Skip to content

refactor: ♻️ Use GitHub's licensee engine for license detection#187

Merged
slugb0t merged 5 commits into
mainfrom
staging
Jul 8, 2026
Merged

refactor: ♻️ Use GitHub's licensee engine for license detection#187
slugb0t merged 5 commits into
mainfrom
staging

Conversation

@slugb0t

@slugb0t slugb0t commented Jul 8, 2026

Copy link
Copy Markdown
Member

Summary by Sourcery

Delegate license detection to GitHub’s licensee engine while persisting and surfacing the detected license file path across backend, storage, and dashboard rendering.

New Features:

  • Store and expose the repository license file path alongside detected SPDX ID and content.
  • Display the actual detected license file path in the dashboard license section instead of a hardcoded name.

Enhancements:

  • Use GitHub’s license API as the primary source of license path, content, and SPDX ID, falling back to conventional license-like filenames only when detection fails.
  • Expand fallback license filename patterns to include common COPYING variants.
  • Refine NOASSERTION license handling and logging messages for clearer diagnostics.

Chores:

  • Add a Prisma migration to persist license file paths in the LicenseRequest table.

@fairdataihub-bot

Copy link
Copy Markdown

Thank you for submitting this pull request! We appreciate your contribution to the project. Before we can merge it, we need to review the changes you've made to ensure they align with our code standards and meet the requirements of the project. We'll get back to you as soon as we can with feedback. Thanks again!

@sourcery-ai

sourcery-ai Bot commented Jul 8, 2026

Copy link
Copy Markdown

Reviewer's Guide

Refactors license detection to rely primarily on GitHub's licensee engine (via detectLicense) while persisting and surfacing the detected license file path and content throughout the compliance, persistence, and dashboard layers, with a small schema migration to store the license path and an expanded fallback search for license-like files.

Sequence diagram for updated license detection using GitHub licensee engine

sequenceDiagram
  participant Caller
  participant ComplianceLicense as checkForLicense
  participant Provider as GitHubRepositoryProvider

  Caller->>ComplianceLicense: checkForLicense(owner, repo)
  ComplianceLicense->>Provider: detectLicense(owner, repo)
  alt provider returns detected.path
    Provider-->>ComplianceLicense: DetectedLicense{name, content, path, spdxId}
    ComplianceLicense-->>Caller: LicenseResult{status:true, path:detected.path, content:detected.content, spdx_id:detected.spdxId}
  else no detected.path
    Provider-->>ComplianceLicense: DetectedLicense{name:null, content:null, path:null, spdxId:null}
    loop LICENSE_PATHS
      ComplianceLicense->>Provider: getFileContent(owner, repo, filePath)
      alt file found
        Provider-->>ComplianceLicense: {content}
        ComplianceLicense-->>Caller: LicenseResult{status:true, path:filePath, content, spdx_id:null}
      end
    end
    ComplianceLicense-->>Caller: LicenseResult{status:false, path:"No LICENSE file found", content:"", spdx_id:null}
  end
Loading

Entity relationship diagram for LicenseRequest with persisted license_path

erDiagram
  Repository ||--o{ LicenseRequest : has

  Repository {
    int id
  }

  LicenseRequest {
    int id
    string license_id
    string license_path
  }
Loading

