name: check-code-attribution

description: Per-file check of vendored code attribution — headers, THIRD_PARTY_NOTICES.md entries, and license compatibility

allowed-tools: Bash Read Grep Glob

You are reviewing changed files for third-party code attribution compliance in **sentry-java**, an MIT-licensed repository.

When running locally (not via Warden), determine which files changed on this branch:

MB=$(git merge-base HEAD origin/main 2>/dev/null || git merge-base HEAD main)

git diff --name-only "${MB}"..HEAD

Then run the Quick triage and subsequent checks on **every** file in that list. Warden's `ignorePaths` in `warden.toml` lists the paths to skip — apply the same exclusions locally.

Warden does **not** use Cursor auth. Before running Warden locally, configure a provider (same model family as `warden.toml`, or override with `-m`):

export WARDEN_ANTHROPIC_API_KEY=sk-ant-... # or: export ANTHROPIC_API_KEY=sk-ant-...

npx pi # then run /login and pick Anthropic (or another provider)

export WARDEN_OPENAI_API_KEY=sk-...

npx @sentry/warden origin/main..HEAD --skill check-code-attribution -m openai/gpt-5.5 -vv

npx @sentry/warden origin/main..HEAD --skill check-code-attribution -vv

If you only need attribution review in the IDE, `/check-code-attribution` in Cursor does not require Warden credentials.

When running via Warden, the changed file is already provided — skip branch-wide discovery, but follow **Warden execution** below.

Warden analyzes one changed file per run (whole-file mode). Complete every Quick triage step — the diff alone is not sufficient.

**Mandatory on every run (do not skip):**

1. `Read` the first 20 lines of the changed file.

2. `Grep` `THIRD_PARTY_NOTICES.md` for the class name (filename without extension, e.g. `ANRWatchDog` for `ANRWatchDog.java`).

3. When Bash is available, compare the merge-base header:

```bash

MB=$(git merge-base HEAD origin/main 2>/dev/null || git merge-base HEAD main)

git show "${MB}:<file-path>" | head -50

```

**Do not dismiss findings because:**

- A `THIRD_PARTY_NOTICES.md` entry exists — file headers are still required; NOTICES does not replace them.

- The diff only removes a header comment block — removed `-` lines with `Copyright`, `Licensed under`, license disclaimers, or vendoring language ("adapted from", etc.) mean attribution was stripped.

- The header says "Adapted from …" but omits copyright holder or license name — flag missing header fields.

For `THIRD_PARTY_NOTICES.md` runs: for every **removed** entry in the diff, use `Read` or `Glob` to confirm whether Scope files still exist with attribution headers. If they do, the entry must not be removed.

Sentry's own files carry **no** copyright headers — any copyright/license line indicates third-party code. Every file that reaches this skill is in scope — do not skip files based on extension.

If this file is `THIRD_PARTY_NOTICES.md`, go to the THIRD_PARTY_NOTICES section below.

For all other files, perform these checks **before** deciding whether to proceed:

1. **Read the file header** — use the Read tool to read the first 20 lines of the file. Look for vendored-code signals: `Copyright`, `Licensed under`, `SPDX-License-Identifier`, or vendoring language ("adapted from", "backported from", "based on", "copied from", "derived from", "inspired by", "ported from", "translated from", "vendored").

2. **Check THIRD_PARTY_NOTICES.md** — use Grep to search `THIRD_PARTY_NOTICES.md` for the file name without extension (e.g., search for `ANRWatchDog` when reviewing `ANRWatchDog.java`). A match means this is a known vendored file.

3. **Scan the diff** — check for vendored-code signals on both added (`+`) and **removed (`-`)** lines. Removed copyright/license lines ARE signals — they mean attribution is being stripped.

**A signal in ANY of these three sources means this is vendored code — proceed to the vendored source file section.**

A file referenced in THIRD_PARTY_NOTICES.md is ALWAYS vendored, even if its current header has no attribution.

**If none of the three sources have signals, report no findings and stop.**

Validate the changed entries using the diff context:

1. For each added or modified entry, verify it has all required fields: **Source URL**, **License name**, **Copyright**, **Scope** (file paths), and **full license text** in a fenced code block.

2. For each Scope path, verify the file(s) exist (use Glob or Read).

3. Flag new license types — especially copyleft or AGPL.

4. Flag orphaned entries whose Scope files no longer exist.

5. For **removed** entries (lines prefixed with `-` in the diff), use Read to check whether the Scope files still exist and still have attribution headers. If they do, the entry must not be removed.

6. Check **copyright consistency** — the Copyright field must match the copyright line inside the embedded license text. Flag mismatches.

The file must have a license header near the top (before the `package` statement in Java/Kotlin files) with:

- Library name or origin

- Copyright year and holder

- License name

- Source URL

Exact wording and comment style may vary. Only flag **missing fields**, not formatting.

Compare the current header (from the Read in Quick triage) against the THIRD_PARTY_NOTICES.md entry. For example, if the NOTICES entry says this file is MIT-licensed by "Salomon BRYS" but the current header has no copyright or license mention, the header was stripped.

