ministryofjustice / ministryofjustice/developer-experience-github-audit

[Current Standards] Review and Remediate Repositories Missing MIT License

Open
#89 1 comment 0 reactions 0 assignees View on GitHub

Nobody has claimed this yet.

Dominant language
Python
Stars
2
Forks
2
Avg merge
10d 5h
Merged PRs (30d)
2

Description

🧑‍💼 User Need

As a GitHub organisation administrator
I want to review all repositories flagged as missing an MIT license and validate whether they are true positives
so that we can ensure legal compliance and avoid accidental exposure of unlicensed code, especially in public‑facing repositories.

💡 Value / Purpose

  • Ensures legal clarity and compliance across the organisation
  • Reduces risk of unlicensed or ambiguously licensed code being used externally
  • Helps maintain a consistent licensing standard
  • Prevents false positives from triggering unnecessary remediation work

🛠️ Description / Context

  • The audit of the top 400 most active repos as per #84 and the supporting spreadsheet identified 23/400 missing an MIT license, before raising remediation tickets, we must:
  • Validate the findings:
    • Confirm whether the repositories truly lack a license
    • Check for non‑standard license filenames
    • Check for license text embedded in README or documentation
    • Confirm whether any repositories intentionally use a different license
  • Categorise each repository:
    • Missing license (requires remediation)
    • Incorrect or non‑standard license placement
    • False positive
    • Requires legal review
  • Prepare follow‑up remediation tickets for each repository requiring action.

🧪 Testing steps

  • Manually inspect each repository for:
    • LICENSE or LICENSE.md
    • alternative license files
    • license text in README
    • references to external licensing
  • Categorise each repository.
  • Document work completed in Developer Experience Team SharePoint and prepare remediation tickets.

✅ Definition of Done

  • All 23 repositories reviewed manually
  • False positives identified and excluded
  • Repositories requiring remediation categorised
  • Follow‑up tickets created for each required fix
  • Summary report produced for leadership/legal

📝 Notes (Optional)

  • Non-compliant repos can be found in the spreadsheet here
  • Verify with @sb21460 the recommended approach for per-repo tickets

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the linked Top 400 Current Standards spreadsheet and review all 23 flagged repositories. Inspect LICENSE or LICENSE.md, alternative license files, README or documentation text, and external licensing references, then categorise each repository. Done means the findings are documented in the Developer Experience Team SharePoint, remediation tickets are prepared where needed, and a summary is produced for leadership or legal.

Written by the indexing model from the issue text.

Assessment

Domain
documentation, security
Issue type
Feature
Difficulty
4/5
Estimated time
3-5 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
45/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.