The intent is not obvious

[yegor256]

I just completed the scan in my repo: https://github.com/yegor256/xembly/actions/runs/13443111996/job/37562042041 The build passed. However, I don't understand what this means. My repository is fine? Everything is OK according to some standard? I'm not sure, how to interpret the result.

It would be nice if the README file of the plugin would explain what it's for and what a passed build means.

[tdruez]

The build passed. However, I don't understand what this means.

This means the scan_codebase pipeline declared in your workflow is completed. This pipeline scans your codebase for package, copyright, and license data.

The scan results declared as output-formats: "json xlsx spdx cyclonedx" are available as artifacts files at https://github.com/yegor256/xembly/actions/runs/13443111996

My repository is fine? Everything is OK according to some standard? I'm not sure, how to interpret the result.

What is considered acceptable depends on your company’s policies and standards. ScanCode does not impose any defaults or opinions on this matter—it simply scans and provides the data.

That said, if you're looking for a way to define and enforce your own policies, you may find the policies system helpful: https://scancodeio.readthedocs.io/en/latest/policies.html.

When the policies are provided, compliance_alert values will be assigned to problematic items during the pipeline execution.

The check-compliance is available to make a build fail if compliance issues are present in the project.

We should automate running the check-compliance as part of this action.

It would be nice if the README file of the plugin would explain what it's for and what a passed build means.

You're absolutely right! There’s definitely room for improvement in how we document the action, and we plan to include more details on its purpose and what a passed build signifies. Your feedback is really helpful, and it’ll guide us as we work to enhance the documentation.

[yegor256]

@tdruez indeed, the check-compliance would be great to have. Without this, just collecting the data (in JSON and other "unreadable" formats) makes little sense for most projects. Also, would be great to have the compliance policies that you've mentioned to be set by default. I may want to configure them, but when I start using this plugin, I expect it to do the compliance checking out-of-the-box.