When Bash is available (local runs), also compare against the merge-base version for additional context:

MB=$(git merge-base HEAD origin/main 2>/dev/null || git merge-base HEAD main)

git show "${MB}:<file-path>" | head -50

Flag these issues:

- **Header stripped** — file is in NOTICES but current header has no attribution

- **Header truncated** — header is present but missing required fields (e.g., copyright line removed, license disclaimer removed)

- **Header inconsistent** — header contradicts what the NOTICES entry says

- **Diff removes attribution lines** — `Copyright`, `Licensed under`, etc. appear on removed lines in the diff

From the Grep in Quick triage: if no matching entry exists, flag it as missing. A valid entry needs: Source URL, License name, Copyright, Scope, full license text.

Classify the license per Sentry's Open Source Legal Policy (https://open.sentry.io/licensing/):

| Tier | Examples | Severity |

|-----------------|-------------------------------------------------|----------------------------------------------|

| Permissive | MIT, BSD, Apache 2.0, ISC, CC0, Unlicense, Zlib | Allowed |

| Weak copyleft | LGPL, MPL, EPL, CDDL | **high** — requires review |

| Strong copyleft | GPL, QPL, Sleepycat, OSL | **high** — requires legal review |

| AGPL | — | **high** — absolute ban, must be removed |

| No license | — | **high** — assume no permission |

If the diff deletes a file and the removed lines contained attribution headers, check whether `THIRD_PARTY_NOTICES.md` still references it — the entry should be updated or removed.

| Level | Use for |

|------------|-----------------------------------------------------------------------------------------------------------------------------------------------------|

| **high** | 🚨 License violations: AGPL, copyleft, unlicensed, no-license code |

| **medium** | ⚠️ Missing attribution header fields, stripped headers, missing/inconsistent NOTICES entries, deleted/renamed vendored files needing NOTICES update |

| **low** | 👀 Attribution present but could be improved |

Note: Warden relies on these severity levels when deciding whether to make comments on PRs or require changes.

**No issues → empty response (say nothing).**

Otherwise, number each finding and order by severity (most severe first). Use this exact format — note the escaped period (`\.`) to prevent markdown list collapsing, and the blank line between entries:

Rules:

- **Escape the period** after the number (`1\.` not `1.`) so markdown does not collapse entries into a tight list.

- Use the emoji from the severity guide (🚨, ⚠️, or 👀) — not the word.

- Use fully qualified Java class names (e.g. `io.sentry.CircularFifoQueue`), not file paths.

- Start the description on a new indented line below the class name.

- Leave an empty line between each numbered finding.

- For license issues, include the policy link.

.warden/logs/

package io.sentry.util;

import java.io.IOException;

import java.io.Writer;

public final class CompactJsonWriter {

private final Writer out;

private boolean needsComma;

public CompactJsonWriter(Writer out) {

this.out = out;

this.needsComma = false;

}

public CompactJsonWriter beginObject() throws IOException {

out.write('{');

needsComma = false;

return this;

}

public CompactJsonWriter endObject() throws IOException {

out.write('}');

needsComma = true;

return this;

}

public CompactJsonWriter name(String name) throws IOException {

if (needsComma) {

out.write(',');

}

out.write('"');

out.write(name);

out.write("\":");

needsComma = false;

return this;

}

public CompactJsonWriter value(String value) throws IOException {

out.write('"');

out.write(value);

out.write('"');

needsComma = true;

return this;

}

public void flush() throws IOException {

out.flush();

}

}

version = 1

[defaults]

model = "anthropic/claude-opus-4-6"

maxTurns = 30

[defaults.verification]

enabled = false

[[defaults.chunking.filePatterns]]

pattern = "**/*.api"

mode = "skip"

[[defaults.chunking.filePatterns]]

pattern = "**/gradlew"

mode = "skip"

[[defaults.chunking.filePatterns]]

pattern = "**/gradlew.bat"

mode = "skip"

[[defaults.chunking.filePatterns]]

pattern = "**/*.java"

mode = "whole-file"

[[defaults.chunking.filePatterns]]

pattern = "**/*.kt"

mode = "whole-file"

[[defaults.chunking.filePatterns]]

pattern = "THIRD_PARTY_NOTICES.md"

mode = "whole-file"

[defaults.chunking.coalesce]

enabled = true

maxGapLines = 100

maxChunkSize = 16000

[[skills]]

name = "check-code-attribution"

failOn = "high"

reportOn = "low"

maxTurns = 30

ignorePaths = [

# Infrastructure directories

".claude/**",

".cursor/**",

".github/**",

".gradle/**",

".idea/**",

".mvn/**",

"gradle/**",

# Generated files

"**/generated/**",

"**/ksp/**",

"**/*.aidl",

"**/*.api",

"**/*.interp",

"**/*.tokens",

"**/*.g.kt",

"**/*.pb.java",

"**/databinding/*Binding.java",

"**/grpc/*Grpc.java",

"**/gradlew",

"**/gradlew.bat",

"**/mvnw",

"**/mvnw.cmd",

# Binary files

"**/*.jar",

# Warden infrastructure

".warden/**",

"warden.toml",

]

[[skills.triggers]]

type = "pull_request"

actions = ["opened", "synchronize"]

requestChanges = true # Post a blocking "Request Changes" PR comment when failOn-level findings exist.

failCheck = true # Red X on task in GitHub when failOn-level findings exist (currently non-blocking).

[[skills.triggers]]

type = "local"