Add community health files, harden CI, and relicense to Apache-2.0 - #326
Add community health files, harden CI, and relicense to Apache-2.0#3261a1a11a wants to merge 1 commit into
Conversation
![chatgpt-codex-connector[bot]](https://avatars.githubusercontent.com/in/1144995?s=60&v=4){kind=small}
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: 9f67ea3531
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
|
|
||
| Every new eviction, admission, or prefetching algorithm needs a test in the matching file under [`test/`](test/) — for eviction algorithms that is [`test/test_evictionAlgo.c`](test/test_evictionAlgo.c). | ||
|
|
||
| [`test/test_cli.sh`](test/test_cli.sh) (the `testCLI` target) covers the command-line tools rather than the library: option parsing, `-e print` parameter reporting, and eviction parameter validation. If you add an algorithm parameter or a CLI option, add a case there. It runs from the build directory and skips itself if the binaries or the sample traces are not where it expects, so it can also be run by hand: |
There was a problem hiding this comment.
At this commit, a repository-wide tracked-file search finds neither test/test_cli.sh nor an equivalent CLI test script, and test/CMakeLists.txt defines no testCLI target. Contributors following this new guidance for CLI or algorithm-parameter changes will therefore hit a missing file and cannot run or extend the claimed coverage; either add and register the described test or replace these instructions with an existing test path.
Useful? React with 👍 / 👎.
There was a problem hiding this comment.
Pull request overview
Repository-maintenance PR that prepares libCacheSim for open-source readiness by relicensing to Apache-2.0, adding standard community health files, hardening CI defaults, and removing unreferenced scratch artifacts (no simulation/source-code behavior changes).
Changes:
- Relicense the repository to Apache-2.0 and align license declarations in docs and the Node.js binding metadata.
- Add/refresh community health files (CONTRIBUTING, CoC, SECURITY policy, PR template, CITATION, EditorConfig).
- Harden GitHub Actions workflows (checkout v4 +
persist-credentials: false, replace archived release action) and clean up ignored/unneeded files.
Reviewed changes
Copilot reviewed 19 out of 21 changed files in this pull request and generated 1 comment.
Show a summary per file
| File | Description |
|---|---|
LICENSE |
Replace GPLv3 text with canonical Apache-2.0 license text. |
CITATION.cff |
Add citation metadata and set license to Apache-2.0. |
CODE_OF_CONDUCT.md |
Add Contributor Covenant v2.1 code of conduct. |
CONTRIBUTING.md |
Add contributor guidance for setup, testing, style, and PR process. |
SECURITY.md |
Replace boilerplate with GitHub private reporting guidance and scope expectations. |
README.md |
Link to new contributing/coC/security docs and clarify Apache-2.0 licensing. |
.editorconfig |
Add EditorConfig aligned with formatting conventions. |
.gitignore |
Clarify ignores (build output, IDE config) and keep selected .vscode files tracked. |
.github/PULL_REQUEST_TEMPLATE.md |
Add structured PR template/checklist. |
.github/workflows/npm-release.yml |
Use actions/checkout@v4 with hardened settings; replace archived release action with gh release create. |
.github/workflows/codeql-analysis.yml |
Harden checkout with persist-credentials: false. |
.github/workflows/code-quality.yml |
Bump checkout to v4 and harden credentials. |
.github/workflows/build.yml |
Harden checkout with persist-credentials: false. |
libCacheSim-node/package.json |
Update license to Apache-2.0 and fix homepage branch path. |
libCacheSim-node/README.md |
Update license statement and fix related-project link. |
package-lock.json |
Remove empty root lockfile. |
test.c |
Remove unreferenced scratch/example file. |
scripts/note |
Remove unreferenced scratch notes file. |
doc/TODO |
Remove unreferenced scratch TODO list. |
random/allocator.c |
Remove unreferenced scratch benchmark code. |
random/allocatorResult |
Remove unreferenced scratch benchmark output. |
💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.
| [`test/test_cli.sh`](test/test_cli.sh) (the `testCLI` target) covers the command-line tools rather than the library: option parsing, `-e print` parameter reporting, and eviction parameter validation. If you add an algorithm parameter or a CLI option, add a case there. It runs from the build directory and skips itself if the binaries or the sample traces are not where it expects, so it can also be run by hand: | ||
|
|
||
| ```bash | ||
| cd _build && bash ../test/test_cli.sh | ||
| ``` |
9f67ea3 to
4c81d19
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: d739e57193
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| Apache License | ||
| Version 2.0, January 2004 |
There was a problem hiding this comment.
