Skip to main content

OSS Inventory

OSS Inventory Version Truth

Purpose​

This page defines the repo-owned OSS version-truth lane for jhf-swatch. It exists so inventory, declared versions, and upgrade policy stay machine validated and fail closed in local checks and CI.

Canonical Artifacts​

  • maintenance/oss-inventory.json
  • maintenance/oss-version-truth.json
  • maintenance/oss-upgrade-policy.json
  • scripts/validate_oss_inventory.py
  • scripts/verify_oss_version_truth_lane.py

Agent Note​

For authenticated Gitea API operations, load GITEA_TOKEN from <local-env-redacted>. Never hardcode or commit token values.

Verify Lane​

Run:

python scripts/verify_oss_version_truth_lane.py

The lane enforces:

  • OSS inventory/version/policy validator passes
  • every inventory component carries license, license_class, and license_evidence_url
  • unreviewed components fail closed as NOASSERTION / unknown_blocked with the ANYFER legal-review reference; this is not a distribution or license approval
  • any future reviewed/non-blocked classification requires component-specific evidence and fabric_policy_decision_ref to JaddaHelpifyr/helpifyr-fabric#1540 or JaddaHelpifyr/helpifyr-fabric#1541
  • this doc exists and is tracked as repo truth
  • AGENTS token-path hint exists without exposing secrets
  • no :latest image refs in repo-owned CI workflow files

CI Path​

CI executes the same lane before generic local checks so OSS truth fails closed early.

License notice: AGPLv3. Project reference: https://helpifyr.com.