chore: add REUSE scaffold and correct the declared package license - #602
chore: add REUSE scaffold and correct the declared package license#602leonardocarreras wants to merge 4 commits into
Conversation
![github-actions[bot]](https://avatars.githubusercontent.com/in/15368?s=60&v=4){kind=small}
There was a problem hiding this comment.
DPsim LLM review
Claim vs. code: matches the description.
TL;DR: One real issue remains: the new REUSE workflow uses a moving fsfe/reuse-action tag instead of an immutable pin, which is a reproducibility and supply-chain risk; the other reports are duplicates of that same concern and the rest of the PR context does not surface additional findings.
Found 1 high (1 anchored to lines below).
🔴 Critical & high
- Pin reuse-action to a full commit SHA
[high · 85% confidence]in.github/workflows/reuse.yaml:29(details inline)
Claim vs. implementation
- Claimed: Add a REUSE scaffold and correct the package license declaration/badges to reflect mixed MPL-2.0 and Apache-2.0 licensing.
- Done: Adds REUSE metadata and license texts, a REUSE lint workflow and pre-commit hook, SPDX headers/annotations in config/docs, and changes pyproject/README to declare and describe MPL-2.0 AND Apache-2.0 with license files.
- Difference: none
How this review was produced
13 specialized finder passes raised 28 findings over the diff and the full changed sources. After de-duplication, 25 were re-checked against the current file and the base-class / interface headers it inherits (code as truth), escalating survivors to a stronger model: 21 refuted as unsupported, 4 kept (0 tentative).
Refuted by verification:
- Pin setuptools version to a minimum that supports PEP 639 SPDX license expression (pyproject.toml): The build-system requirement is already pinned as
setuptools>=77on line 8. - Pin setuptools version to a release that supports PEP 639 SPDX license expression (pyproject.toml): The dependency list explicitly requires
setuptools>=77, matching the comment. - Pin reuse-tool hook version to avoid breaking changes (.pre-commit-config.yaml): rev: "v6.2.0" is already pinned in the file; the finding’s claim that it is a floating tag is contradicted by the source.
- Pin reuse-tool hook version to avoid breakage (.pre-commit-config.yaml): The hook is pinned to the explicit tag string "v6.2.0" in the current file, so this repeats a non-issue rather than a defect.
- Pin reuse-action version to avoid unexpected changes (.github/workflows/reuse.yaml): The file does not use
v6.2.0; it usesfsfe/reuse-action@v6, so the finding’s premise is incorrect. - Pin reuse-tool hook version to avoid unexpected changes (.pre-commit-config.yaml): The file already pins the hook to v6.2.0; the complaint about not using a commit hash is a policy preference, not a code defect here.
- Clarify hook name in comment (.github/workflows/reuse.yaml): No comment about
lint-fileorlint:appears anywhere in this file. - Clarify hook name in comment (.pre-commit-config.yaml): The comment and hook id are both present and consistent: it says "lint-file, not lint" and the hook is reuse-lint-file.
- Improve comment clarity for license expression (pyproject.toml): The added comment already explains the MPL-2.0 plus Apache-2.0 wheel composition.
- Use SPDLOG_LOGGER_INFO for human-readable messages in CI logs (.github/workflows/reuse.yaml): There is no logger/print statement in the workflow; the only relevant line is a
uses:action invocation. - Clarify pre-commit hook usage for REUSE compliance (.pre-commit-config.yaml): The comment explicitly explains the split between pre-commit file-only linting and the full-tree REUSE workflow.
- Clarify reuse-lint-file purpose in comment (.pre-commit-config.yaml): The comment already gives the rationale that the file-only hook "stays fast" and avoids failing on unrelated files.
- Pin setuptools version requirement to avoid future breakage (pyproject.toml): This is a policy/maintainability suggestion, not a defect in the file; the requirement is intentionally pinned to
>=77. - Pin reuse-tool pre-commit hook to a specific version (.pre-commit-config.yaml): The rev is already pinned on the hook line; the surrounding comment does not need to repeat the version pin.
- Annotate Jupyter notebooks with correct copyright year range (REUSE.toml): The notebook annotation explicitly uses 2017-2026 at line 14, and the file contains no contrary standard-year requirement.
Automated, non-blocking review. May be wrong. Models: find mistral-small-4-119b-2603, gpt-oss-120b → verify gpt-5.4-mini → final gpt-5.5.
f138a0b to
a455bd6
Compare
There was a problem hiding this comment.
DPsim LLM review
Claim vs. code: matches the description.
TL;DR: One process-compliance issue was flagged: the commits appear to be missing required DCO sign-off trailers, which would block merge if confirmed; no code-level correctness findings were provided, and the rest of the change is about packaging/licensing metadata and REUSE scaffolding.
