Skip to content

Add remaining open-source compliance artifacts#5

Merged
drew merged 1 commit intomainfrom
fix/1-open-source-compliance
Mar 5, 2026
Merged

Add remaining open-source compliance artifacts#5
drew merged 1 commit intomainfrom
fix/1-open-source-compliance

Conversation

@drew
Copy link
Collaborator

@drew drew commented Mar 5, 2026

Summary

Closes #1 — addresses the remaining open-source compliance gaps on main.

  • SPDX header: Added missing header to .github/workflows/dco.yml (the only source file without one)
  • DCO in CONTRIBUTING.md: Added "Developer Certificate of Origin" section with sign-off instructions and git commit -s example
  • THIRD-PARTY-NOTICES: New file listing all third-party dependencies (Docker base images, APT packages, npm packages, GitHub Actions, CI images) with license identifiers and upstream URLs
  • CI scope fix: Removed .github/ from the license header check exclusion list so future workflow files are validated

Issue #1 Acceptance Criteria

Criteria Status
LICENSE file present at repo root (Apache 2.0) Already on main
All existing source files have SPDX copyright headers Fixed (dco.yml was missing)
CONTRIBUTING.md present with DCO requirement Fixed (DCO section added)
THIRD-PARTY-NOTICES file present with current dependency list Added
(Optional) CI check blocks PRs missing headers Already on main; scope expanded to include .github/

- Add SPDX copyright header to .github/workflows/dco.yml
- Add DCO sign-off requirement section to CONTRIBUTING.md
- Create THIRD-PARTY-NOTICES with all third-party dependencies
- Include .github/ in license header CI check scope
@drew drew self-assigned this Mar 5, 2026
@drew drew merged commit 1de4791 into main Mar 5, 2026
1 check passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Add open-source compliance files and copyright headers

1 participant