Perform SPDX license and copyright checks with reuse

[lurtz]

reuse is specialized to check for SPDX license and copyright information in source files. It is capable of checking way more file types than we currently check with opengrep and faster.

However it only checks for SPDX information and not the full mandatory copyright header. Therefore opengrep will still be used to check that, but SPDX information will be checked with reuse. If only SPDX information is needed we can trim the header and remove opengrep.

[lurtz]

For the reviewer: reuse is added here

[AlexanderLanin]

Can you add it to some readme somewhere on how to use the tool (without precommit)? Where is the config?

[lurtz]

at the moment there is no config. I will try your template proposal

[lurtz]

Is this enough?

https://github.com/elektrobit-contrib/eclipse-score_devcontainer/blob/90d00f48718d96ef8a515c33d1b9a0e03b50e3af/README.md?plain=1#L119-L125

[AlexanderLanin]

We need to figure out where this header came from and if this change is ok

[AlexanderLanin]

Can you add it to some readme somewhere on how to use the tool (without precommit)? Where is the config?

[AlexanderLanin]

However it only checks for SPDX information and not the full mandatory copyright

Sure? https://reuse.readthedocs.io/en/stable/man/reuse-annotate.html#templates

[lurtz]

However it only checks for SPDX information and not the full mandatory copyright

Sure? https://reuse.readthedocs.io/en/stable/man/reuse-annotate.html#templates

I removed the opengrep solution now, but reuse still does not enforce the full header and only checks for SPDX lines. It fails when these are missing.

For example this CODEOWNERS file would be compliant, when running reuse lint:

# SPDX-FileCopyrightText: 2026 Contributors to the Eclipse Foundation
# SPDX-License-Identifier: Apache-2.0

* @opajonk @lurtz

However whenever reuse annotate is run via scripts/run_reuse_annotate.sh, reuse will apply the template and add the full header.

[lurtz]

note the rename. Maybe we still need to keep a copy at LICENSE

[AlexanderLanin]

should pre-commit not run ./scripts/run_reuse_annotate.sh directly?

[lurtz]

I would love to, but I did not find a way to achieve that. I might need to write a custom rule to do that