Found 1 high (0 anchored to lines below).
🔵 Optional / low-confidence (1)
- Missing Developer Certificate of Origin sign-off on commits
[high · 35% confidence · unconfirmed]inN/A
Claim vs. implementation
- Claimed: Add a REUSE scaffold and correct the package license declaration to MPL-2.0 AND Apache-2.0, with matching README and license files.
- Done: Adds REUSE metadata/scaffold, license texts, CI and pre-commit REUSE checks, updates README license wording/badge, and changes pyproject to declare MPL-2.0 AND Apache-2.0 with license-files and a newer setuptools minimum.
- Difference: none
How this review was produced
13 specialized finder passes raised 19 findings over the diff and the full changed sources. After de-duplication, 19 were re-checked against the current file and the base-class / interface headers it inherits (code as truth), escalating survivors to a stronger model: 18 refuted as unsupported, 1 kept (1 tentative).
Refuted by verification:
- Pin setuptools to a version that supports PEP 639 SPDX license expression (pyproject.toml): The file already pins setuptools to "setuptools>=77" on line 7; there is no missing patch pin issue in the current source.
- bump setuptools minimum version to at least 77 for PEP 639 SPDX license support (pyproject.toml): The requirement is already updated to setuptools>=77, so the claim that the bump is premature or absent is contradicted by the file.
- Pin setuptools minimum to a version that supports PEP 639 SPDX license expression (pyproject.toml): Line 7 explicitly requires "setuptools>=77", not 76, so the alleged allowance of setuptools 76 is false.
- Bump setuptools minimum version to 77 to support PEP 639 SPDX license expression (pyproject.toml): The requirement list itself was changed on line 7; it is not merely a comment update.
- bump setuptools minimum version to 77 for PEP 639 SPDX license support (pyproject.toml): The file already contains the asserted lower bound "setuptools>=77".
- Pin reuse-tool hook version to avoid drift (.pre-commit-config.yaml): The file intentionally pins fsfe/reuse-tool at rev "v6.2.0" and comments that the hook only checks touched files, so the claimed CI drift is not a defect in this file.
- Clarify comment about notebooks in REUSE.toml (REUSE.toml): The comment is present and the file is a new REUSE.toml; the notebook annotation is already explained by the surrounding comment and the claim is only stylistic.
- Use SPDLOG_LOGGER_* macros for simulation-time logging (.github/workflows/reuse.yaml): Line 25 is a GitHub Actions step using fsfe/reuse-action@v6, not simulation-time logging or std::cout/printf.
- bump setuptools requirement to >=77 for PEP 639 license support (pyproject.toml): The lower bound is already set to 77, so the complaint that it should have been bumped earlier is not a defect in this file.
- bump setuptools minimum to 77 to support PEP 639 license expression (pyproject.toml): The current source does not keep setuptools at >=42; it requires >=77.
- bump setuptools minimum to 77 to read PEP 639 license fields (pyproject.toml): The file does not allow setuptools 76; it explicitly requires 77 or newer.
- Add missing annotation for LICENSE file (REUSE.toml): This REUSE.toml is not missing a LICENSE annotation defect in the shown file; the finding points to an omission not evidenced by the current contents and no LICENSE path is referenced here.
- Annotate CMakeLists.txt files for SPDX compliance (REUSE.toml): Line 42 annotates XML files, not CMakeLists.txt, so the finding does not match the actual file content.
- setuptools version requirement insufficient for PEP 639 SPDX license expression (pyproject.toml): The build-system requirement is already "setuptools>=77", so the stated insufficiency of >=42 is not present in the current file.
- Use correct comment syntax for SPDX header in .editorconfig (.editorconfig): The file already uses '#' comment syntax for the SPDX header on lines 1-3, which is correct for .editorconfig.
Automated, non-blocking review. May be wrong. Models: find mistral-small-4-119b-2603, gpt-oss-120b → verify gpt-5.4-mini → final gpt-5.5.
a455bd6 to
33ab047
Compare
There was a problem hiding this comment.
DPsim LLM review
Claim vs. code: The diff also adds SPDX headers to root config/docs files and changes the README license wording to say every file states its own license, which goes beyond the stated metadata-only/license-doc refresh; otherwise none
TL;DR: One medium-risk packaging issue remains: the new reuse-tool pre-commit hook can fail in Python 3.9 environments even though the project still declares 3.9 support; the setuptools bump is a build-system change worth documenting but is not a code defect. No higher-severity correctness, scheduling, or equation issues were flagged.
Found 2 medium (1 anchored to lines below).
