Add REUSE compliance and SBoM

.credo.exs

@@ -1,3 +1,7 @@
+# SPDX-FileCopyrightText: 2023 Erlang Ecosystem Foundation
+#
+# SPDX-License-Identifier: Apache-2.0
+
 # This file contains the configuration for Credo and you are probably reading
 # this after creating it with `mix credo.gen.config`.
 #

.formatter.exs

@@ -1,3 +1,8 @@
+# SPDX-FileCopyrightText: 2023 Erlang Ecosystem Foundation
+# SPDX-FileCopyrightText: 2025 Matt Enlow
+#
+# SPDX-License-Identifier: Apache-2.0
+
 # Used by "mix format"
 [
   plugins: [Styler],

.github/CONTRIBUTING.md

@@ -1,3 +1,9 @@
+<!--
+SPDX-FileCopyrightText: 2023 Erlang Ecosystem Foundation
+
+SPDX-License-Identifier: Apache-2.0
+-->
+
 # Contributing to `oidcc`
 
 ## Welcome!

.github/ISSUE_TEMPLATE/BUG.yml

@@ -1,3 +1,7 @@
+# SPDX-FileCopyrightText: 2023 Erlang Ecosystem Foundation
+#
+# SPDX-License-Identifier: Apache-2.0
+
 name: 🐞 Bug Report
 description: Something is broken?
 labels: ["bug"]

.github/ISSUE_TEMPLATE/FEATURE.yml

@@ -1,3 +1,7 @@
+# SPDX-FileCopyrightText: 2023 Erlang Ecosystem Foundation
+#
+# SPDX-License-Identifier: Apache-2.0
+
 name: 🎉 Feature Request
 description: You have a neat idea that should be implemented?
 labels: ["enhancement"]

.github/PULL_REQUEST_TEMPLATE.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2023 Erlang Ecosystem Foundation
+
+SPDX-License-Identifier: Apache-2.0

.github/PULL_REQUEST_TEMPLATE/FIX.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2023 Erlang Ecosystem Foundation
+
+SPDX-License-Identifier: Apache-2.0

.github/PULL_REQUEST_TEMPLATE/IMPROVEMENT.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2023 Erlang Ecosystem Foundation
+
+SPDX-License-Identifier: Apache-2.0

.github/PULL_REQUEST_TEMPLATE/NEW_FEATURE.md.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2023 Erlang Ecosystem Foundation
+
+SPDX-License-Identifier: Apache-2.0

.github/dependabot.yml

@@ -1,3 +1,7 @@
+# SPDX-FileCopyrightText: 2023 Erlang Ecosystem Foundation
+#
+# SPDX-License-Identifier: Apache-2.0
+
 version: 2
 updates:
   - package-ecosystem: "github-actions"

.github/renovate.json.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: 2026 Erlang Ecosystem Foundation
+
+SPDX-License-Identifier: Apache-2.0

.github/scorecard.yml

@@ -1,3 +1,7 @@
+# SPDX-FileCopyrightText: 2026 Erlang Ecosystem Foundation
+#
+# SPDX-License-Identifier: Apache-2.0
+
 annotations:
   - checks:
       - fuzzing

.github/workflows/branch_main.yml

@@ -1,3 +1,7 @@
+# SPDX-FileCopyrightText: 2023 Erlang Ecosystem Foundation
+#
+# SPDX-License-Identifier: Apache-2.0
+
 on:
   push:
     branches:
@@ -18,6 +22,18 @@ jobs:
 
     uses: $/.github/workflows/part_test.yml
 
+  license:
+    name: "License"
+
+    permissions:
+      id-token: write
+      contents: read
+      attestations: write
+
+    uses: $/.github/workflows/part_license.yml
+    with:
+      attest: false
+
   docs:
     name: "Docs"
 

.github/workflows/codeql.yml

@@ -1,3 +1,7 @@
+# SPDX-FileCopyrightText: 2026 Erlang Ecosystem Foundation
+#
+# SPDX-License-Identifier: Apache-2.0
+
 name: "CodeQL Advanced"
 
 on:

.github/workflows/part_dependency_submission.yml

@@ -1,3 +1,7 @@
+# SPDX-FileCopyrightText: 2025 Erlang Ecosystem Foundation
+#
+# SPDX-License-Identifier: Apache-2.0
+
 on:
   workflow_call: {}
 

.github/workflows/part_docs.yml

@@ -1,3 +1,7 @@
+# SPDX-FileCopyrightText: 2023 Erlang Ecosystem Foundation
+#
+# SPDX-License-Identifier: Apache-2.0
+
 on:
   workflow_call:
     inputs:

