Add License Scanning and Reporting for Endpoints Changes on Main.

[arav-agarwal2]

What does this PR do?

As part of the rollout for our AI coding policy, we'd like to add a small licensing checker to this codebase. It shouldn't block anything - it just reports changes on an action report we can review asynchronously.

Type of change

• Bug fix
• New feature
• Documentation update
• Refactor/cleanup

Related issues

Testing

• Tests added/updated
• All tests pass locally
• Manual testing completed

Checklist

• Code follows project style
• Pre-commit hooks pass
• Documentation updated (if needed)

[github-actions]

MLCommons CLA bot All contributors have signed the MLCommons CLA ✍️ ✅

[gemini-code-assist]

Code Review

This pull request adds a .github/scanoss.json configuration file to define scanning skip patterns (such as tests, vendor, and third-party directories) and specify BOM inclusions and exclusions. There are no review comments, and I have no feedback to provide.

Important

The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.

[arekay-nv]

Review-council: SCANOSS license-scan workflow

Three independent reviewers (Codex gpt-5.5, Grok 4.5, Claude) looked at this PR. The workflow is well-built and security-conscious — correct push-to-main trigger (not pull_request_target), permissions: contents: read, and defensive shell (handles the all-zeros first-push SHA, empty deltas, and a missing key). No critical/high issues: ${{ }} interpolation into run: is limited to commit SHAs + env.REPORTS_DIR (not injectable), and the data.items() results walk matches SCANOSS's output shape.

Findings below are reliability/hardening, most-severe first. The top one (flagged by all three reviewers) is the only thing I'd treat as merge-worthy — a failed scan currently reports as "clean." The rest are optional. Nothing here blocks the PR.