🟡 Suggestions
- reuse-tool pre-commit hook requires Python >=3.10 but project declares >=3.9
[medium · 78% confidence]in.pre-commit-config.yaml:57(details inline)
🔵 Optional / low-confidence (1)
- bump setuptools minimum to 77 to support PEP 639 license expression
[medium · 35% confidence · unconfirmed]inpyproject.toml:6
Claim vs. implementation
- Claimed: Add a REUSE scaffold, update package licensing metadata to MPL-2.0 AND Apache-2.0, and refresh README/license docs without changing file licenses.
- Done: Adds REUSE tooling/config (LICENSES texts, REUSE.toml, workflow, pre-commit hook), updates pyproject to setuptools>=77 with dual-license metadata and license-files, and edits README/badges plus SPDX headers in a few root config/docs files.
- Difference: The diff also adds SPDX headers to root config/docs files and changes the README license wording to say every file states its own license, which goes beyond the stated metadata-only/license-doc refresh; otherwise none
How this review was produced
13 specialized finder passes raised 23 findings over the diff and the full changed sources. After de-duplication, 22 were re-checked against the current file and the base-class / interface headers it inherits (code as truth), escalating survivors to a stronger model: 20 refuted as unsupported, 2 kept (1 tentative).
Refuted by verification:
- reuse lint job should run on pull_request_target to avoid fork safety issues (.github/workflows/reuse.yaml): The workflow already triggers on pull_request, and the file is a new workflow with no evidence it needs pull_request_target or repository secrets.
- pre-commit exclude pattern for LICENSES/ should match directory separator (.pre-commit-config.yaml): The exclude already uses
^LICENSES/on line 14, and the file comment explicitly documents thatLICENSES/is intentional. - bump setuptools requirement to version supporting PEP 639 SPDX license expression (pyproject.toml): the comment explicitly says setuptools 77 is the first release that reads PEP 639 license/license-files
- Update setuptools requirement comment to match new version (pyproject.toml): the comment and requirement are consistent: it says 77 is the first release and requires setuptools>=77
- Fix license badge URL to point to LICENSES directory (README.md): The badge target is already the LICENSES/ directory and the markdown link syntax is valid as written.
- Clarify license mix in README (README.md): The README already states the mixed licensing and explicitly says every file states its own license and the license texts are in LICENSES/.
- Annotate Jupyter notebooks with MPL-2.0, not Apache-2.0 (REUSE.toml): The file explicitly sets SPDX-License-Identifier = "MPL-2.0" for **/*.ipynb on lines 9-12.
- Annotate PNG images with MPL-2.0, not Apache-2.0 (REUSE.toml): The PNG annotation explicitly uses SPDX-License-Identifier = "MPL-2.0" on lines 14-17.
- Annotate JPG images with MPL-2.0, not Apache-2.0 (REUSE.toml): The JPG annotation explicitly uses SPDX-License-Identifier = "MPL-2.0" on lines 19-22.
- Annotate SVG files with MPL-2.0, not Apache-2.0 (REUSE.toml): The SVG annotation explicitly uses SPDX-License-Identifier = "MPL-2.0" on lines 24-28.
- Annotate JSON files with MPL-2.0, not Apache-2.0 (REUSE.toml): The JSON annotation explicitly uses SPDX-License-Identifier = "MPL-2.0" on lines 30-34.
- Add SPDX header to REUSE.toml (REUSE.toml): This new TOML file has no comment-based SPDX header by design; it is the REUSE.toml metadata file itself, not a source/script/workflow file.
- Pin setuptools version to a release that supports PEP 639 SPDX license expression (pyproject.toml): line 5 documents the rationale for setuptools>=77 as the first release reading PEP 639 license/license-files
- bump setuptools minimum to 77 to read PEP 639 license expression (pyproject.toml): line 5 explicitly states 77 is the first release for PEP 639 license/license-files, contradicting the claimed lack of documentation/minimum rationale
- license expression should match declared license-files (pyproject.toml): line 17 explains Apache-2.0 sources compile in, supporting the dual MPL-2.0 AND Apache-2.0 expression with listed license files
Automated, non-blocking review. May be wrong. Models: find mistral-small-4-119b-2603, gpt-oss-120b → verify gpt-5.4-mini → final gpt-5.5.
33ab047 to
6e0b8a2
Compare
There was a problem hiding this comment.
DPsim LLM review
Claim vs. code: matches the description.
TL;DR: One medium issue remains: the new REUSE workflow uses a floating action tag instead of an immutable pin, which can make CI behavior change unexpectedly; the rest of the reported items are the same reproducibility concern. No other correctness, scheduling, or equation issues were flagged.
