
"action": "report",
"rule_module": "research_extensions",
"severity": "medium"
},
{
"line": 44,
"reason": "job in .github/workflows/container-publish.yml references `secrets.*` but does not install `step-security/harden-runner` — review outbound-egress monitoring",
"type": "RE001",
"file": ".github/workflows/container-publish.yml",
"action": "report",
"rule_module": "research_extensions",
"severity": "medium"
}
]Powered by Hypatia Neurosymbolic CI/CD Intelligence |
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
Contributor
|
✅ Coding Agent task started: View task and status The task will inspect the CI failures, validate its fix, and commit the fix to this branch automatically.
|
Contributor
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Flips the last
PMPL-1.0-or-laterSPDX header on the default branch toMPL-2.0, per owner rulings D246/D265 (owner code is MPL-2.0, docs CC-BY-SA-4.0). The commit was written on 2026-10-01 and never pushed; it was found while reconciling local-only branches (BoJ recon, increment 2) and rebased onto currentmain(c17fe8f4).📌 New pins
Head SHA:
e0d2df0ee831f42bc5ef5e29143cbc22d03d643e. No actionuses:SHAs,actions.lockentries, lockfile records or container digests are added or changed.Changes
elixir/test/backend_assurance/prim_eq_char_test.exs: line 1 SPDX headerPMPL-1.0-or-later→MPL-2.0. One line, a comment only.RSR Quality Checklist
Required
_build/depsin this clone. The change is a single#comment line, so it cannot alter test behaviour; CI's backend-assurance run covers the file..exscomment.unsafeblocks — none involved.git grep 'SPDX-License-Identifier: PMPL'on the head returns nothing..envfiles included.As Applicable
.machine_readable/STATE/ECOSYSTEM/META — not applicable: no project state, integration or architecture change. (The PMPL mention in.machine_readable/6a2/AGENTIC.a2mlis left to the descriptiles/A2ML retirement work.)contractile.just,docs/planning/v1-critical-chain-2026-06-11.adoc,site/catalog.json) and are out of scope here.TOPOLOGY.md— not applicable.Testing
git diff --stat origin/main→ 1 file, 1 insertion, 1 deletion.git grep -l 'SPDX-License-Identifier: PMPL' HEAD→ no output (zero PMPL SPDX headers remain).git log -1 --format=%G?→G(signed).Deferred red checks (pre-existing on main, not introduced here)
governance / Allowlist Preflight— red on main before this PR; tracked in Three pre-existing red non-required checks on main: Allowlist Preflight (empty GH_TOKEN), Workflow security linter (duplicatewithin abi-drift.yml), SonarQube (403) #338.governance / Workflow security linter— red on main (abi-drift.yml:86duplicatewith:key); tracked in Three pre-existing red non-required checks on main: Allowlist Preflight (empty GH_TOKEN), Workflow security linter (duplicatewithin abi-drift.yml), SonarQube (403) #338.SonarQube— 403 on main; tracked in Three pre-existing red non-required checks on main: Allowlist Preflight (empty GH_TOKEN), Workflow security linter (duplicatewithin abi-drift.yml), SonarQube (403) #338.Screenshots
Not applicable.
🤖 Generated with Claude Code
https://claude.ai/code/session_0144BSwhFVjj4EJ2u7Y2VHWf