github-featured/deusdata--codebase-memory-mcp
2
0
Fork 0
Code Issues Pull Requests Deployments Models Agent Notes Packages Projects Releases Wiki Activity

fix(build,ci): make the integrations-hash generator runnable and quiet a JSON-license false positive

Browse Source 
Two CI failures on the integration-asset change, both build/gate plumbing, not
the architecture:

1. scripts/gen-integrations-hash.sh was committed 100644 while Makefile.cbm
   invoked it directly, so a fresh CI checkout died with "Permission denied"
   building the hash header — which failed EVERY test leg at step 0, since the
   contract step builds first. It passed locally only because the generated
   header was already cached, so make never re-ran the generator. Fixed both
   ways: the recipe now runs it via `sh` (mode-independent, cannot regress from
   a checkout mode), and the file is committed 100755 to match its siblings.
   Note: test_script_exec_bit_contract.sh scans shell call sites, not Makefile
   recipes, so it did not catch this — the `sh` prefix is the durable guard.

2. The license gate (ScanCode) flagged scripts/package-release.sh with the SPDX
   'JSON' license. The archive member lists place 'cbm-integrations.json' and
   'LICENSE' adjacently, and ScanCode reads the '.json LICENSE' token adjacency
   as a JSON-license reference. The order is not free to change — the Windows
   single-binary contract locks the exact member sequence — so this is a genuine
   false positive on a first-party MIT build script. Added it to the policy's
   ignored_paths with the same justification the six existing first-party
   entries carry (the gate scripts, provenance auditor, and discover.c all name
   licenses for legitimate reasons). No allow-listed SPDX id was added; the
   JSON license is NOT now permitted anywhere else.

Signed-off-by: Martin Vogel <martin.vogel.tech@gmail.com>
This commit is contained in:
Martin Vogel
2026-08-08 04:18:01 +02:00
parent a6f132bc85
commit 83df500364
3 changed files with 4 additions and 3 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Makefile.cbm
+1 -1
View File
@@ -699,7 +699,7 @@ BUILD_DIR = build/c
# Integration-asset hash header (variables defined next to PROJECT_HDRS; the
# rule lives here because target lines expand $(BUILD_DIR) immediately).
$(INTEGRATIONS_HASH_HDR): $(INTEGRATIONS_ASSET) scripts/gen-integrations-hash.sh | $(BUILD_DIR)
scripts/gen-integrations-hash.sh $(INTEGRATIONS_ASSET) $@
sh scripts/gen-integrations-hash.sh $(INTEGRATIONS_ASSET) $@
# ── Object file compilation (grammars need relaxed warnings) ─────
scripts/gen-integrations-hash.sh
Regular → Executable
View File
scripts/license-policy.json
+3 -2
View File
@@ -16,13 +16,14 @@
"LicenseRef-scancode-public-domain",
"LicenseRef-scancode-public-domain-disclaimer"
],
"_ignored_paths_comment": "Path prefixes (relative to the staged scan tree) excluded from the gate. Use ONLY for documented false positives. Justifications: the license tooling itself (gate scripts + this policy file) necessarily names prohibited licenses; gen-third-party-notices.sh echoes license terminology; audit-license-provenance.py names licenses in its verdict maps; src/discover/discover.c contains a license-FILENAME classification list (LICENSE-MIT, LICENSE-APACHE, ...) for file discovery, which ScanCode reads as license references.",
"_ignored_paths_comment": "Path prefixes (relative to the staged scan tree) excluded from the gate. Use ONLY for documented false positives. Justifications: the license tooling itself (gate scripts + this policy file) necessarily names prohibited licenses; gen-third-party-notices.sh echoes license terminology; audit-license-provenance.py names licenses in its verdict maps; src/discover/discover.c contains a license-FILENAME classification list (LICENSE-MIT, LICENSE-APACHE, ...) for file discovery, which ScanCode reads as license references; package-release.sh lists the archive members 'cbm-integrations.json LICENSE ...' adjacently (an order the Windows single-binary contract locks), and ScanCode reads the '.json LICENSE' token adjacency as a reference to the SPDX 'JSON' license — a first-party MIT build script, not vendored code.",
"ignored_paths": [
"tree/scripts/license-policy.json",
"tree/scripts/license-gate-check.py",
"tree/scripts/license-gate.sh",
"tree/scripts/gen-third-party-notices.sh",
"tree/src/discover/discover.c",
"tree/scripts/audit-license-provenance.py"
"tree/scripts/audit-license-provenance.py",
"tree/scripts/package-release.sh"
]
}