Repository hygiene · rule repo-unlicensed
Public data repository with no licence
A Metacenta review checks this under the rule A public repo states its licence. Everything below applies whether or not you ever commission one.
What this rule checks
This rule flags a public repository with no licence the host can identify. A licence file the host cannot match to a known licence is reported as well, as a separate problem. Private and internal repositories are not judged. If the host reports no visibility, we decline.
Why it matters
An unlicensed public repository grants nobody permission to use, modify or contribute to it, whatever the author intended. An unidentified licence gives a would-be contributor's legal team nothing to approve.
How to fix it
State the licence of the public repository. Add a LICENSE file holding the unmodified text of the licence you intend. If publication was a mistake, make the repository private instead.
When it is fine to leave
Publishing code to be read but not reused, with all rights reserved, is a legitimate choice. Say so in the README, so the absence reads as a decision. A private repository needs no open-source licence, which is why we do not check one.
What we need to check it
Read-only access to the repository's metadata. We use the visibility and the licence identifier the host resolved, not a filename match. So a COPYING file can count, and a LICENSE file holding something else does not.
Published rules it corresponds to
OpenSSF Scorecard, rule License. Ours checks a subset of what it flags; theirs is stricter. Scorecard scores every repository on whether a licence is present and recognised. This engine asks it only of a public repository. An internal analytics repo is right to carry no open-source licence, and that describes almost every client.
This means our check corresponds to their rule. It does not mean the publisher reviewed or endorses it.