Repository navigation
build(copyright): run the header scanner in mvn validate, not just CI - #92
Merged
Merged
Conversation
The provenance-aware copyright-header check (bin/check-copyright-headers.sh, from PR #90/#91) only ran via the copyright.yml GitHub Action and manual invocation - a local `mvn` build did zero header enforcement (the mycila license plugin is skipped by default for this fork). So header mistakes were only caught in CI. Wire the scanner into the build: - exec-maven-plugin runs bin/check-copyright-headers.sh in the `validate` phase, once at the root (inherited=false; the script cd's to the git top-level itself). Skip with -Dcopyright.skip=true (new property, default false). Worktree-safe (unlike the mycila plugin), which is why the scanner can be bound at all. - Graceful shallow-clone handling: the scanner needs the fork-point commit to classify provenance. It now WARNs and skips (exit 0) when that commit is absent (e.g. a shallow clone / a build without full history) instead of hard-failing, so it never breaks such builds. COPYRIGHT_CHECK_REQUIRE_FORK_POINT=1 forces the old hard-fail; copyright.yml sets it (it fetches full history, so a missing fork point there is a real error), keeping the CI gate strict. - Self-test updated: fixture C now asserts both the default warn+skip (exit 0) and strict-mode hard-fail (exit 2). Verified: `mvn validate` runs the scanner and passes on a clean tree; fails the build on a fork-original file wrongly claiming Confluent; and is bypassed by -Dcopyright.skip=true. Scanner self-test passes. Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Dependency Review✅ No vulnerabilities or license issues or OpenSSF Scorecard issues found.OpenSSF Scorecard
Scanned Files
|
✅ Duplicate Code ReportTwo engines run in parallel for cross-validation. Each has its own thresholds tuned to its baseline - the real safety net is the per-engine "max increase vs base" check. ✅ PMD CPD
No new clones introduced by this PR. ✅ jscpd (language-agnostic)
No new clones introduced by this PR. Powered by astubbs/duplicate-code-cross-check |
✅ SpotBugs ReportNo bugs found (new bugs only — baseline from base branch excluded). |
🧪🔒 Quarantine Lane Report
🔴 expected while the owner PR is open · 🟡🎲 flapper, pass proves nothing · 🚨 a deterministic quarantined test passing means its fix landed: delete its |
astubbs
added a commit
that referenced
this pull request
Jul 31, 2026
…pipefail misclassification (#94) Seen live on PR #93's check: 'printf | grep -q' pipes randomly evaluate a MATCH as false - grep -q exits at first hit, printf takes SIGPIPE, and under set -o pipefail the pipeline fails, so an upstream-derived file (ParallelStreamProcessor) was flagged as 'fork-original claims Confluent copyright'. The rename lookup had the worse variant: awk's early exit SIGPIPEs printf inside a $() assignment, which set -e turns into silent script death. All 9 pipe sites converted to herestrings (<<<) - no pipe, no SIGPIPE, correct by construction. Self-test gains a structural guard that fails if a pipe into grep -q / awk ever reappears in the scanner (comment lines excluded). Now doubly important since #92 runs the scanner in mvn validate: the race would have hit every local build, not just CI. Verified: self-tests 17/17, full scan 213 files 0 violations. Claude-Session: https://claude.ai/code/session_013ALhTf1TRA2S6Ue5rkiQdK Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
astubbs
added a commit
that referenced
this pull request
Jul 31, 2026
…gs (#93) * ci(review): make the automatic Claude review actually post - pass --comment + tool grants The 'review' workflow has been running green (13 min, ~$5/run) while never posting anything, because: 1. The code-review plugin's own contract: 'If --comment argument was NOT provided, stop here. Do not post any GitHub comments.' The prompt never passed --comment, so every review ended as a log-only summary. 2. Prompt-mode runs get no tool grants by default - run logs show 27 permission denials per review. Grant the plugin command's declared allowed-tools set via claude_args (gh pr/issue read commands, gh pr comment, and the buffered inline-comment MCP tool). @claude mention replies were unaffected (mention mode posts its own tracking comment), which is why interactive review worked while the automatic one silently didn't. The plugin de-dupes per PR (it skips if Claude already commented), so synchronize pushes won't spam. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013ALhTf1TRA2S6Ue5rkiQdK * fix(copyright): herestrings for scanner membership tests - SIGPIPE + pipefail misclassification Seen live on PR #93's check: 'printf | grep -q' pipes randomly evaluate a MATCH as false - grep -q exits at first hit, printf takes SIGPIPE, and under set -o pipefail the pipeline fails, so an upstream-derived file (ParallelStreamProcessor) was flagged as 'fork-original claims Confluent copyright'. The rename lookup had the worse variant: awk's early exit SIGPIPEs printf inside a $() assignment, which set -e turns into silent script death. All 9 pipe sites converted to herestrings (<<<) - no pipe, no SIGPIPE, correct by construction. Self-test gains a structural guard that fails if a pipe into grep -q / awk ever reappears in the scanner (comment lines excluded). Now doubly important since #92 runs the scanner in mvn validate: the race would have hit every local build, not just CI. Verified: self-tests 17/17, full scan 213 files 0 violations. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Claude-Session: https://claude.ai/code/session_013ALhTf1TRA2S6Ue5rkiQdK --------- Co-authored-by: Claude Fable 5 <noreply@anthropic.com>
astubbs
added a commit
that referenced
this pull request
Jul 31, 2026
Resolve AGENTS.md (combine all four PR Discipline bullets - #75s three + #95s use-the-template rule), CHANGELOG.adoc (keep #75s renamed local line + highcpu/PIT entries alongside #95s PR-checklist entry; drop the stale macOS line the rename supersedes), and README.adoc (regenerated from the resolved CHANGELOG). Brings in #92/#95/#96 (copyright-in-mvn, PR checklist gate, track_progress) and dep bumps.
5 tasks done
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Why
The provenance-aware copyright-header check (
bin/check-copyright-headers.sh, added in #90/#91) only ran via thecopyright.ymlGitHub Action and manual invocation. A localmvn validate/installdid zero header enforcement - the mycila license plugin is-Dlicense.skip=trueby default for this fork. So header mistakes only surfaced in CI. This wires the check into the build somvncatches them locally too.What
exec-maven-pluginruns the scanner in thevalidatephase, once at the root (inherited=false; the scriptcds to the git top-level itself). Skippable with-Dcopyright.skip=true(new property, defaultfalse). This is only safe because the scanner is worktree-safe (unlike the mycila plugin, which is why that one is skipped).COPYRIGHT_CHECK_REQUIRE_FORK_POINT=1forces the hard-fail;copyright.ymlsets it (it fetches full history, so a missing fork point there is a genuine error) - the CI gate stays strict.Verification
mvn validateruns the scanner and passes on a clean tree (Checked 213 java files … 0 violations).exec-maven-plugin … Process exited with an error: 1).-Dcopyright.skip=truebypasses it.bin/test-check-copyright-headers.shpasses (both fork-point modes).Standalone, off
master- not related to the highcpu-runner PR (#75).🤖 Generated with Claude Code