Merge pull request #157 from NVIDIA-NeMo/fix/spdx-check-local-artifacts

fix(release): use Git excludes for SPDX scan

Author: sklinglernv

scripts/check_license_headers.py

@@ -6,50 +6,44 @@
 ``lint`` job runs it on every merge request. Empty ``__init__.py`` package
 markers (0 bytes) are exempt — they hold no copyrightable content.
 
-Walks the filesystem (no ``git`` dependency, so it runs in the minimal CI lint
-image), skipping virtualenvs, caches, build output, and vendored trees.
+Uses Git's file and exclude handling as the source of truth: tracked Python
+files and untracked, nonignored Python files are checked. Files excluded by
+``.gitignore``, ``.git/info/exclude``, or the user's global Git excludes are
+not repository source and are not scanned.
 """
 
 from __future__ import annotations
 
+import os
+import subprocess
 import sys
 from pathlib import Path
 
 REQUIRED = "SPDX-License-Identifier"
 # Only the first few lines are checked (header sits above any docstring, after
 # an optional shebang/coding line).
 HEAD_LINES = 5
-# Directory names to skip anywhere in the tree.
-SKIP_DIRS = {
-    ".git",
-    ".venv",
-    "venv",
-    "__pycache__",
-    "node_modules",
-    "dist",
-    "build",
-    ".uv-cache",
-    ".mypy_cache",
-    ".pytest_cache",
-    ".ruff_cache",
-    "site-packages",
-    ".scratch",
-    "htmlcov",
-    # Local git worktrees are separate checkouts of other branches. Scanning
-    # them makes this check fail on someone else's in-progress work — and on
-    # vendored trees that branch happens to contain. CI never has them, so the
-    # failure only ever hits developers running the check locally.
-    ".worktrees",
-}
 
 
 def source_python_files(root: Path) -> list[Path]:
-    files: list[Path] = []
-    for path in root.rglob("*.py"):
-        if any(part in SKIP_DIRS for part in path.relative_to(root).parts):
-            continue
-        files.append(path)
-    return files
+    """Return tracked and untracked, nonignored Python files under *root*."""
+    result = subprocess.run(
+        [
+            "git",
+            "ls-files",
+            "--cached",
+            "--others",
+            "--exclude-standard",
+            "-z",
+            "--",
+            "*.py",
+        ],
+        cwd=root,
+        check=True,
+        capture_output=True,
+    )
+    relative_paths = (os.fsdecode(raw) for raw in result.stdout.split(b"\0") if raw)
+    return sorted(root / relative for relative in relative_paths)
 
 
 def main() -> int:

tests/test_check_license_headers.py

@@ -0,0 +1,49 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026, NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+"""Tests for the repository SPDX header scanner."""
+
+from __future__ import annotations
+
+import subprocess
+from pathlib import Path
+
+from scripts.check_license_headers import source_python_files
+
+
+def _python_file(path: Path) -> Path:
+    path.parent.mkdir(parents=True, exist_ok=True)
+    path.write_text("print('test')\n")
+    return path
+
+
+def _git(root: Path, *args: str) -> None:
+    subprocess.run(["git", *args], cwd=root, check=True, capture_output=True)
+
+
+def test_source_files_follow_standard_git_excludes(tmp_path: Path) -> None:
+    _git(tmp_path, "init")
+    (tmp_path / ".gitignore").write_text("/tmp/\n")
+    with (tmp_path / ".git" / "info" / "exclude").open("a") as exclude:
+        exclude.write("\n.codex/\n")
+
+    tracked_source = _python_file(tmp_path / "src" / "tracked.py")
+    untracked_source = _python_file(tmp_path / "src" / "new.py")
+    ignored_by_gitignore = _python_file(tmp_path / "tmp" / "generated.py")
+    ignored_by_info_exclude = _python_file(tmp_path / ".codex" / "external.py")
+    _git(tmp_path, "add", ".gitignore", "src/tracked.py")
+
+    found = set(source_python_files(tmp_path))
+
+    assert tracked_source in found
+    assert untracked_source in found
+    assert ignored_by_gitignore not in found
+    assert ignored_by_info_exclude not in found
+
+
+def test_source_files_include_tracked_files_that_match_ignore_rules(tmp_path: Path) -> None:
+    _git(tmp_path, "init")
+    tracked_source = _python_file(tmp_path / "generated" / "tracked.py")
+    _git(tmp_path, "add", "generated/tracked.py")
+    (tmp_path / ".gitignore").write_text("/generated/\n")
+
+    assert tracked_source in source_python_files(tmp_path)