File-Level Changes

Change Details Files
Delegate license detection to provider.detectLicense and only fall back to conventional filenames, while adjusting downstream validation and database updates to handle undecided/custom licenses more explicitly.
  • Extend ExistingLicense to include a persisted license_path field used when reusing previous license data.
  • In checkForLicense, call provider.detectLicense first and, if a path is returned, use its path/content/spdxId directly; otherwise, fall back to scanning a small set of conventional license filenames and treat any found file as a non-classified (spdx_id = null) custom candidate.
  • Adjust log messages in validateLicense to clarify handling of missing, NOASSERTION, and custom license cases without changing decision logic.
  • In updateLicenseDatabase, track licensePath alongside licenseId/content, prefer an existing record when inputs are empty and existing contains_license is true, and persist license_path on both update and create.
ui/server/services/compliance/license.ts
Augment the GitHub repository provider to return the matched license file path and decoded content from GitHub's license API, and propagate this through the provider interface.
  • Extend DetectedLicense interface to include UTF-8 decoded content and file path fields.
  • In GitHubRepositoryProvider.detectLicense, decode the API's base64-encoded content, capture the path, and return them together with name and spdxId.
  • Ensure 404 handling returns nulls for name, content, path, and spdxId instead of throwing.
ui/server/services/providers/github.ts
ui/server/services/providers/interface.ts
Surface the actual detected license file path in dashboard rendering and subject loading so user-facing text no longer assumes the file is named LICENSE at the repository root.
  • In _subjectsFromDb, populate license.path from licenseDb.license_path instead of hard-coding an empty string.
  • Update renderLicense markdown templates to interpolate license.path in user-facing messages for both standard and custom licenses, and slightly tweak phrasing around NOASSERTION/custom cases.
ui/server/services/dashboard/manager.ts
ui/server/services/dashboard/renderer.ts
Persist the license file path for each LicenseRequest in the database.
  • Add a non-null TEXT license_path column with default '' to the LicenseRequest table via a Prisma migration.
ui/prisma/schema.prisma
ui/prisma/migrations/20260701183609_add_license_path_to_license_request/migration.sql

Tips and commands

Interacting with Sourcery

  • Trigger a new review: Comment @sourcery-ai review on the pull request.
  • Continue discussions: Reply directly to Sourcery's review comments.
  • Generate a GitHub issue from a review comment: Ask Sourcery to create an
    issue from a review comment by replying to it. You can also reply to a
    review comment with @sourcery-ai issue to create an issue from it.
  • Generate a pull request title: Write @sourcery-ai anywhere in the pull
    request title to generate a title at any time. You can also comment
    @sourcery-ai title on the pull request to (re-)generate the title at any time.
  • Generate a pull request summary: Write @sourcery-ai summary anywhere in
    the pull request body to generate a PR summary at any time exactly where you
    want it. You can also comment @sourcery-ai summary on the pull request to
    (re-)generate the summary at any time.
  • Generate reviewer's guide: Comment @sourcery-ai guide on the pull
    request to (re-)generate the reviewer's guide at any time.
  • Resolve all Sourcery comments: Comment @sourcery-ai resolve on the
    pull request to resolve all Sourcery comments. Useful if you've already
    addressed all the comments and don't want to see them anymore.
  • Dismiss all Sourcery reviews: Comment @sourcery-ai dismiss on the pull
    request to dismiss all existing Sourcery reviews. Especially useful if you
    want to start fresh with a new review - don't forget to comment
    @sourcery-ai review to trigger a new review!

Customizing Your Experience

Access your dashboard to:

  • Enable or disable review features such as the Sourcery-generated pull request
    summary, the reviewer's guide, and others.
  • Change the review language.
  • Add, remove or edit custom review instructions.
  • Adjust other review settings.

Getting Help

@fairdataihub-bot

Copy link
Copy Markdown

Thanks for making updates to your pull request. Our team will take a look and provide feedback as soon as possible. Please wait for any GitHub Actions to complete before editing your pull request. If you have any additional questions or concerns, feel free to let us know. Thank you for your contributions!

@what-the-diff

what-the-diff Bot commented Jul 8, 2026

Copy link
Copy Markdown

PR Summary

  • Introduction of New SQL Migration File
    A new migration procedure has been established to include a license_path column in the LicenseRequest table, allowing us to track where each license is stored.

  • Update to the Data Model
    The Prisma schema has been updated so that the LicenseRequest model now contains a license_path field. This is a string and will be empty by default.

  • Existing License Interface Modification
    The interface for existing licenses has been slightly modified to include the newly added license_path property.

  • Broadened License File Name Possibilities
    The list of common license file names that our program recognizes (LICENSE_PATHS) has been expanded to include additional names like COPYING, COPYING.LESSER for improved detection.

