Audit public repository root licenses across PickNik orgs

[kronk-bot]

[written by AI]

Summary

• audit active public non-fork repositories in both PickNikRobotics and PickNikRoboticsServices
• fail closed on API, filtering, and sorting failures
• report missing and NOASSERTION root licenses through one machine-maintained issue
• run weekly and on manual dispatch with issue-write permission limited to the mutating job
• related to PickNikRobotics/moveit_pro#22271

Validation

• python3 -m unittest -v scripts/test_audit_public_repo_licenses.py — 9 tests passed
• bash -n scripts/audit_public_repo_licenses.sh — passed
• shellcheck scripts/audit_public_repo_licenses.sh — passed
• shared jq predicate fixture — passed
• live read-only audit — correctly reported only PickNikRoboticsServices/robot_configuration_setup
• YAML parsing and git diff --check — passed
• independent and CodeRabbit CLI reviews — passed after findings were addressed

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Team

Run ID: 4e30bd40-8758-4067-bbee-c2c0c476c342

📥 Commits

Reviewing files that changed from the base of the PR and between 82d77ae and d861c9b.

📒 Files selected for processing (3)

• .github/workflows/public_repo_license_audit.yaml
• scripts/audit_public_repo_licenses.sh
• scripts/test_audit_public_repo_licenses.py

Included review availability: 9 reviews are currently available. Your included PR review attempts over the past 7 days set your current allowance at 10 reviews per hour.

---

📝 Summary

Summary by CodeRabbit

• New Features

  • Added automated audits to identify public repositories with missing or unrecognized root licenses.
  • Audits run on a schedule or manually and can create, update, or close a tracking issue.
  • Checks fail when unresolved license findings remain or audit results cannot be verified.

• Documentation

  • Added guidance for audit behavior, repository scope, issue tracking, pull request checks, and local execution.

• Tests

  • Added coverage for successful audits, failures, filtering, issue updates, remediation, and duplicate tracking issues.

Walkthrough

The change adds a public repository license audit. The audit filters repositories, reports missing licenses, manages a tracking issue, runs through GitHub Actions, and includes unit tests and local usage documentation.

Changes

Public repository license audit

Layer / File(s)	Summary
Repository filtering and scanning scripts/public_repo_license_findings.jq, scripts/audit_public_repo_licenses.sh, scripts/test_audit_public_repo_licenses.py	The jq filter selects active repositories with missing or unrecognized licenses. The audit scans both organizations, handles API and sorting failures, and reports unresolved repositories. Tests cover filtering and check-only results.
Tracking issue lifecycle scripts/audit_public_repo_licenses.sh, scripts/test_audit_public_repo_licenses.py	The audit detects duplicate tracking issues, closes resolved issues, and creates or updates a machine-managed issue for unresolved repositories. Tests cover issue creation, remediation closure, duplicate detection, and protection of human-authored issues.
Workflow and usage integration .github/workflows/public_repo_license_audit.yaml, README.md, scripts/test_audit_public_repo_licenses.py	The workflow runs tests on relevant pull requests and runs the audit on scheduled or manual dispatch. The README documents audit behavior and local execution. The test module provides the executable test entry point.

Priority: ⬇️ Low

Merge Risk: ⚪ Minimal · up to d861c

This adds a scheduled public-repository license audit with scoped issue updates and protections for human-authored tracking issues. The supplied validation and coverage indicate no remaining merge-blocking risk.

---

Caution

Pre-merge checks failed

Please resolve all errors before merging. Addressing warnings is optional.

• Ignore (reviewers only)

❌ Failed checks (1 error)

Check name	Status	Explanation	Resolution
Human Review Check	❌ Error	The PR is not low-risk. It adds a GitHub Actions workflow with pull-request, scheduled, and manual execution; runs-on: ubuntu-latest; repository and issue permissions; and `GH_TOKEN: ${{ github.toke…	This PR requires review by a requested human reviewer. After review, a non-author requested reviewer should override this pre-merge check.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description check	✅ Passed	The pull request description accurately describes the license audit script, workflow, issue behavior, permissions, schedule, and validation results covered by the changeset.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

Full details: Human Review Check

Explanation

The PR is not low-risk. It adds a GitHub Actions workflow with pull-request, scheduled, and manual execution; runs-on: ubuntu-latest; repository and issue permissions; and GH_TOKEN: ${{ github.token }}. These are explicit CI/CD and permissions/token changes covered by the failure conditions. The full diff from origin/main confirms the workflow and these settings are introduced by this PR.

• Fix all pre-merge checks with AI

---

_{Comment @coderabbitai help to get the list of available commands.}