.github/workflows/part_license.yml

@@ -0,0 +1,78 @@
+# SPDX-FileCopyrightText: 2026 Erlang Ecosystem Foundation
+#
+# SPDX-License-Identifier: Apache-2.0
+
+on:
+  workflow_call:
+    inputs:
+      attest:
+        description: "Attest the SBoM"
+        default: true
+        type: boolean
+
+name: "License Compliance"
+
+permissions:
+  contents: read
+
+jobs:
+  lint:
+    name: "Check REUSE License Compliance"
+
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: REUSE Compliance Check
+        uses: fsfe/reuse-action@676e2d560c9a403aa252096d99fcab3e1132b0f5 # v6.0.0
+
+  spdx:
+    name: "Generate SBoM"
+
+    runs-on: ubuntu-latest
+
+    permissions:
+      id-token: write
+      contents: read
+      attestations: write
+
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@46b06cea07f9e64621fdf066ba77ac6915163d43 # v2.22.3
+        with:
+          egress-policy: audit
+
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: REUSE Compliance Check
+        uses: fsfe/reuse-action@676e2d560c9a403aa252096d99fcab3e1132b0f5 # v6.0.0
+        with:
+          args: spdx --output sbom.spdx --creator-person "GitHub Action" --creator-organization "Erlang Ecosystem Foundation"
+
+      - name: "Attest provenance"
+        uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2
+        id: attest-provenance
+        if: "${{ inputs.attest }}"
+        with:
+          subject-path: 'sbom.spdx'
+
+      - name: "Copy provenance"
+        if: "${{ inputs.attest }}"
+        run: cp "$ATTESTATION" sbom.spdx.sigstore
+        env:
+          ATTESTATION: "${{ steps.attest-provenance.outputs.bundle-path }}"
+
+      - uses: actions/upload-artifact@cf430e030ddbb5b0abf93d22962f4752f3646cd9 # v7.0.2
+        with:
+          name: sbom
+          path: sbom.spdx*

.github/workflows/part_publish.yml

@@ -1,3 +1,7 @@
+# SPDX-FileCopyrightText: 2023 Erlang Ecosystem Foundation
+#
+# SPDX-License-Identifier: Apache-2.0
+
 on:
   workflow_call:
     inputs:

.github/workflows/part_release.yml

@@ -1,3 +1,7 @@
+# SPDX-FileCopyrightText: 2023 Erlang Ecosystem Foundation
+#
+# SPDX-License-Identifier: Apache-2.0
+
 on:
   workflow_call:
     inputs:
@@ -37,6 +41,12 @@ jobs:
           name: docs
           path: .
 
+      - name: "Download SBoM Artifact"
+        uses: actions/download-artifact@9000827ccba6bdab643e8b6fd33ac0654aef8333 # v8.0.2
+        with:
+          name: sbom
+          path: .
+
       - name: Create release
         env:
           GITHUB_TOKEN: ${{ github.token }}
@@ -48,4 +58,4 @@ jobs:
           --generate-notes
           ${{ !inputs.stable && '--prerelease' || '' }}
           "$RELEASE_NAME"
-          docs.tar.gz*
+          docs.tar.gz* sbom.spdx*

.github/workflows/part_test.yml

@@ -1,3 +1,7 @@
+# SPDX-FileCopyrightText: 2023 Erlang Ecosystem Foundation
+#
+# SPDX-License-Identifier: Apache-2.0
+
 on:
   workflow_call: {}
 

.github/workflows/pr.yml

@@ -1,3 +1,7 @@
+# SPDX-FileCopyrightText: 2023 Erlang Ecosystem Foundation
+#
+# SPDX-License-Identifier: Apache-2.0
+
 on:
   pull_request:
     branches:
@@ -19,6 +23,18 @@ jobs:
 
     uses: $/.github/workflows/part_test.yml
 
+  license:
+    name: "License"
+
+    permissions:
+      id-token: write
+      contents: read
+      attestations: write
+
+    uses: $/.github/workflows/part_license.yml
+    with:
+      attest: false
+
   docs:
     name: "Docs"
 

.github/workflows/scorecards.yml

@@ -1,3 +1,7 @@
+# SPDX-FileCopyrightText: 2026 Erlang Ecosystem Foundation
+#
+# SPDX-License-Identifier: Apache-2.0
+
 # This workflow uses actions that are not certified by GitHub. They are provided
 # by a third-party and are governed by separate terms of service, privacy
 # policy, and support documentation.

.github/workflows/tag-beta.yml

@@ -1,3 +1,7 @@
+# SPDX-FileCopyrightText: 2023 Erlang Ecosystem Foundation
+#
+# SPDX-License-Identifier: Apache-2.0
+
 on:
   push:
     tags:
@@ -21,6 +25,16 @@ jobs:
 
     uses: $/.github/workflows/part_docs.yml
 
+  license:
+    name: "License"
+
+    permissions:
+      id-token: write
+      contents: read
+      attestations: write
+
+    uses: $/.github/workflows/part_license.yml
+
   publish:
     name: "Publish"
 
@@ -35,7 +49,7 @@ jobs:
   release:
     name: "Release"
 
-    needs: ["docs"]
+    needs: ["docs", "license"]
 
     permissions:
       contents: write

.github/workflows/tag-stable.yml

@@ -1,3 +1,7 @@
+# SPDX-FileCopyrightText: 2023 Erlang Ecosystem Foundation
+#
+# SPDX-License-Identifier: Apache-2.0
+
 on:
   push:
     tags:
@@ -19,6 +23,16 @@ jobs:
 
     uses: $/.github/workflows/part_docs.yml
 
+  license:
+    name: "License"
+
+    permissions:
+      id-token: write
+      contents: read
+      attestations: write
+
+    uses: $/.github/workflows/part_license.yml
+
   publish:
     name: "Publish"
 
@@ -33,7 +47,7 @@ jobs:
   release:
     name: "Release"
 
-    needs: ["docs"]
+    needs: ["docs", "license"]
 
     permissions:
       contents: write

.gitignore

@@ -1,3 +1,7 @@
+# SPDX-FileCopyrightText: 2023 Erlang Ecosystem Foundation
+#
+# SPDX-License-Identifier: Apache-2.0
+
 # The directory Mix will write compiled artifacts to.
 /_build/
 

.tool-versions.license

@@ -0,0 +1,3 @@
+SPDX-FileCopyrightText: NONE
+
+SPDX-License-Identifier: CC0-1.0