The plugin ships as a public binary with a bundled set of Go dependencies and carries no NOTICE file, so nobody downloading a release can see the licences of what is inside it. The release checklist treats a missing NOTICE as a warning, and v0.1.1 went out today with that warning standing.
The repo also has no way to produce one, so the file would go stale on the next dependency bump. Two sibling repos already solve this: galactic generates its NOTICE from a template through a Taskfile target, and cloud and network commit the result. This repo should do the same so the release checklist can refresh the file rather than skip it.
What success looks like
- A NOTICE file at the repo root listing every bundled module and its licence, generated, not hand-written.
- A single task or make target regenerates it from go.mod, following galactic's pattern.
- CI fails when the committed NOTICE is out of date with go.mod.
- GoReleaser attaches NOTICE to each release alongside LICENSE.
Related to https://github.com/datum-cloud/inventory/releases/tag/v0.1.1
https://claude.ai/code/session_01T2Bmcs7qWPaw1R6HnmrmBq
The plugin ships as a public binary with a bundled set of Go dependencies and carries no NOTICE file, so nobody downloading a release can see the licences of what is inside it. The release checklist treats a missing NOTICE as a warning, and v0.1.1 went out today with that warning standing.
The repo also has no way to produce one, so the file would go stale on the next dependency bump. Two sibling repos already solve this: galactic generates its NOTICE from a template through a Taskfile target, and cloud and network commit the result. This repo should do the same so the release checklist can refresh the file rather than skip it.
What success looks like
Related to https://github.com/datum-cloud/inventory/releases/tag/v0.1.1
https://claude.ai/code/session_01T2Bmcs7qWPaw1R6HnmrmBq