Found 1 medium (1 anchored to lines below).
🟡 Suggestions
- reuse-action version should be pinned to a commit hash
[medium · 86% confidence]in.github/workflows/reuse.yaml:26(details inline)
Claim vs. implementation
- Claimed: Add a REUSE scaffold and correct the package license declaration/badge to MPL-2.0 AND Apache-2.0 without relicensing files.
- Done: Adds REUSE metadata and license texts, a REUSE lint workflow and pre-commit hook, updates README/license wording, and changes pyproject to declare MPL-2.0 AND Apache-2.0 with license-files and a newer setuptools minimum.
- Difference: none
How this review was produced
13 specialized finder passes raised 17 findings over the diff and the full changed sources. After de-duplication, 16 were re-checked against the current file and the base-class / interface headers it inherits (code as truth), escalating survivors to a stronger model: 14 refuted as unsupported, 2 kept (0 tentative).
Refuted by verification:
- Pin setuptools to a version that supports PEP 639 SPDX license expression (pyproject.toml): The file already sets requires = ["setuptools>=77", ...], so it does not still read setuptools>=42.
- bump setuptools minimum version to 77 to support PEP 639 SPDX license expression (pyproject.toml): The comment and requirement already mention setuptools 77 and PEP 639 license/license-files, matching the change.
- bump setuptools minimum version to 77 (pyproject.toml): The comment explicitly states setuptools 77 is the first release that reads PEP 639 license/license-files, which is the justification.
- reuse-tool pre-commit hook should be pinned to a commit hash (.pre-commit-config.yaml): The hook is already pinned to the exact tag "v6.2.0" in the file, not a floating branch or moving ref.
- add missing comment explaining setuptools version requirement (pyproject.toml): The comment on line 5 already explains the setuptools>=77 requirement and references PEP 639 license/license-files.
- bump setuptools minimum version to 77 to read PEP 639 license expression (pyproject.toml): The build-system requirement is already bumped to setuptools>=77 in the current file.
- Pin reuse-tool hook to a full version tag for reproducibility (.pre-commit-config.yaml): The config already uses a full version tag for reuse-tool at rev: "v6.2.0".
- Annotate Jupyter notebooks with correct license identifier (REUSE.toml): The notebook annotation explicitly sets SPDX-License-Identifier = "MPL-2.0" on line 12, matching the finding's stated value.
- Annotate PNG images with correct license identifier (REUSE.toml): The PNG annotation explicitly sets SPDX-License-Identifier = "MPL-2.0" on line 17, so there is no mismatch in the file.
- Annotate JPG images with correct license identifier (REUSE.toml): The JPG annotation explicitly sets SPDX-License-Identifier = "MPL-2.0" on line 22, contradicting the claim of an incorrect annotation.
- Annotate SVG files with correct license identifier (REUSE.toml): The SVG annotation explicitly sets SPDX-License-Identifier = "MPL-2.0" on line 28, so the file does not show the alleged issue.
- setuptools version requirement must be >=77 for PEP 639 license expression (pyproject.toml): The current pyproject.toml no longer has setuptools>=42; it already requires setuptools>=77.
- Add SPDX header to new TOML file (REUSE.toml): This new TOML file has no SPDX header requirement because REUSE.toml is the configuration file itself, and the file content begins with package metadata rather than a comment header.
- Verify Apache-2.0 license text completeness (LICENSES/Apache-2.0.txt): the file contains the Apache License 2.0 text through sections 1-9 and the appendix, ending with the standard limitations clause
Automated, non-blocking review. May be wrong. Models: find mistral-small-4-119b-2603, gpt-oss-120b → verify gpt-5.4-mini → final gpt-5.5.
| uses: actions/checkout@v6 | ||
|
|
||
| - name: Run reuse lint | ||
| uses: fsfe/reuse-action@v6 |
There was a problem hiding this comment.
reuse-action version should be pinned to a commit hash
severity: medium · confidence: 86%
The workflow pins the checkout action to v6 but uses the floating tag 'v6' for the reuse-action. Floating tags can move and introduce non-reproducible builds. The REUSE tool version should be pinned to a commit hash to ensure reproducibility.
Suggested fix: Pin the reuse-action to a specific commit hash, e.g., 'uses: fsfe/reuse-action@629a7a5'.
| uses: fsfe/reuse-action@v6 | |
| uses: fsfe/reuse-action@629a7a54a8374d27585a39f11f75a68a7330525f |
Checked against the source: line 26 uses fsfe/reuse-action@v6, a tag rather than an immutable commit hash
stage: cpp-design
There was a problem hiding this comment.