  • Enhancement to License Detection Capabilities

    • We've improved the way the system handles the detection of license files. It can now automatically detect the license file via the provider, retrieving its path and content when found.
    • We've also updated the comments to clarify the fallback plan if the system fails to detect the license automatically.
  • Updates to License Validation and Appropriate Database Modification

    • The updateLicenseDatabase function has been adjusted to manage the newly added license_path.
    • The logic has been modified so that the licensePath variable is populated depending on the existing license record.
  • Improved Display of License Information
    License information on the dashboard is now accurately displayed. It uses the actual license_path detected, rather than a hardcoded string as used before.

  • Enhanced GitHub API Responses
    The mechanism for detecting licenses via the GitHub API (detectLicense method) now sends back more informative responses. Along with the name and SPDX ID, it also returns the path and content of the detected license file.

@sourcery-ai sourcery-ai Bot left a comment

Copy link
Copy Markdown

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Hey - I've found 1 issue, and left some high level feedback:

  • In checkForLicense, the detectLicense call swallows any error and downgrades it to a "no license" result; consider narrowing this catch (e.g., only handling 404/known API failures) so unexpected errors still surface rather than silently hiding provider issues.
  • The renderLicense messages now interpolate license.path but still claim the file is "at the root level"; since the GitHub API may return non-root paths, consider updating this wording to reflect the actual path location or omitting the root-level assumption.
Prompt for AI Agents
Please address the comments from this code review:

## Overall Comments
- In `checkForLicense`, the `detectLicense` call swallows any error and downgrades it to a "no license" result; consider narrowing this catch (e.g., only handling 404/known API failures) so unexpected errors still surface rather than silently hiding provider issues.
- The `renderLicense` messages now interpolate `license.path` but still claim the file is "at the root level"; since the GitHub API may return non-root paths, consider updating this wording to reflect the actual path location or omitting the root-level assumption.

## Individual Comments

### Comment 1
<location path="ui/server/services/dashboard/manager.ts" line_range="501" />
<code_context>
     license: {
       content: licenseDb?.license_content ?? "",
-      path: "",
+      path: licenseDb?.license_path ?? "",
       spdx_id: licenseDb?.license_id ?? null,
       status: licenseDb?.contains_license ?? false,
</code_context>
<issue_to_address>
**suggestion:** Handle empty `license_path` more gracefully when rendering the dashboard

For existing `LicenseRequest` rows, `license_path` will be `""` until they’re backfilled, so this change will render `A `` file is found...` for those cases. Consider normalizing the value here (e.g., use `null` or a default like `"LICENSE"` when the DB value is empty) and update `renderLicense` to treat that case explicitly.

Suggested implementation:

```typescript
    cwl: null,
    license: {
      content: licenseDb?.license_content ?? "",
      // Normalize empty/whitespace-only license_path to null so rendering can treat it explicitly.
      path: licenseDb?.license_path?.trim() ? licenseDb.license_path.trim() : null,
      spdx_id: licenseDb?.license_id ?? null,
      status: licenseDb?.contains_license ?? false,
    },

```

To fully implement your comment, the UI code that renders license information (likely a `renderLicense` function or component) should be updated to:
1. Treat `license.path === null` (or `!license.path`) as a special case and avoid rendering backticks with an empty path (e.g., show “A license file is found...” or “A license file is present but its path is not yet available” instead of `A `` file is found...`).
2. Optionally, if you’d rather display a default like `"LICENSE"`, you could instead normalize with `path: licenseDb?.license_path?.trim() || "LICENSE"`, and adjust the renderer text accordingly to explain it’s an assumed/default path.
3. Ensure any logic that tests for existence of a license file uses `license.status` (or similar boolean) rather than assuming a non-empty `path` is the only indicator.
</issue_to_address>

Sourcery is free for open source - if you like our reviews please consider sharing them ✨
Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.

Comment thread ui/server/services/dashboard/manager.ts
@slugb0t
slugb0t merged commit a8c5707 into main Jul 8, 2026
5 checks passed
@fairdataihub-bot

Copy link
Copy Markdown

Thank you for getting this pull request merged. We appreciate your contribution and look forward to your next one!

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant