chore: open-source project setup#122
Merged
Merged
Conversation
- Replace LICENSE file with Apache License 2.0 full text - Add NOTICE file as required by Apache 2.0 - Add pre-commit hook to auto-add SPDX headers to new Go files
Add Apache-2.0 SPDX headers to 94 Go source files for license compliance.
- Update README with Support, Security, Governance sections - Update CONTRIBUTING with Apache 2.0 license agreement and Redis 6.0+ - Update SECURITY.md license reference to Apache 2.0 - Add GOVERNANCE.md (BDFL model, release process, maintainership) - Add SUPPORT.md (help channels, response times, security reporting) - Update docs site license reference to Apache 2.0
GitHub config: - Add CODEOWNERS with directory-specific rules - Add FUNDING.yml for GitHub Sponsors - Migrate Issue templates from Markdown to YAML forms - Add severity/priority fields to bug/feature issue forms - Add question issue form - Add GitHub Discussions link to issue config - Add license acknowledgment to PR template Workflows: - Add stale workflow (14d issues, 7d PRs auto-management) - Add labeler workflow (auto-label PRs by changed files) - Add label-sync workflow (clean labels on merge) - Add release-drafter workflow (auto-draft release notes) - Add CodeQL workflow (weekly security scanning) - Add SPDX header check to CI Other: - Add .gitattributes for consistent line endings and diff settings - Modernize .gitignore with categorized sections
Reviewer's GuideSwitches the project licensing and contributor model to Apache 2.0 and adds open‑source friendly governance, support docs, SPDX enforcement, and GitHub automation (CI, CodeQL, release drafting, labeling, stale/label-sync workflows, and structured issue templates). Sequence diagram for PR lifecycle with labeling, CI, and release draftingsequenceDiagram
actor Developer
participant GitHub
participant LabelerWorkflow
participant CIWorkflow
participant LabelSyncWorkflow
participant ReleaseDrafterWorkflow
Developer->>GitHub: Open pull request
GitHub-->>LabelerWorkflow: pull_request_target event (opened)
LabelerWorkflow-->>GitHub: Apply labels based on changed files
GitHub-->>CIWorkflow: pull_request event
CIWorkflow-->>CIWorkflow: Run go build, go vet, tests
CIWorkflow-->>CIWorkflow: Run SPDX header grep check
CIWorkflow-->>GitHub: Report CI status on PR
Developer->>GitHub: Update PR (push commits)
GitHub-->>LabelerWorkflow: pull_request_target event (synchronize)
LabelerWorkflow-->>GitHub: Update labels if needed
GitHub-->>CIWorkflow: pull_request event
CIWorkflow-->>GitHub: Update CI status
Developer->>GitHub: Merge pull request
GitHub-->>LabelSyncWorkflow: pull_request event (closed, merged)
LabelSyncWorkflow-->>GitHub: Sync labels using repository config
GitHub-->>ReleaseDrafterWorkflow: push event on master
ReleaseDrafterWorkflow-->>GitHub: Update draft release notes
Flow diagram for SPDX header enforcement via pre-commit and CIflowchart TD
DevEdit["Developer edits Go files"] --> PreCommitRun["Run git commit with pre-commit enabled"]
PreCommitRun --> LocalSPDXHook["Local pre-commit hook add-spdx-header"]
LocalSPDXHook --> ScanFiles["Scan *.go files without SPDX header"]
ScanFiles --> InsertHeader["Insert // SPDX-License-Identifier: Apache-2.0 at correct position"]
InsertHeader --> CommitComplete["Commit succeeds with updated files"]
CommitComplete --> Push["Push branch to GitHub"]
Push --> CIWorkflow["CI workflow ci.yaml"]
CIWorkflow --> SPDXCheck["Run grep to verify SPDX header in all *.go files"]
SPDXCheck -->|all files have header| CI_PASS["CI passes"]
SPDXCheck -->|missing header detected| CI_FAIL["CI fails and reports missing files"]
CI_FAIL --> FixHeaders["Developer fixes headers locally (re-run pre-commit)"]
FixHeaders --> PreCommitRun
File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue, and left some high level feedback:
- The
add-spdx-headerpre-commit hook usessed -i "", which is macOS-specific and will fail on Linux (including most CI runners); consider using a portablesedinvocation or a small Go/Python helper instead. - The newly added
.github/CODEOWNERSfile appears to be empty in this change; if you intend to use code owners for reviews, populate it with the relevant paths and owners or drop the file until you have a concrete mapping.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The `add-spdx-header` pre-commit hook uses `sed -i ""`, which is macOS-specific and will fail on Linux (including most CI runners); consider using a portable `sed` invocation or a small Go/Python helper instead.
- The newly added `.github/CODEOWNERS` file appears to be empty in this change; if you intend to use code owners for reviews, populate it with the relevant paths and owners or drop the file until you have a concrete mapping.
## Individual Comments
### Comment 1
<location path=".pre-commit-config.yaml" line_range="31-34" />
<code_context>
+ - id: add-spdx-header
+ name: Add SPDX license header
+ entry: >-
+ bash -c 'for f in "$@"; do if ! head -1 "$f" | grep -q "SPDX-License-Identifier";
+ then sed -i "" "1i\\
+ // SPDX-License-Identifier: Apache-2.0\\
+ " "$f" && echo "Added SPDX header to $f"; fi; done'
+ language: system
+ files: \.go$
</code_context>
<issue_to_address>
**issue (bug_risk):** The SPDX header injection script is not portable and can break files with build tags or existing SPDX lines.