DPsim LLM review
Claim vs. code: The diff also changes the PyPI workflow to drop Python 3.9, and it adds SPDX headers to some files rather than only adjusting declared/package metadata and README.
No issues surfaced by the automated passes.
Claim vs. implementation
- Claimed: Add a REUSE scaffold and update the package’s declared license to MPL-2.0 AND Apache-2.0, with matching README and packaging metadata.
- Done: Adds REUSE files/workflow/pre-commit hook, license texts, SPDX headers in a few root files, updates README license wording/badge, and changes pyproject metadata to MPL-2.0 AND Apache-2.0 with license-files plus newer setuptools and Python 3.10+.
- Difference: The diff also changes the PyPI workflow to drop Python 3.9, and it adds SPDX headers to some files rather than only adjusting declared/package metadata and README.
How this review was produced
13 specialized finder passes raised 13 findings over the diff and the full changed sources. After de-duplication, 13 were re-checked against the current file and the base-class / interface headers it inherits (code as truth), escalating survivors to a stronger model: 13 refuted as unsupported, 0 kept (0 tentative).
Refuted by verification:
- Pin setuptools version to a release that supports PEP 639 SPDX license expression (pyproject.toml): The file does not pin setuptools to a single version; it uses a lower bound "setuptools>=77".
- Remove unsupported Python version from CI matrix (.github/workflows/publish_to_pypi.yaml): The matrix at line 50 already lists only cp310, cp311, cp312, cp313; cp39 is absent.
- Add rationale for REUSE tool pinning (.pre-commit-config.yaml): The file already has an explanatory comment for this repo block: "Needs pre-commit itself on Python 3.10 or newer."
- Bump setuptools lower bound to a version that supports PEP 639 SPDX license expression (pyproject.toml): A comment on line 5 explains why 77 is required for PEP 639 license/license-files support.
- Remove unsupported Python version from wheel build matrix (.github/workflows/publish_to_pypi.yaml): The wheel-build matrix no longer includes cp39 on line 50.
- remove stray Python version cp39 from matrix (.github/workflows/publish_to_pypi.yaml): Line 50 shows cp39 removed from matrix.python, so the claimed stray version is not present.
- Pin setuptools minimum version to 77 to support PEP 639 license expression (pyproject.toml): The claimed manylinux mismatch is not present in the current file because requires-python was raised to ">=3.10" and the build matrix line is unchanged in this diff scope.
- Pin setuptools version to avoid future breakage of PEP 639 parsing (pyproject.toml): The file intentionally leaves setuptools unbounded above by using a minimum version only, which is a normal packaging pattern.
- CIBW build matrix includes unsupported Python versions (pyproject.toml): The project now requires Python ">=3.10" on line 23, so cp39 is not an unsupported version for this file's current configuration.
- Add missing REUSE annotation for LICENSES directory (REUSE.toml): REUSE.toml already contains explicit annotations blocks for the listed non-commentable file types, and no LICENSES-directory omission is present in the file.
- cibuildwheel build matrix includes unsupported Python version (pyproject.toml): The file still lists cp39 in the cibuildwheel build expression, but the project's minimum Python version is now 3.10, so the mismatch claim is not supported by the current source.
- Missing SPDX header in REUSE.toml (REUSE.toml): This new REUSE.toml is a configuration file, not a source file requiring an SPDX comment header; it already includes package-level SPDX fields at the top.
- Pin setuptools version to one that supports PEP 639 SPDX license expression (pyproject.toml): the file uses PEP 639 license/license-files at lines 18-19 and documents setuptools 77 as the first release that reads them, so >=77 is not an over-broad pin to replace with 76
Automated, non-blocking review. May be wrong. Models: find mistral-small-4-119b-2603, gpt-oss-120b → verify gpt-5.4-mini → final gpt-5.5.
6e0b8a2 to
7fadee6
Compare
There was a problem hiding this comment.
DPsim LLM review
Claim vs. code: The diff also changes the PyPI workflow to drop cp39 from the build matrix, which the PR description does not mention.
TL;DR: One medium-confidence CI hygiene issue remains around the REUSE workflow pinning, while the other notes are low-confidence documentation/build-environment concerns; the license/REUSE changes themselves did not surface a correctness or stamping problem in these passes.
Found 2 medium, 1 low (1 anchored to lines below).
🟡 Suggestions
- Pin reuse-tool action version to a full release tag
[medium · 80% confidence]in.github/workflows/reuse.yaml:26(details inline)
🔵 Optional / low-confidence (2)
- Require Python 3.10 or newer; document rationale for dropping older versions
[medium · 30% confidence · unconfirmed]inpyproject.toml:23 - reuse-tool added as dev dependency without explicit CI installation step
[low · 35% confidence · unconfirmed]in.pre-commit-config.yaml:58
Claim vs. implementation
- Claimed: Add a REUSE scaffold, update packaging to declare the wheel as MPL-2.0 AND Apache-2.0 with license files, refresh README/license wording, and require newer setuptools/Python.
