Add ScanCode license scanning workflow

Introduces a standalone License Scan workflow using
aboutcode-org/scancode-action, replacing the intended FOSSA
integration. Runs on all pull requests and pushes to main,
scanning the codebase and enforcing a license policy
(check-compliance at ERROR level) backed by policies.yml.

- .github/workflows/scancode.yml: scan_codebase pipeline emitting
  JSON/SPDX/CycloneDX SBOMs; actions SHA-pinned per repo convention.
- policies.yml: approves permissive (MIT/Apache/BSD/ISC) licenses,
  denies copyleft (GPL/AGPL/LGPL) as error.
- README.md: adds the built-in GitHub Actions status badge.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

Author: tbjers

.github/workflows/scancode.yml

@@ -0,0 +1,28 @@
+name: License Scan
+
+on:
+  pull_request:
+  push:
+    branches: [main]
+
+env:
+  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
+
+permissions:
+  contents: read
+
+jobs:
+  scan:
+    name: ScanCode
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          path: scancode-inputs
+
+      - uses: aboutcode-org/scancode-action@e46d127dfbe502ad2699fbbba8efedad1b2adbd1 # beta
+        with:
+          pipelines: "scan_codebase"
+          output-formats: "json spdx cyclonedx"
+          check-compliance: true
+          compliance-fail-level: "ERROR"

README.md

@@ -1,6 +1,7 @@
 # coverage-tracker
 
 ![Endpoint Badge](https://img.shields.io/endpoint?url=https%3A%2F%2Fdemo.coveragetracker.dev%2Fapi%2Fbadge%2FCoverageTracker%2Fcoverage-tracker%2Fcoverage.json)
+[![License Scan](https://github.com/CoverageTracker/coverage-tracker/actions/workflows/scancode.yml/badge.svg)](https://github.com/CoverageTracker/coverage-tracker/actions/workflows/scancode.yml)
 
 A self-hosted dashboard that tracks code coverage, cyclomatic complexity, and code duplication across your GitHub repositories — with trend charts, per-PR diff checks, and README badges.
 

policies.yml

@@ -0,0 +1,42 @@
+license_policies:
+  # Approved — permissive, MIT-compatible
+  - license_key: mit
+    label: Approved License
+    compliance_alert: ''
+  - license_key: apache-2.0
+    label: Approved License
+    compliance_alert: ''
+  - license_key: bsd-new
+    label: Approved License
+    compliance_alert: ''
+  - license_key: bsd-simplified
+    label: Approved License
+    compliance_alert: ''
+  - license_key: isc
+    label: Approved License
+    compliance_alert: ''
+  - license_key: 0bsd
+    label: Approved License
+    compliance_alert: ''
+  - license_key: unlicense
+    label: Approved License
+    compliance_alert: ''
+  - license_key: cc0-1.0
+    label: Approved License
+    compliance_alert: ''
+  - license_key: python
+    label: Approved License
+    compliance_alert: ''
+  # Prohibited — strong copyleft, incompatible with MIT distribution
+  - license_key: gpl-2.0
+    label: Prohibited License
+    compliance_alert: error
+  - license_key: gpl-3.0
+    label: Prohibited License
+    compliance_alert: error
+  - license_key: agpl-3.0
+    label: Prohibited License
+    compliance_alert: error
+  - license_key: lgpl-3.0
+    label: Prohibited License
+    compliance_alert: error