fix(ci): rhodibot must never relicense AGPL — warn only - #36
Merged
Conversation
Rhodibot ran a sed sweep over dotfiles rewriting AGPL SPDX headers,
on a Monday cron AND on every completed Hypatia analysis:
sed -i 's/AGPL-3.0-or-later/MPL-2.0/g; s/AGPL-3.0/MPL-2.0/g' "$dotfile"
Three things wrong with that:
1. LICENCE-POLICY.adoc A2 forbids it outright -- "No automated or bulk
SPDX/licence change (sed sweep, script, agent pass) on any estate
repo, ever. Prior automated attempts falsified third-party licence
authorship -- a legal-integrity hazard." This is literally a sed
sweep changing SPDX headers.
2. AGPL is CORRECT in this estate, not drift. Rule 3 covers projects
co-developed with the owner's son; Rule 5 (added 2026-08-26) makes
games AGPL as a class. This bot was scheduled to undo a policy set
the same day.
3. It was HALF-fixed, which is worse than either state. The sed target
had been changed from PMPL to MPL-2.0, but the report line still read
"(AGPL → PMPL)" -- so the log described an edit the code no longer
made. A bot whose output misdescribes its own behaviour is harder to
audit than one that is plainly wrong.
Replaced with warn-only, matching what rsr-template-repo's rhodibot
already does correctly:
echo "::warning::... must be fixed MANUALLY (owner-only, never
auto-edited). AGPL is correct under LICENCE-POLICY Rule 3 and Rule 5."
The header comment claiming 'Fix SPDX headers (AGPL → PMPL in dotfiles)'
is corrected to say it flags for manual review.
Note on scope: 38 copies of the original PMPL-rewriting form exist as
vendored sub-copies under developer-ecosystem and standards/k9-svc.
Those are inert unless executed, and are a separate cleanup; this fixes
the one that is ACTIVE and scheduled.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
|
Caution Review failedThe pull request is closed. ℹ️ Recent review info⚙️ Run configurationConfiguration used: Organization UI Review profile: ASSERTIVE Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughSummary by CodeRabbit
WalkthroughThe workflow documentation now identifies AGPL SPDX headers as manual-review items. Matching dotfiles emit a warning, record the header for review, preserve the header, and mark the workflow as changed. ChangesAGPL header handling
Estimated code review effort: 2 (Simple) | ~10 minutes Poem
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Rhodibot ran a sed sweep over dotfiles rewriting AGPL SPDX headers — on a Monday cron and on every completed Hypatia analysis:
Three things wrong with it
1.
LICENCE-POLICY.adocA2 forbids it outright:This is literally a sed sweep changing SPDX headers.
2. AGPL is correct in this estate, not drift. Rule 3 covers projects co-developed with the owner's son. Rule 5 — added today, 2026-08-26 — makes games AGPL as a class. This bot was scheduled to undo a policy set the same day.
3. It was half-fixed, which is worse than either state. The
sedtarget had already been changed from PMPL to MPL-2.0, but the report line still read(AGPL → PMPL)— so the log described an edit the code no longer made. A bot whose output misdescribes its own behaviour is harder to audit than one that is plainly wrong.The fix
Warn-only, matching what
rsr-template-repo's rhodibot already does correctly — someone hardened the spine but this copy was missed.Scope note
38 copies of the original PMPL-rewriting form exist as vendored sub-copies under
developer-ecosystemandstandards/k9-svc. Those are inert unless executed and are a separate cleanup. This fixes the one that is active and scheduled.🤖 Generated with Claude Code