The intent is not obvious

[yegor256]

I just completed the scan in my repo: https://github.com/yegor256/xembly/actions/runs/13443111996/job/37562042041 The build passed. However, I don't understand what this means. My repository is fine? Everything is OK according to some standard? I'm not sure, how to interpret the result.

It would be nice if the README file of the plugin would explain what it's for and what a passed build means.

[tdruez]

The build passed. However, I don't understand what this means.

This means the scan_codebase pipeline declared in your workflow is completed. This pipeline scans your codebase for package, copyright, and license data.

The scan results declared as output-formats: "json xlsx spdx cyclonedx" are available as artifacts files at https://github.com/yegor256/xembly/actions/runs/13443111996

My repository is fine? Everything is OK according to some standard? I'm not sure, how to interpret the result.

What is considered acceptable depends on your company’s policies and standards. ScanCode does not impose any defaults or opinions on this matter—it simply scans and provides the data.

That said, if you're looking for a way to define and enforce your own policies, you may find the policies system helpful: https://scancodeio.readthedocs.io/en/latest/policies.html.

When the policies are provided, compliance_alert values will be assigned to problematic items during the pipeline execution.

The check-compliance is available to make a build fail if compliance issues are present in the project.

We should automate running the check-compliance as part of this action.

It would be nice if the README file of the plugin would explain what it's for and what a passed build means.

You're absolutely right! There’s definitely room for improvement in how we document the action, and we plan to include more details on its purpose and what a passed build signifies. Your feedback is really helpful, and it’ll guide us as we work to enhance the documentation.

[yegor256]

@tdruez indeed, the check-compliance would be great to have. Without this, just collecting the data (in JSON and other "unreadable" formats) makes little sense for most projects. Also, would be great to have the compliance policies that you've mentioned to be set by default. I may want to configure them, but when I start using this plugin, I expect it to do the compliance checking out-of-the-box.

[divyanshrai1]

Hi! I'd like to work on improving the README documentation to address this issue.

Based on @tdruez's explanation, I can add a clearer section that explains:

1. What the action does (scans codebase for package, copyright, and license data using ScanCode.io pipelines)
2. What "build passed" means (the scan_codebase pipeline completed successfully and generated output artifacts)
3. Where to find and interpret the scan results (artifacts section with json/xlsx/spdx/cyclonedx outputs)
4. How to use the check-compliance feature to enforce policies

I'm new to open-source contributions, so I'd appreciate any guidance on:

• Which sections of the README would be best to enhance?
• Are there any specific examples or use cases you'd like me to include?
• Should I create a separate "Understanding Scan Results" section or integrate it into existing sections?

Looking forward to contributing to this project!