Add copyright year linter to npm lint command

[Copilot]

• Understand the existing check-license.sh script and copyright header format
• Create a new script scripts/check-copyright-year.sh that:
  • Identifies new files compared to the baseline commit (using git diff)
  • Checks that the copyright year in new files is the current year
  • Fails if any new file has an outdated copyright year
• Add the new check to npm lint command in package.json
• Test the linter manually to ensure it works correctly
• Run existing lint and build commands to verify the integration
• Address code review feedback:
  • Fixed newline output formatting using arrays and printf
  • Extracted file patterns into a reusable variable
  • Added comment clarifying behavior with multiple copyright lines
• Run CodeQL security check (no issues found - shell scripts not analyzed)
• Use GITHUB_BASE_REF environment variable in GitHub CI for more reliable baseline reference
• Simplify FILE_PATTERNS to just scripts/** and packages/*/src/**
• Add check for full Apache license text (suggests using SPDX reference instead)
• Prefix error files with 🛑 emoji
• Fix CI issue: fetch base branch in GitHub Actions since checkout does shallow clone

Original prompt

I would like to add a linter to npm lint command that does the following

• identifies which new files are added in the change compared to the baseline commit
• checks which copyright year is specified in the copyright header and fails if that year is not the current year

---

💬 We'd love your input! Share your thoughts on Copilot coding agent in our 2 minute survey.

[yurishkuro]

@copilot when running in GitHub CI don't we have access to the baseline reference via std env var? I would like to use that as a more reliable reference in CI than the current fallback logic.

[Copilot]

@copilot when running in GitHub CI don't we have access to the baseline reference via std env var? I would like to use that as a more reliable reference in CI than the current fallback logic.

Updated the script in commit 0dc1f79 to use GITHUB_BASE_REF environment variable when running in GitHub CI. The priority is now: 1) explicit argument, 2) GITHUB_BASE_REF (set by GitHub Actions for pull_request events), 3) fallback to origin/main.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• iojs.org
  • Triggering command: /usr/bin/curl curl -q --fail --compressed -L -s REDACTED -o - (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[yurishkuro]

@copilot the FILE_PATTERNS seems overly complicated. Would't the following suffice?

• scripts/**
• packages/*/src/**

Another thing I would like to add to the linter is a check that the copyright header is not followed by a full text of Apache header, e.g. by checking that the string Licensed under the Apache License is not present. If it is the error message should suggest that the header should be replaced with just an SPDX reference

// SPDX-License-Identifier: Apache-2.0

and point to https://github.com/jaegertracing/jaeger-ui/blob/main/CONTRIBUTING.md#license

Finally, when printing the files which are in error prefix them with the stop emoji 🛑

[Copilot]

@copilot the FILE_PATTERNS seems overly complicated. Would't the following suffice?

• scripts/**...

Implemented all requested changes in commit 5a69f8d:

• Simplified FILE_PATTERNS to scripts/** and packages/*/src/**
• Added check for full Apache license text (looks for "Licensed under the Apache License" in first 20 lines)
• Error files now prefixed with 🛑 emoji
• Points to CONTRIBUTING.md#license for guidance

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• iojs.org
  • Triggering command: /usr/bin/curl curl -q --fail --compressed -L -s REDACTED -o - (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 97.89%. Comparing base (4398cb8) to head (e2b29f0).
⚠️ Report is 1 commits behind head on main.

Additional details and impacted files

@@           Coverage Diff           @@
##             main    #3197   +/-   ##
=======================================
  Coverage   97.89%   97.89%           
=======================================
  Files         262      262           
  Lines        8212     8212           
  Branches     2172     2141   -31     
=======================================
  Hits         8039     8039           
  Misses        172      172           
  Partials        1        1           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[yurishkuro]

@copilot I just added two files to this PR that should have failed in the CI. When I ran the script locally it correctly identified those files. But in GitHub actions the run did not result in an error: https://github.com/jaegertracing/jaeger-ui/actions/runs/19803541571/job/56734288664?pr=3197

[Copilot]

@copilot I just added two files to this PR that should have failed in the CI. When I ran the script locally it correctly identified those files. But in GitHub actions the run did not result in an erro...

The issue was that actions/checkout does a shallow clone without the base branch. The script now explicitly fetches the base branch when GITHUB_BASE_REF is set (commit 33f675f). The CI should now correctly detect the failing files.

[graphite-app]

The $NEW_FILES variable is unquoted in the for loop, which will cause word splitting on spaces, tabs, and newlines. If any filenames contain spaces or special characters, the script will fail to check them correctly or iterate over partial filenames.

Fix by using a while loop with read:

while IFS= read -r file; do
    [ -z "$file" ] && continue
    if [ -f "$file" ]; then
        # ... rest of the logic
    fi
done <<< "$NEW_FILES"

Or by quoting in the loop:

for file in "${NEW_FILES[@]}"; do

Though the latter requires converting NEW_FILES to an array using readarray or mapfile.

Spotted by Graphite Agent



Is this helpful? React 👍 or 👎 to let us know.