From 3803e0f941de2822876aec5b67282f65b0bb168c Mon Sep 17 00:00:00 2001 From: Claude Leet Date: Sat, 3 Oct 2026 08:44:54 +0100 Subject: [PATCH] Treat GPL, LGPL and AGPL license identifiers as not tracker keys A Debian copyright file names licenses as GPL-3, LGPL-2 or AGPL-3, which have the tracker key's shape. The dotted forms (GPL-3.0) were already excluded by the lookahead; the bare forms were reported as leaks. --- actions/repo-hygiene/check-repo-hygiene.py | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/actions/repo-hygiene/check-repo-hygiene.py b/actions/repo-hygiene/check-repo-hygiene.py index a60c193..697458f 100755 --- a/actions/repo-hygiene/check-repo-hygiene.py +++ b/actions/repo-hygiene/check-repo-hygiene.py @@ -77,7 +77,7 @@ # Same shape, not tracker keys. Each is a real external standard, so this is a list of # evidenced exceptions rather than a way to quiet a genuine hit. -NOT_A_TRACKER_KEY = re.compile(r"\b(?:ISO-\d+|RFC-\d+|SHA-\d+|UTF-\d+|AES-\d+|PEP-\d+|CVE-\d+|SMETS-\d+|FLEX-\d+)\b") +NOT_A_TRACKER_KEY = re.compile(r"\b(?:ISO-\d+|RFC-\d+|SHA-\d+|UTF-\d+|AES-\d+|PEP-\d+|CVE-\d+|SMETS-\d+|FLEX-\d+|GPL-\d+|LGPL-\d+|AGPL-\d+)\b") # Any link into the internal Atlassian site, not only a wiki one. Review asked whether this # should require a /wiki/ path, since the name said "wiki link" while the pattern also matched a