- Done: Adds REUSE metadata/files and CI/pre-commit checks, changes pyproject to setuptools>=77, license expression and license-files, and bumps required Python to 3.10 while updating README and some file headers.
- Difference: The diff also changes the PyPI workflow to drop cp39 from the build matrix, which the PR description does not mention.
How this review was produced
13 specialized finder passes raised 15 findings over the diff and the full changed sources. After de-duplication, 15 were re-checked against the current file and the base-class / interface headers it inherits (code as truth), escalating survivors to a stronger model: 12 refuted as unsupported, 3 kept (2 tentative).
Refuted by verification:
- Use DOUBLE_EPSILON or exposed constants for tolerances, not ad-hoc literals (pyproject.toml): The finding is explicitly not applicable to this file’s changed lines and the file contains no tolerance code.
- Bump setuptools requirement to >=77 for PEP 639 license fields (pyproject.toml): Line 6 is a build-time setuptools requirement and the comment already explains it is for reading PEP 639 license/license-files.
- Remove unsupported Python version cp39 from wheel build matrix (.github/workflows/publish_to_pypi.yaml): The workflow matrix at line 50 already excludes cp39 and lists only cp310-cp313.
- Remove Python 3.9 from PyPI build matrix (.github/workflows/publish_to_pypi.yaml): There is no stale comment on line 49; it is the matrix key
python, and the version list on line 50 matches the new set. - Clarify comment about setuptools version requirement (pyproject.toml): The comment on line 5 matches the requirement on line 6 and is not ambiguous in the file context.
- Pin setuptools version to avoid future breakage of PEP 639 license fields (pyproject.toml): The file intentionally uses a lower-bounded build requirement; pinning an upper bound is a policy suggestion, not a defect.
- Update setuptools requirement comment to match new minimum version (pyproject.toml): There is no 'setuptools 76' comment in the file; the actual comment says 77 and matches the requirement.
- Update cibuildwheel build string to match new Python requirement (pyproject.toml): Line 73 is outside the changed lines scope, and the file still builds cp39 wheels intentionally.
- Add missing REUSE annotation for LICENSES directory (REUSE.toml): REUSE.toml already contains annotations for the listed non-commentable file types, and the file itself is the REUSE config, not a LICENSES directory entry.
- Remove unsupported Python version cp39 from wheel builds (.github/workflows/publish_to_pypi.yaml): The current source shows cp39 removed from the wheel build matrix, so the claimed cp39 build failure cannot occur here.
- cibuildwheel build list includes unsupported Python version (pyproject.toml): The file’s cibuildwheel build list still includes cp39 by design, so this is not a defect in the changed lines.
- Missing SPDX header in REUSE.toml (REUSE.toml): This TOML config file is not a source/script/workflow file requiring an SPDX comment header; REUSE metadata is expressed here as TOML keys instead.
Automated, non-blocking review. May be wrong. Models: find mistral-small-4-119b-2603, gpt-oss-120b → verify gpt-5.4-mini → final gpt-5.5.
| uses: actions/checkout@v6 | ||
|
|
||
| - name: Run reuse lint | ||
| uses: fsfe/reuse-action@v6 |
There was a problem hiding this comment.
Pin reuse-tool action version to a full release tag
severity: medium · confidence: 80%
The workflow uses the latest tag for the fsfe/reuse-action (v6). While the action is stable, pinning to a full release tag (e.g., v6.2.0) is a best practice to avoid unexpected breaking changes from a floating tag.
Suggested fix: Pin the reuse-tool action to the same version used in .pre-commit-config.yaml (v6.2.0) to ensure consistency across CI and pre-commit.
| uses: fsfe/reuse-action@v6 | |
| - name: Run reuse lint | |
| uses: fsfe/reuse-action@v6.2.0 |
Checked against the source: the workflow uses fsfe/reuse-action@v6 rather than a full release tag
stage: tests-docs-coverage
Signed-off-by: Leonardo Carreras <leonardo.carreras@eonerc.rwth-aachen.de>
Signed-off-by: Leonardo Carreras <leonardo.carreras@eonerc.rwth-aachen.de>
Signed-off-by: Leonardo Carreras <leonardo.carreras@eonerc.rwth-aachen.de>
Signed-off-by: Leonardo Carreras <leonardo.carreras@eonerc.rwth-aachen.de>
7fadee6 to
70ce3b6
Compare
There was a problem hiding this comment.
DPsim LLM review
Claim vs. code: matches the description.
Found 3 medium (1 anchored to lines below).
🟡 Suggestions
- Missing SPDX header in REUSE configuration file
[medium · 96% confidence]inREUSE.toml:1(details inline)
🔵 Optional / low-confidence (2)
- Add missing SPDX annotation for LICENSE file
[medium · 35% confidence · unconfirmed]inREUSE.toml:9 - requires-python set to >=3.10 without documenting rationale
[medium · 30% confidence · unconfirmed]inpyproject.toml:23
Claim vs. implementation
- Claimed: Add a REUSE scaffold, update package metadata to declare MPL-2.0 AND Apache-2.0 with license files, refresh README licensing, and raise build/runtime requirements to setuptools 77 and Python 3.10.
- Done: Adds REUSE tooling/files and SPDX headers for touched root files, changes pyproject to MPL-2.0 AND Apache-2.0 with license-files, updates README license text/badge, bumps setuptools to 77, requires Python 3.10, and drops cp39 from the PyPI workflow.
- Difference: none
How this review was produced
13 specialized finder passes raised 18 findings over the diff and the full changed sources. After de-duplication, 17 were re-checked against the current file and the base-class / interface headers it inherits (code as truth), escalating survivors to a stronger model: 14 refuted as unsupported, 3 kept (2 tentative).
Refuted by verification:
- Pin setuptools version to avoid future breakage of PEP 639 license fields (pyproject.toml): build-system.requires already specifies setuptools>=77, not setuptools>=42
- Wheel matrix excludes cp39 unnecessarily (.github/workflows/publish_to_pypi.yaml): the matrix intentionally excludes cp39 and matches the >=3.10 Python floor; lack of an extra comment is not a demonstrated defect
- Pin setuptools version to avoid future breakage of PEP 639 parsing (pyproject.toml): the file documents the >=77 minimum on line 5 and uses setuptools>=77 on line 6 rather than an accidental old bound
- requires-python should match CI and pre-commit constraints (pyproject.toml): requires-python is explicitly declared as >=3.10 on line 23
- Wheel matrix should match requires-python (.github/workflows/publish_to_pypi.yaml): the workflow matrix starts at cp310, which matches requires-python >=3.10 rather than conflicting with it
- Remove unsupported Python version from wheel matrix (.github/workflows/publish_to_pypi.yaml): the matrix lists cp310, cp311, cp312, and cp313 only; cp39 is absent
- Incorrect comment about setuptools version requirement (pyproject.toml): the comment and requirement consistently use setuptools 77 as the PEP 639 support floor
- Clarify license badge to reflect dual-license status (README.md): the README badge already says License: MPL 2.0 AND Apache 2.0
- Update requires-python to >=3.10 to match REUSE and pre-commit constraints (pyproject.toml): the project declares requires-python = ">=3.10", not >=3.9
- Remove cp39 from wheel matrix to match requires-python >=3.10 (.github/workflows/publish_to_pypi.yaml): the wheel build matrix does not include cp39
- set setuptools lower bound to 77 explicitly in build-system.requires (pyproject.toml): the requirement string has been updated to setuptools>=77
- Add missing SPDX annotation for LICENSES/ directory (REUSE.toml): REUSE annotations apply to current files lacking comment headers, not to pre-annotating a directory for hypothetical future additions
- Incorrect workflow trigger branch (.github/workflows/publish_to_pypi.yaml): the master branch trigger is pre-existing and outside the changed lines for this PR
- Incorrect workflow trigger branch (.github/workflows/reuse.yaml): line 11 is a standard pull_request trigger for a REUSE lint workflow, with no evidence in the file of privileged or unintended execution
Automated, non-blocking review. May be wrong. Models: find mistral-small-4-119b-2603, gpt-oss-120b → verify gpt-5.4-mini → final gpt-5.5.
| @@ -0,0 +1,34 @@ | |||
| version = 1 | |||
There was a problem hiding this comment.
Missing SPDX header in REUSE configuration file
severity: medium · confidence: 96%
The new REUSE.toml file lacks the required SPDX license header. All new source, script, and workflow files must include an SPDX-FileCopyrightText and SPDX-License-Identifier line using the file's comment syntax (# for TOML). Absence of the header will cause the REUSE pre‑commit hook and CI lint to fail, breaking the process gate for license compliance.