When the existing code is distributed under the newly declared Apache-2.0 terms, this replacement purports to grant permissions that only its copyright holders can grant. The commit description explicitly says the consent of the 14 authors in visible history is assumed rather than established, while the history contains substantial outside-authored source contributions such as Clock2QPlus; merging this therefore risks mislicensing those contributions. Retain GPL-3.0 or document the necessary permissions from every relevant copyright holder before replacing the license.
Useful? React with 👍 / 👎.
d739e57 to
e8518b7
Compare
There was a problem hiding this comment.
💡 Codex Review
Here are some automated review suggestions for this pull request.
Reviewed commit: e8518b7c87
ℹ️ About Codex in GitHub
Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you
- Open a pull request for review
- Mark a draft as ready
- Comment "@codex review".
If Codex has suggestions, it will comment; otherwise it will react with 👍.
Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".
| bash scripts/setup_hooks.sh | ||
| ``` | ||
|
|
||
| The hook runs clang-format, clang-tidy, and a strict-warning compile on the files you staged, which is roughly what CI will check. Use `SKIP_LINT=1 git commit ...` to bypass it in a pinch. Logs are kept in `.lint-logs/`. |
There was a problem hiding this comment.
When contributors install this hook and rely on the documented validation, C/C++ changes with clang-tidy findings or compilation failures can still be committed: in scripts/setup_hooks.sh, both the clang-tidy block and the ninja strict-warning compilation block are commented out (lines 244–337), so the generated hook only configures CMake and runs clang-format. Its logs are also created under mktemp, not .lint-logs/. Either enable the promised checks/log location or document the hook's actual behavior.
Useful? React with 👍 / 👎.
|
Consolidated response to the review comments on this PR. Contributor consent for the relicense (P1) — real, and squarely the maintainer's call. Replacing GPL-3.0 with Apache-2.0 grants permissions only the copyright holders can grant, and 14 authors appear in the visible history. I raised this in the PR description before it was flagged and I am not able to resolve it: it needs the maintainer's judgement about which contributions are outside-authored and whether permission exists, not a code change. The relicense was requested explicitly by the project owner, so I implemented it and documented the assumption rather than making the decision silently. Do not merge this on the strength of CI being green — that part is a governance question.
Pre-commit hook description — real, not yet fixed. npm package license — fixed after a separate finding. The package declared Apache-2.0 while Generated by Claude Code |
e8518b7 to
c13378d
Compare
Part 1 of 5, split out of #324. Independent — mergeable in any order.
Repository metadata only. No source files are touched, so nothing here can change a simulation result.
Relicense to Apache-2.0
LICENSEis now the canonical Apache-2.0 text, verified byte-identical to the copy served by apache.org:Every declaration that named GPL now matches it —
CITATION.cff,libCacheSim-node/package.json, the node README,CONTRIBUTING.md, and the README license section, which named no license at all and only linked the file. NoGPLreference remains anywhere in the tree.Three things worth your attention:
libCacheSim/cache/eviction/LHDis MIT (CMU, 2017-2018) and is compiled in by default. MIT is compatible with Apache-2.0 and its ownLICENSEstays in place, which is what MIT requires. I checked this specifically, since a copyleft dependency there would have blocked the relicense.Copyright [yyyy] [name of copyright owner]) is left verbatim, as apache.org ships it and as most Apache-licensed projects do. It is instructional boilerplate for applying the license to source files, and the clone here is shallow, so filling in a start year would have meant guessing.The node package was previously self-contradictory:
package.jsondeclared MIT while the project was GPL-3.0 andbinding.gyplinksvendor/liblibCacheSim.astatically, and its README said "MIT License - see the LICENSE file" where that file was the repository's GPLv3.Community health files
CONTRIBUTING.md,CODE_OF_CONDUCT.md(Contributor Covenant 2.1), a pull request template,CITATION.cff, and.editorconfigmirroring.clang-format.SECURITY.mdwas GitHub's boilerplate with its instructional comments still in it and no reporting channel at all; it is rewritten around GitHub private vulnerability reporting. Enforcement contacts point at the.github/CODEOWNERSGitHub profiles rather than publishing an email address.CI
actions/create-release@v1was archived by GitHub in 2021 and is replaced withgh release createcheckout@v3bumped to v4persist-credentials: falseon every checkout (OpenSSF Scorecard)homepagepointed into a nonexistentmainbranchHygiene
Removed scratch files nothing referenced:
test.c,random/,doc/TODO,scripts/note, and an empty rootpackage-lock.json. Stopped.gitignore's.vscode/*rule from contradicting the four.vscode/*.jsonfiles deliberately checked in.Testing
No source changes, so no build impact.
CITATION.cffandpackage.jsonwere both parsed to confirm they are still valid, and the tree was grepped to confirm no GPL reference survives.Generated by Claude Code