docs: claim the runner license and record the bundled asset #14

Merged

day01 merged %!d() commits from %!s() into %!s()

2026-08-03 13:21:55 +00:00

day01 commented

2026-08-03 13:17:33 +00:00

Owner

The license file still carried Copyright (c) 2022 The Gitea Authors, inherited
from the upstream runner. No Go source survived the Rust rewrite — the tree is
275 Rust files and zero .go files.

What genuinely remains from Gitea is the vendored protocol definition in
crates/runner-control-gitea/proto/, which already keeps its own LICENSE and
a pinned UPSTREAM next to it. That stays untouched; it is the attribution that
actually has to be there. The root file now names the SynCode authors and
carries the portions notices.

hash-files.js had no provenance recorded at all — 5103 lines of bundled
JavaScript with no UPSTREAM, no license header and no source in the tree. Its
module set (internal-pattern, patternHelper, minimatch) and the
__nccwpck_require__ signature identify it as an ncc bundle of the Actions glob
toolkit, MIT. It now has an UPSTREAM file like the proto directory does.

One gap I could not close from the artifact itself: the bundle carries no
revision, so UPSTREAM names the package and license but pins no commit. If you
know whether it was lifted from nektos/act or built from actions/toolkit
directly, say which and I will pin it.

I am not a lawyer. MIT to MIT with attribution kept where the code actually
remains is standard practice, but if the runner is going commercial this is
worth a review by someone who is.

The license file still carried `Copyright (c) 2022 The Gitea Authors`, inherited from the upstream runner. No Go source survived the Rust rewrite — the tree is 275 Rust files and zero `.go` files. What genuinely remains from Gitea is the vendored protocol definition in `crates/runner-control-gitea/proto/`, which already keeps its own `LICENSE` and a pinned `UPSTREAM` next to it. That stays untouched; it is the attribution that actually has to be there. The root file now names the SynCode authors and carries the portions notices. `hash-files.js` had no provenance recorded at all — 5103 lines of bundled JavaScript with no `UPSTREAM`, no license header and no source in the tree. Its module set (`internal-pattern`, `patternHelper`, `minimatch`) and the `__nccwpck_require__` signature identify it as an ncc bundle of the Actions glob toolkit, MIT. It now has an `UPSTREAM` file like the proto directory does. One gap I could not close from the artifact itself: the bundle carries no revision, so `UPSTREAM` names the package and license but pins no commit. If you know whether it was lifted from nektos/act or built from actions/toolkit directly, say which and I will pin it. I am not a lawyer. MIT to MIT with attribution kept where the code actually remains is standard practice, but if the runner is going commercial this is worth a review by someone who is.

day01 added 1 commit 2026-08-03 13:17:34 +00:00

docs: claim the runner license and record the bundled asset

		The license file still carried the upstream runner's copyright, although no
Go source survived the Rust rewrite. What remains from Gitea is the vendored
protocol definition, which keeps its own license and pin next to it.

hash-files.js had no recorded provenance. It is an ncc bundle of the Actions
glob toolkit, identified by its module set and bundler signature.