From a174f0cfacbc0a3a0042263ec26f3c66b914da98 Mon Sep 17 00:00:00 2001
From: Torgny Bjers <torgny@bjers.org>
Date: Mon, 6 Jul 2026 15:12:24 -0400
Subject: [PATCH] Add ScanCode license scanning workflow

Introduces a standalone License Scan workflow using
aboutcode-org/scancode-action, replacing the intended FOSSA
integration. Runs on all pull requests and pushes to main,
scanning the codebase and enforcing a license policy
(check-compliance at ERROR level) backed by policies.yml.

- .github/workflows/scancode.yml: scan_codebase pipeline emitting
  JSON/SPDX/CycloneDX SBOMs; actions SHA-pinned per repo convention.
- policies.yml: approves permissive (MIT/Apache/BSD/ISC) licenses,
  denies copyleft (GPL/AGPL/LGPL) as error.
- README.md: adds the built-in GitHub Actions status badge.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
---
 .github/workflows/scancode.yml | 28 +++++++++++++++++++++++
 README.md                      |  1 +
 policies.yml                   | 42 ++++++++++++++++++++++++++++++++++
 3 files changed, 71 insertions(+)
 create mode 100644 .github/workflows/scancode.yml
 create mode 100644 policies.yml

diff --git a/.github/workflows/scancode.yml b/.github/workflows/scancode.yml
new file mode 100644
index 0000000..42d40c4
--- /dev/null
+++ b/.github/workflows/scancode.yml
@@ -0,0 +1,28 @@
+name: License Scan
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    name: ScanCode
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          path: scancode-inputs
+
+      - uses: aboutcode-org/scancode-action@e46d127dfbe502ad2699fbbba8efedad1b2adbd1 # beta
+        with:
+          pipelines: "scan_codebase"
+          output-formats: "json spdx cyclonedx"
+          check-compliance: true
+          compliance-fail-level: "ERROR"
diff --git a/README.md b/README.md
index 75ffaee..6e3f721 100644
--- a/README.md
+++ b/README.md
@@ -1,6 +1,7 @@
 # coverage-tracker
 
 ![Endpoint Badge](https://img.shields.io/endpoint?url=https%3A%2F%2Fdemo.coveragetracker.dev%2Fapi%2Fbadge%2FCoverageTracker%2Fcoverage-tracker%2Fcoverage.json)
+[![License Scan](https://github.com/CoverageTracker/coverage-tracker/actions/workflows/scancode.yml/badge.svg)](https://github.com/CoverageTracker/coverage-tracker/actions/workflows/scancode.yml)
 
 A self-hosted dashboard that tracks code coverage, cyclomatic complexity, and code duplication across your GitHub repositories — with trend charts, per-PR diff checks, and README badges.
 
diff --git a/policies.yml b/policies.yml
new file mode 100644
index 0000000..da680e6
--- /dev/null
+++ b/policies.yml
@@ -0,0 +1,42 @@
+license_policies:
+  # Approved — permissive, MIT-compatible
+  - license_key: mit
+    label: Approved License
+    compliance_alert: ''
+  - license_key: apache-2.0
+    label: Approved License
+    compliance_alert: ''
+  - license_key: bsd-new
+    label: Approved License
+    compliance_alert: ''
+  - license_key: bsd-simplified
+    label: Approved License
+    compliance_alert: ''
+  - license_key: isc
+    label: Approved License
+    compliance_alert: ''
+  - license_key: 0bsd
+    label: Approved License
+    compliance_alert: ''
+  - license_key: unlicense
+    label: Approved License
+    compliance_alert: ''
+  - license_key: cc0-1.0
+    label: Approved License
+    compliance_alert: ''
+  - license_key: python
+    label: Approved License
+    compliance_alert: ''
+  # Prohibited — strong copyleft, incompatible with MIT distribution
+  - license_key: gpl-2.0
+    label: Prohibited License
+    compliance_alert: error
+  - license_key: gpl-3.0
+    label: Prohibited License
+    compliance_alert: error
+  - license_key: agpl-3.0
+    label: Prohibited License
+    compliance_alert: error
+  - license_key: lgpl-3.0
+    label: Prohibited License
+    compliance_alert: error