CI: Add REUSE compliance checks

[heymrbox]

Summary

• Add SPDX copyright and Apache-2.0 license headers across authored source and configuration files.
• Add REUSE metadata for documentation, fixtures, and generated artifacts.
• Pin the REUSE tool and enforce make reuse-lint locally and in CI.
• Document the licensing workflow and add the canonical Apache-2.0 license text.

Linked issues

CAC-214

Checklist

Vendor-neutral naming (required — see CONTRIBUTING.md)

• No oci / oracle / *.oci.com / oraclecloud.com in any API group, CRD group, proto package, gRPC service/package, Kubernetes namespace, image registry, Helm chart, or Go module path.
• Any cloud-specific (incl. OCI) integration lives in an isolated, optional adapter (pkg/adapters/.../) — never in core controllers, CRD types, the proto contract, or default config.
• No Oracle/OCI domain or namespace in sample manifests, README, or default values.
• Pre-commit naming guard passed (make install-hooks once, then it runs on every commit).

Quality

• Every human-authored commit includes a matching DCO Signed-off-by: trailer (git commit --signoff).
• make build and make test pass locally.
• make lint clean (gofmt + go vet).
• make manifests generate produces no drift (generated code committed).
• New/changed behavior has unit tests.
• Operator-facing change (CRD columns/fields, .status, CLI, gRPC/HTTP, install bundle/RBAC, samples)? If so, the install-smoke gate asserts it (see CONTRIBUTING.md).
• CI is green.

Contracts (only if touching CRDs or proto)

• Change matches the tech spec (or the spec is updated in the same PR).
• Backward compatibility considered for v1alpha1 consumers (engines, gateway clients).
• If proto/ changed, docs/design/grpc-contract.md is updated to match (the pre-commit hook enforces this).
• If CRD API types (api/v1alpha1/*_types.go) or the proto contract changed, the documentation is updated to match — the docs site (site/) and/or the design docs (docs/). CI enforces this (make verify-docs-sync); add the no-docs-needed label to waive a genuinely doc-exempt change.

[linear-code]

CAC-214

[github-actions]

Codex review

Files reviewed

• .githooks/: {pre-commit,pre-push} [reviewed]
• .github/: PULL_REQUEST_TEMPLATE.md [reviewed]
• .github/actions/setup-syft/: action.yml [reviewed]
• .github/: dependabot.yml [reviewed]
• .github/workflows/: {c2-reconciler-canary,c6-engine-wiring-canary,ci,codeql,codex-review,cpu-substrate-canary,default-install-smoke,docs,release-sbom,static}.yml [reviewed]
• /: .gitignore, .golangci.yml, CONTRIBUTING.md, LICENSES/Apache-2.0.txt, Makefile, PROJECT, REUSE.toml, buf.yaml, codecov.yml, go.mod, plugins/inferencecache.yaml, ruff.toml [reviewed]
• api/v1alpha1/: {cachebackend_effective,cachebackend_effective_test,cachebackend_types,cachebackend_types_test,cacheindex_types,cachepolicy_types,cachetenant_types,groupversion_info,pdtopology_types,prompttemplate_types,remaining_crds_types_test}.go [reviewed]
• api/v1alpha1/: zz_generated.deepcopy.go [skipped — generated]
• cmd/controller/: main.go [reviewed]
• cmd/inferencecache/: {doctor,doctor_args_test,doctor_integration_test,doctor_unit_test,main}.go [reviewed]
• cmd/kvevent-fake-engine/: {e2e_test,main,main_test}.go [reviewed]
• cmd/kvevent-subscriber/: main.go [reviewed]
• cmd/server/: {main,main_test}.go [reviewed]
• config/certmanager/: {certificate,kustomization}.yaml [reviewed]
• config/crd/: kustomization.yaml [skipped — generated]
• config/default/: {kustomization,manager_webhook_patch,namespace,webhookcainjection_patch}.yaml [reviewed]
• config/manager/: {kustomization,manager}.yaml [reviewed]
• config/observability/: {alerting-rules,kustomization,podmonitor,prometheus-rules-tests,prometheus-rules,servicemonitor}.yaml [reviewed]
• config/overlays/server-tls/: kustomization.yaml [reviewed]
• config/rbac/: {cachebackend_editor_role,cachebackend_viewer_role,cacheindex_editor_role,cacheindex_viewer_role,cachepolicy_editor_role,cachepolicy_viewer_role,cachetenant_editor_role,cachetenant_viewer_role,kustomization,leader_election_role,leader_election_role_binding,pdtopology_editor_role,pdtopology_viewer_role,prompttemplate_editor_role,prompttemplate_viewer_role,role_binding,service_account}.yaml [reviewed]
• config/samples/_test/: cachebackend-invalid-scale-to-zero-no-min.yaml [reviewed]
• config/samples/: {cache_v1alpha1_cachebackend,cache_v1alpha1_cacheindex,cache_v1alpha1_cachepolicy,cache_v1alpha1_cachetenant,cache_v1alpha1_pdtopology,cache_v1alpha1_prompttemplate,cachebackend-cpu-override,cachebackend-events-only,cachebackend-external,cachebackend-lmcache-cpu,cachebackend-lmcache,cachebackend-mooncake,cachebackend-sglang-hicache,cachebackend-sglang-host-only,cachebackend-sglang,cachebackend-with-engine,cachebackend-with-override,recipe-cpu-dev,recipe-external-cache,recipe-gpu-production,recipe-multi-tenant,recipe-tuning}.yaml [reviewed]
• config/server/: {kustomization,networkpolicy,server}.yaml [reviewed]
• config/server/tls/: {certificate,kustomization,patch-volumes,patch}.yaml [reviewed]
• config/webhook/: {kustomization,service}.yaml [reviewed]
• dockerfiles/: Dockerfile [reviewed]
• docs/reference-stack/helm/: values-reference.yaml [reviewed]
• docs/reference-stack/kind/: cluster.yaml [reviewed]
• docs/reference-stack/manifests/: {cpu-local/deployment,deployment,namespace,service,sglang-lmcache/deployment}.yaml [reviewed]
• docs/reference-stack/scripts/: {canary_c2_reconcile,canary_c6_engine_wiring,canary_dual_input_tokenization,canary_e2e,default_install_smoke,prefix_cache_hit_test}.sh, {kv_events_subscriber,kv_events_synthetic_publisher,test_kv_events}.py, requirements.txt [reviewed]
• hack/: boilerplate.go.txt, {resolve-release-image-digests,resolve-release-image-digests_test,sbom-registry-smoke,verify-dco,verify-dco_test,verify-docs-sync,verify-docs-sync_test,verify-minimal-images,verify-minimal-images_test,verify-syft-version}.sh [reviewed]
• hack/index-sizing/: {main,main_test}.go [reviewed]
• hack/internal/tools/: {go.mod,tools.go} [reviewed]
• hack/verify-prometheus-drift/: {main,main_test}.go [reviewed]
• hack/verify-samples/: {admission_test,main,main_test}.go [reviewed]
• internal/adapters/builtin/: {boundaries_test,doc,registry,registry_test}.go [reviewed]
• internal/adapters/builtin/runtime/: {contract_aliases_test,doc,lmcachecheck,lmcachecheck_script_test,lmcachecheck_test,sglang_hicache,sglang_hicache_test,sglang_lmcache,sglang_lmcache_test,sglang_lmcache_wire,vllm_lmcache,vllm_lmcache_test,vllm_lmcache_wire,vllm_lmcache_wire_test}.go [reviewed]
• internal/adapters/builtin/storage/: {effective_config,lmcache_server,mooncake,redis,redis_test,registry,registry_test}.go [reviewed]
• internal/controller/: {cachebackend_autoscaling_test,cachebackend_controller,cachebackend_controller_test,cachebackend_engine_compat,cachebackend_engine_compat_integration_test,cachebackend_engine_compat_test,cachebackend_events_only_integration_test,cachebackend_events_test,cachebackend_hostnetwork_test,cachebackend_kernelcheck,cachebackend_kernelcheck_integration_test,cachebackend_kernelcheck_test,cachebackend_kvevent_gate_test,cachebackend_matched_pods_test,cachebackend_mooncake_hostnetwork_integration_test,cachebackend_probe,cachebackend_probe_integration_test,cachebackend_probe_test,cachebackend_resources_integration_test,cachebackend_schema_trim_integration_test,cachebackend_server_restart,cachebackend_server_restart_integration_test,cachebackend_server_restart_test,cachebackend_t2degraded_test,cacheindex_authed_integration_test,cacheindex_controller,cacheindex_controller_test,cacheindex_integration_test,cacheindex_metrics,cachepolicy_affinity_routing_integration_test,cachepolicy_authed_integration_test,cachepolicy_eviction_integration_test,cachepolicy_matched_tokens_floor_integration_test,cachepolicy_routing_floor_integration_test,cachepolicy_strategy_integration_test,contract_coverage_sweep_test,controlplane_controller,controlplane_controller_test,engine_pod_events_controller,engine_pod_events_controller_test,integration_test,probe_client,probe_client_test,tenant_quota_integration_test}.go [reviewed]
• internal/controlplaneapi/: {contracts_test,doc,policy,probe}.go [reviewed]
• internal/enginebinding/: {doc,metadata,metadata_test}.go [reviewed]
• internal/webhook/pod/: {doc,envtest_integration_test,overrides,overrides_test,podinjector,podinjector_test}.go [reviewed]
• internal/webhook/v1alpha1/: {cachebackend_defaulter_envtest_test,cachebackend_webhook,cachebackend_webhook_test,cachepolicy_cachetenant_envtest_test,cachepolicy_webhook,cachepolicy_webhook_test,cachetenant_webhook,cachetenant_webhook_test,doc}.go [reviewed]
• pkg/adapters/backend/: {backend,backend_test}.go [reviewed]
• pkg/adapters/engine/: {config,coverage_test,doc,events,events_test,forwarder,forwarder_test,lora_adapter_test,mapper,mapper_test,metrics_scraper,metrics_scraper_test,positional,positional_test,sglang_wire_test,stats_reporter,stats_reporter_test,subscriber,subscriber_test,wire_test}.go [reviewed]
• pkg/adapters/engineclient/: {canary,canary_test,engineclient,grpc,openai,openai_test}.go [reviewed]
• pkg/adapters/runtime/: {adapter,adapter_test,doc,kernelcheck,kvevent_subscriber,lmcache_shared,reference,wire_contract}.go [reviewed]
• pkg/cli/doctor/checks/: {cachebackend,checks,checks_test,endpoints,podaudit,tenant_policy}.go [reviewed]
• pkg/cli/doctor/: {finding,finding_test}.go [reviewed]
• pkg/cli/doctor/output/: {human,json,output,output_test,table}.go [reviewed]
• pkg/fingerprint/: {chain,chain_test,fingerprint,fingerprint_test}.go [reviewed]
• pkg/fingerprint/testdata/: gen_golden.py, requirements.txt [reviewed]
• pkg/index/: {adapter_partition_test,affinity_test,aggregate_test,diagnostics_test,distinguishing_power_lookup_test,distinguishing_power_test,doc,index,index_test,lfu_eviction_test,snapshot_wire_contract_test,tenant_quota_test}.go [reviewed]
• pkg/render/: doc.go [reviewed]
• pkg/server/auth/: {audience,doc,integration_test,middleware,middleware_test}.go [reviewed]
• pkg/server/: {adapter_partition_test,affinity_routing_test,diagnostics_test,doc,inferencecache_service,lfu_credit_test,lmcache_offload_integration_test,logging,logging_test,matched_tokens_floor_test,metrics,metrics_test,policy,policy_test,probe,probe_test,route_dual_input_test,route_lookup_hitmiss_test,routing_floor_response_test,routing_floor_score_test,server,server_test,tenant_quota_test,tls,tls_test}.go [reviewed]
• pkg/server/proto/inferencecache/v1alpha1/: {doc,inferencecache.pb,inferencecache_grpc.pb,replica_stats_client_version_test}.go [skipped — generated]
• pkg/testing/: {doc,envtest_setup}.go [reviewed]
• pkg/tokenize/: {cgo_smg,cgo_smg_test,new_cgo,new_default,tokenize,tokenize_test}.go [reviewed]
• pkg/version/: {doc,version}.go [reviewed]
• proto/inferencecache/v1alpha1/: inferencecache.proto [reviewed]
• rust/ictokenizer/: Cargo.toml, src/lib.rs [reviewed]
• site/: .gitignore, go.mod, hugo.toml [reviewed]
• site/assets/scss/: {_styles_project,_variables_project}.scss [reviewed]
• site/layouts/: 404.html [reviewed]
• site/layouts/_default/_markup/: render-heading.html [reviewed]
• site/layouts/partials/: {anchor,footer,head-css,head,navbar-version-selector,navbar,seo_schema}.html [reviewed]
• site/layouts/shortcodes/: {feature-state,include,needs-update,params}.html [reviewed]
• site/layouts/shortcodes/blocks/: {content-item,content-section,link-down,tab,tabs}.html [reviewed]

Findings

Blocking

None.

Should-fix

None.

Nit

None.

Per-category coverage

1. Vendor-neutral naming: Clean
2. Contract & spec / docs sync: Clean
3. gRPC fail-open semantics: Clean
4. Quality (tests / error wrapping / package placement / generated drift): Clean

Verdict

approve

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!