Missing Copyright Or Licence Header

ID

kotlin.track_lack_copyright_license_headers

Severity

high

Remediation Complexity

medium

Remediation Risk

low

Remediation Effort

medium

Resource

Code Smell

Language

Kotlin

Tags

best-practice, code-style

Description

Reports a Kotlin source file whose leading comment block — the comments above the package clause, the @file: annotations or the first declaration, whichever comes first — does not carry the project’s copyright or licence notice.

What counts as a header is a project decision, so the notice is supplied as a regular expression in the headerPattern property. It ships matching the two notices in general use — an SPDX identifier, or a copyright line in any spelling and any case — so the rule is silent on a project that carries either and reports the files that carry neither. Replace it with the notice the project enforces. An empty pattern turns the rule off: that is the escape hatch for a project with no header policy, where flagging every one of its files would be pure noise.

Both comment forms count, so a // run and a block or KDoc comment are equally good places for the notice. Kotlin has no generated-code marker convention of its own, so no file is exempted on that ground — a project that generates Kotlin sources excludes them by path instead.

Rationale

A file with no header leaves its ownership and its redistribution terms undeclared. Source files travel on their own: they get vendored, copied into a snippet, pasted into an issue, or shipped inside a container image. Once separated from the repository’s LICENSE file, an unheaded file carries no evidence of the terms it was released under.

That has concrete consequences. Licence-compliance scans and SPDX inventories read per-file notices, so an unheaded file shows up as unknown-licence and blocks the release. Contributors cannot tell whether a file is safe to reuse. And in a repository that mixes licences — a vendored third-party directory, a dual-licensed module — the absence of a header is genuinely ambiguous rather than merely untidy.

package com.example.billing // FLAW -- no copyright or licence notice anywhere above the package clause

fun charge(amount: Int): Int = amount

Remediation

Add the project’s notice as a comment block at the very top of the file. A file annotation or a shebang line may sit between the notice and the package clause; the pattern is searched anywhere in the leading block, so any order matches.

// Copyright 2026 Example Corp.
// SPDX-License-Identifier: Apache-2.0

package com.example.billing

fun charge(amount: Int): Int = amount

Adding headers across an existing repository is mechanical and worth automating — addlicense, reuse and similar tools insert the block in place. Most IDEs also apply a copyright profile to every new file, which keeps the problem from coming back.

Configuration

Property Default Description

headerPattern

SPDX-License-Identifier|(?i:Copyright)

Regular expression searched inside the file’s leading comment block. The default matches an SPDX identifier or a copyright line in any spelling and any case — Copyright © 2021, Copyright (c) 2024, Copyright 2026 The Authors. Replace it with the exact notice the project enforces, or set it to "" to turn the rule off.

© 2026 Xygeni. All rights reserved