Suggested fix: Add a SPDX header at the top of REUSE.toml using TOML comment syntax. Use the same copyright range as other root files and the MPL‑2.0 identifier, which matches the project's primary license.
| version = 1 | |
| # SPDX-FileCopyrightText: 2022-2026 Institute for Automation of Complex Power Systems, EONERC, RWTH Aachen University | |
| # SPDX-License-Identifier: MPL-2.0 | |
| version = 1 | |
| SPDX-PackageName = "DPsim" | |
| SPDX-PackageSupplier = "The DPsim Authors <post_acs@eonerc.rwth-aachen.de>" | |
| SPDX-PackageDownloadLocation = "https://github.com/sogno-platform/dpsim" | |
| # Only for files that cannot carry a comment header. Everything else uses its own SPDX header. | |
| # A header cell would be executed and shown, and nbconvert rewrites the file anyway. | |
| [[annotations]] | |
| path = "**/*.ipynb" | |
| SPDX-FileCopyrightText = "2017-2026 Institute for Automation of Complex Power Systems, EONERC, RWTH Aachen University" | |
| SPDX-License-Identifier = "MPL-2.0" | |
| [[annotations]] | |
| path = "**/*.png" | |
| SPDX-FileCopyrightText = "2016-2026 Institute for Automation of Complex Power Systems, EONERC, RWTH Aachen University" | |
| SPDX-License-Identifier = "MPL-2.0" | |
| [[annotations]] | |
| path = "**/*.jpg" | |
| SPDX-FileCopyrightText = "2022-2026 Institute for Automation of Complex Power Systems, EONERC, RWTH Aachen University" | |
| SPDX-License-Identifier = "MPL-2.0" | |
| # Exported from drawio / doxygen, so a comment would not survive the next export. | |
| [[annotations]] | |
| path = "**/*.svg" | |
| SPDX-FileCopyrightText = "2017-2026 Institute for Automation of Complex Power Systems, EONERC, RWTH Aachen University" | |
| SPDX-License-Identifier = "MPL-2.0" | |
| # JSON has no comment syntax. | |
| [[annotations]] | |
| path = "**/*.json" | |
| SPDX-FileCopyrightText = "2021-2026 Institute for Automation of Complex Power Systems, EONERC, RWTH Aachen University" | |
| SPDX-License-Identifier = "MPL-2.0" |
Checked against the source: the new REUSE.toml starts with version = 1 and lacks SPDX-FileCopyrightText and SPDX-License-Identifier comments
stage: process-compliance
|
Codecov Report✅ All modified and coverable lines are covered by tests. Additional details and impacted files@@ Coverage Diff @@
## master #602 +/- ##
==========================================
- Coverage 72.87% 72.54% -0.34%
==========================================
Files 497 497
Lines 32295 32295
Branches 17461 17461
==========================================
- Hits 23534 23427 -107
- Misses 8707 8782 +75
- Partials 54 86 +32 ☔ View full report in Codecov by Harness. 🚀 New features to boost your workflow:
|
1 participant
pyproject.tomldeclareslicense = "MPL-2.0", but 38 files are Apache-2.0 and some of them compile into the wheel (Simulation.cpp, the VILLAS interface layer). Changes it toMPL-2.0 AND Apache-2.0withlicense-files, and fixes the README badge and license section to match. No file's license is touched and the rootLICENSEstays, so GitHub still detects MPL-2.0.Please tell me if you agree or disagree, I will keep this open longer but this is a fact that we did not see before (and is the current status). Other option would be to ask the authors to relicense.
I also see that some of the flipping to Apache licensing was done by mistake, the file was before not Apache but MPL. 24 of the 38 carried
Copyright 2017-2021/2022 Institute for Automation of Complex Power Systems, EONERC, RWTH Aachen Universityand the MPL-2.0 boilerplate, and lost both in two commits that do not mention relicensing: 784afa5 "use spdx license identifiers" (20 files, wrote 21 Apache-2.0 identifiers and not a single MPL-2.0 one) and 3b73b0b "add comments for a plan of action" (4 files, includingSimulation.cpp). The other 14 are Apache-2.0 from the start, so the wheel is mixed-license either way. I would track that in a separate issue rather than here if that is what we should do.In general, the other changes:
setuptools>=42to>=77, since 77 is the first release that reads the PEP 639 SPDXlicenseexpression andlicense-files, and 76 already rejects the string that is on main todayrequires-pythonto>=3.10and dropscp39from the wheel matrix. 3.9 is end of life since October 2025, and the pre-commit hook needs 3.10 anywayLICENSES/MPL-2.0.txtandLICENSES/Apache-2.0.txtfromreuse downloadREUSE.tomlwith glob annotations for the files that cannot carry a comment (notebooks, images, JSON).reuse lintworkflow, and thefsfe/reuse-toolpre-commit hook. The hook runsreuse-lint-file, so it only judges the files a commit touches. It needs Python 3.10 or newer.reuse lintand pre-commit stay red until then.