SRE-978: Require a license file per Cargo.toml and pyproject.toml directory

[claude]

Requested by Tim Diekmann · Slack thread

🌟 What is the purpose of this PR?

Before: yarn lint:license-in-workspaces took its directory list from yarn workspaces list, so it required a LICENSE.md only in directories that hold a package.json. A Rust crate or a Python package without a package.json was never checked.

After: the check requires a LICENSE.md in every directory holding a Cargo.toml or a pyproject.toml as well, and keeps the existing Yarn workspace rule.

This is defensive ahead of the turborepo native-Rust transition, which would remove package.json from Rust crates. Without this change, every crate would stop being checked at that point. Every Cargo.toml and pyproject.toml directory in the repository already has a LICENSE.md, so this PR adds no license files.

scripts/check-license-in-workspaces.ts gains a second globby call for **/Cargo.toml and **/pyproject.toml. The checked directory set becomes the union of the repository root, the Yarn workspace locations, and the parent directory of each of those manifests. The ignore list is hoisted to a constant so both globs share it. yarn workspaces list stays the authority for JavaScript packages, so package.json behaviour is unchanged.

🔗 Related links

• SRE-978 (internal)
• H-3690 (internal) — rejected replacing this script with a Yarn constraint. A constraint only sees Yarn workspaces, so the script stays.

🔍 What does this change?

• Requires a LICENSE.md in every directory holding a Cargo.toml or a pyproject.toml.
• Deduplicates the checked directory list. The repository root was checked twice before, because yarn workspaces list reports the root workspace at location . and the script also added the root explicitly.
• Rewords the summary messages to name the manifests the check covers.

Pre-Merge Checklist 🚀

🚢 Has this modified a publishable library?

This PR:

• does not modify any publishable blocks or libraries, or modifications do not need publishing

📜 Does this require a change to the docs?

The changes in this PR:

• are internal and do not require a docs change

🕸️ Does this require a change to the Turbo Graph?

The changes in this PR:

• do not affect the execution graph

⚠️ Known issues

• A Cargo.toml without a [package] section counts as a package directory. The only one in the repository is the root manifest, which already requires a LICENSE.md, so nothing changes today. Excluding virtual workspace manifests would need a TOML parse.
• The script is still named check-license-in-workspaces.ts, and the yarn script lint:license-in-workspaces, though the check covers more than Yarn workspaces. Renaming both would touch package.json and .github/workflows/lint.yml; say the word and I will do it.

🛡 What tests cover this?

• The existing "Run yarn lint:license-in-workspaces" step in the global job of .github/workflows/lint.yml. No new CI wiring was needed.

❓ How to test this?

1. Check out the branch and run yarn lint:license-in-workspaces. It exits 0 and reports no [MISSING] entries.
2. Run mkdir -p libs/scratch-crate && printf '[package]\nname = "scratch-crate"\n' > libs/scratch-crate/Cargo.toml, then run the check again. It exits 1 with [MISSING] libs/scratch-crate/LICENSE.md.
3. Remove libs/scratch-crate.

[vercel]

The latest updates on your projects. Learn more about Vercel for GitHub.

Project	Deployment	Actions	Updated (UTC)
hash	Ready	Preview	Aug 28, 2026 11:20pm

3 Skipped Deployments

Project	Deployment	Actions	Updated (UTC)
hashdotdesign-tokens	Ignored		Aug 28, 2026 11:20pm
petrinaut	Skipped		Aug 28, 2026 11:20pm
petrinaut-docs	Skipped		Aug 28, 2026 11:20pm

[cursor]

PR Summary

Low Risk
Internal lint-only change with no runtime or security impact; existing packages already satisfy the new rules.

Overview
Extends yarn lint:license-in-workspaces so it enforces LICENSE.md in every directory that contains Cargo.toml or pyproject.toml, not only Yarn workspace roots from package.json.

The script discovers those manifest paths via globby, unions them with the existing workspace list (with Set deduplication so the repo root is not checked twice), and reuses a shared ignore list for build/venv folders. User-facing log and failure text now refer to package directories and the three manifest types.

^{Reviewed by Cursor Bugbot for commit a3d7922. Bugbot is set up for automated code reviews on this repo. Configure here.}