Warn when a module has not set a license - #671
Merged
Merged
Conversation
The SDK's module templates seed `license: Specify your license`, and nothing prompts anyone to replace it. Three modules under tidev have shipped releases with it still in place — titanium-identity, titanium-onboarding and ti.previewinteraction — and it surfaces anywhere the manifest does. `readManifest()` now warns when it sees one. It deliberately does not throw: the placeholder belongs to a dependency, and failing an app build because somebody else's metadata is unfilled punishes the wrong person. The predicate is exported so a packaging or release step, which is talking to the author who can actually fix it, can reject what this only warns about.
The warning called the value a "scaffolding placeholder", which describes where the string came from rather than what the reader should do about it. It now names the fix: Module ti.foo has not set a license (ios/manifest): choose an SPDX license such as "Apache-2.0". Suggesting SPDX rather than any free-form string is the point: sixteen modules currently spell Apache 2.0 six different ways, which is what made this worth warning about at all.
cb1kenobi
changed the title
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The SDK's module templates seed the manifest with a placeholder licence:
Nothing prompts anyone to replace it, so it ships. A code search across
tidevfinds three modules that have released with it still in place — titanium-identity, titanium-onboarding and ti.previewinteraction — and it surfaces anywhere the manifest does, including the module listing on titaniumsdk.com.readManifest()now warns when it sees one:The message names the fix rather than the origin of the string — where the value came from is not the reader's problem. Suggesting SPDX specifically is the point: across the sixteen modules in the Titanium registry, Apache 2.0 is currently spelled six different ways (
Apache 2.0,Apache License Version 2.0,Apache License, Version 2.0,Apache,Apache 2,Apache Public License v2), which is what made this worth warning about at all.Why a warning and not an error
readManifest()already throws for a missingmoduleid,platformorversion, so throwing here would be consistent — but those are structural, and this is not. The placeholder belongs to a dependency. Failing an app build because somebody else's metadata is unfilled punishes the person who cannot fix it, and would break builds that work today for three real modules.The predicate is exported instead:
so a packaging or release step — which is talking to the author who can fix it — can reject what this only warns about. That is the layer where the check actually belongs.
Matching ignores case and surrounding whitespace, since the templates emit a trailing newline and manifests are hand-edited. A missing licence is treated as not a placeholder: absent is a different problem from unfilled, and not this check's.
Checks
4 new tests; full suite 287 passed, 1 skipped, across 29 files.
pnpm check(type-check, lint, format) clean.Context: this came out of TI-66 on the titaniumsdk.com rewrite, which found the placeholder plus the six spellings. The spelling normalisation went out as separate PRs to the module repos and is now merged in eight of them.
🤖 Generated with Claude Code