Key issues with this hook:
1. Uses `sed -i ""`, which only works with BSD `sed` (macOS) and will fail on GNU `sed` (Linux/CI). Consider a cross-platform approach (e.g., `python`/`perl` in-place edit or a `sed` incantation that works on both).
2. Inserts the SPDX line at the very top, which breaks Go files that start with `//go:build` / `// +build` or other required first-line constructs. The header should be inserted after any build tags or shebangs.
3. Only checks the first line for `SPDX-License-Identifier`, so it can add a duplicate header if SPDX already appears later in the file, while CI checks anywhere in the file.
Refactor to be cross-platform, choose the correct insertion point, and scan the whole file for an existing SPDX line before adding one.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
|
You are seeing this message because GitHub Code Scanning has recently been set up for this repository, or this pull request contains the workflow file for the Code Scanning tool. What Enabling Code Scanning Means:
For more information about GitHub Code Scanning, check out the documentation. |
- Replace macOS-specific sed with python3 for cross-platform support - Insert SPDX header after //go:build and // +build tags - Scan entire file for existing SPDX before adding to prevent duplicates
Owner
Author
|
@sourcery-ai review |
There was a problem hiding this comment.
Hey - I've found 2 issues, and left some high level feedback:
- The
.github/labeler.ymlrules for thebuglabel are extremely broad (any*.goor*_test.gochange), which will cause most PRs to be auto-labeled as bugs; consider tightening these patterns so labels more accurately reflect intent. - The
label-sync.yamlworkflow only grantspull-requests: write, butmicnncim/action-label-syncerneeds permission to manage repository labels (via the issues/labels API), so you likely need to addissues: write(or appropriate repo-level scope) to the workflow permissions. - The inline Python in the local
add-spdx-headerpre-commit hook is quite large and complex for an embedded one-liner; consider moving it into a dedicated script file (checked into the repo) and referencing that from the hook for easier maintenance and testing.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- The `.github/labeler.yml` rules for the `bug` label are extremely broad (any `*.go` or `*_test.go` change), which will cause most PRs to be auto-labeled as bugs; consider tightening these patterns so labels more accurately reflect intent.
- The `label-sync.yaml` workflow only grants `pull-requests: write`, but `micnncim/action-label-syncer` needs permission to manage repository labels (via the issues/labels API), so you likely need to add `issues: write` (or appropriate repo-level scope) to the workflow permissions.
- The inline Python in the local `add-spdx-header` pre-commit hook is quite large and complex for an embedded one-liner; consider moving it into a dedicated script file (checked into the repo) and referencing that from the hook for easier maintenance and testing.
## Individual Comments
### Comment 1
<location path=".github/workflows/ci.yaml" line_range="49-56" />
<code_context>
version: v2.11.3
- name: Run go vet
run: go vet ./...
+ - name: Check SPDX headers
+ run: |
+ missing=$(grep -rL "// SPDX-License-Identifier: Apache-2.0" --include="*.go" . || true)
+ if [ -n "$missing" ]; then
+ echo "Missing SPDX headers in:"
+ echo "$missing"
+ exit 1
+ fi
- name: Run test
run: go test -race -v ./...
</code_context>
<issue_to_address>
**suggestion:** Align the SPDX CI check with the pre-commit hook behavior and consider limiting the scan to tracked files.
The CI step currently uses `grep -rL` over all `*.go` files in the tree, which may include generated or ignored files and may not exactly match what the pre-commit hook enforces. Two suggestions:
1) Use `git ls-files "*.go"` instead of `grep -r` so CI only checks tracked Go sources.
2) Match the exact header form used by the pre-commit hook (e.g., `^// SPDX-License-Identifier:`) so both checks enforce the same invariant and don’t drift over time.
```suggestion
- name: Check SPDX headers
run: |
missing=$(git ls-files '*.go' | xargs -r grep -L -E '^// SPDX-License-Identifier:' || true)
if [ -n "$missing" ]; then
echo "Missing SPDX headers in:"
echo "$missing"
exit 1
fi
```
</issue_to_address>
### Comment 2
<location path=".github/workflows/labeler.yml" line_range="3-5" />
<code_context>
+name: CodeQL
+
+on:
+ push:
+ branches:
</code_context>
<issue_to_address>
**🚨 question (security):** Using `pull_request_target` has security implications when labeling untrusted forks.
Because `pull_request_target` runs with base-repo privileges, it can be risky if any PR-supplied files or config are interpreted. In this workflow you read `.github/labeler.yml` from the target branch, which is safer than reading from the PR branch, but please double-check that no other untrusted PR content is used. If you don’t rely on `pull_request_target` semantics (e.g., for secrets), prefer `pull_request` to minimize the attack surface.
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
- Extract inline SPDX pre-commit hook to scripts/add-spdx-header.py - Tighten labeler rules: remove overly broad bug label, scope enhancement - Switch labeler workflow from pull_request_target to pull_request - Add issues:write permission to label-sync workflow - Align CI SPDX check to use git ls-files and match exact header format
github-actions
Bot
added
documentation
enhancement
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Manual step required
After merging, update the GitHub repo license setting:
Settings → General → License → Apache 2.0
Test plan
go build ./...passesgo vet ./...passesgo test -race ./...passesSummary by Sourcery
Switch the project to Apache 2.0 licensing and set up open-source friendly automation, templates, and metadata.
New Features:
Enhancements:
CI:
Documentation:
Chores: