docs(debt): close L1 — GitHub now detects MPL-2.0 - #61
Merged
Conversation
L1 said the API result 'must be re-checked after merge'. Re-checked: $ gh api repos/hyperpolymath/invariant-path/license {"name":"MPL-2.0","path":"LICENSE"} The trailing-space and http/https diagnosis was correct. Recording one thing that nearly caused a wrong conclusion: detection LAGS the push. An immediate query still returned null and only cleared after a pause, which looked exactly like the fix having failed. Also annotates C2: PR #59 makes Scorecard periodic, which is correct on signal-discipline grounds but does not fix the startup_failure — it changes when the failure is visible, not whether it happens.
This comment has been minimized.
This comment has been minimized.
![gitar-bot[bot]](https://avatars.githubusercontent.com/in/827041?s=60&v=4){kind=small}
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Small follow-up to the documentation refresh, closing one finding with its evidence.
L1 → RESOLVED
docs/DEBT.mdL1 said the API result "must be re-checked after merge". Re-checked:The diagnosis was right:
LICENSEdeviated from canonical MPL-2.0 by a trailing space (line 38) andhttpvshttps(line 360). Replacing it with the canonical text fixed detection. The repository had been showing as unlicensed.One gotcha recorded, because it nearly produced the wrong conclusion: GitHub's licence detection lags the push. An immediate
gh repo view --json licenseInfostill returnednulland only cleared after a pause — indistinguishable from the fix having failed. Anyone re-testing this should wait before concluding.C2 annotated
PR #59 makes Scorecard periodic rather than per-push. That is right on signal-discipline grounds — Scorecard measures the repository's posture, not the change under review — but it does not close C2: a scheduled run will still fail to start for whatever the underlying cause is. It changes when the failure is visible, not whether it happens. Noted so the two are not conflated when #59 lands.
Docs only; no code, no workflows.
🤖 Generated with Claude Code