Missing Copyright Or Licence Header
ID |
go.track_lack_copyright_license_headers |
Severity |
high |
Remediation Complexity |
medium |
Remediation Risk |
low |
Remediation Effort |
medium |
Resource |
Code Smell |
Language |
Go |
Tags |
best-practice, code-style |
Description
Reports a Go source file whose leading comment block — the comments above the package clause —
does not carry the project’s copyright or licence notice.
What counts as a header is a project decision, so the notice is supplied as a regular expression
in the headerPattern property. It ships matching the two notices in general use — an SPDX
identifier, or a copyright line in any spelling and any case — so the rule is silent on a project
that carries either and reports the files that carry neither. Replace it with the notice the
project enforces. An empty pattern turns the rule off: that is the escape hatch for a project
with no header policy, where flagging every one of its files would be pure noise.
Machine-generated files — those carrying Go’s own // Code generated … DO NOT EDIT. marker
(protobuf output, mocks, stringer) — are skipped: nobody hand-edits them, and their first lines
are the generator’s business, not the project’s.
Rationale
A file with no header leaves its ownership and its redistribution terms undeclared. Source files
travel on their own: they get vendored, copied into a snippet, pasted into an issue, or shipped
inside a container image. Once separated from the repository’s LICENSE file, an unheaded file
carries no evidence of the terms it was released under.
That has concrete consequences. Licence-compliance scans and SPDX inventories read per-file notices, so an unheaded file shows up as unknown-licence and blocks the release. Contributors cannot tell whether a file is safe to reuse. And in a repository that mixes licences — a vendored third-party directory, a dual-licensed module — the absence of a header is genuinely ambiguous rather than merely untidy.
package billing // FLAW — no copyright or licence notice anywhere above the package clause
func Charge(amount int) error {
return nil
}Remediation
Add the project’s notice as a comment block above the package clause. A build constraint may
precede it; the pattern is searched anywhere in the leading block, so both orders match.
// Copyright 2026 Example Corp.
// SPDX-License-Identifier: Apache-2.0
package billing
func Charge(amount int) error {
return nil
}Adding headers across an existing repository is mechanical and worth automating — addlicense,
reuse and similar tools insert the block in place.
Configuration
| Property | Default | Description |
|---|---|---|
|
|
Regular expression searched inside the file’s leading comment block. The default matches an SPDX
identifier or a copyright line in any spelling and any case — |