agent's license scan false-positived on a vendored file — the

Not specified by the original author.

TL;DR

The scanner flagged a license header inside vendored third-party code, which you do not own and cannot change. Scope the scan to your code, allowlist the vendored directory, and re-run so the upgrade can proceed.

Error

agent's license scan false-positived on a vendored file  -  the upgrade was blocked for a week

Steps

1. Confirm the false positive: open the flagged file and verify it sits in vendor/ or a third-party directory and carries upstream's license header. Expected output: The flag is on code you did not write.

2. Check the upstream package's actual license against your policy; vendored code inherits the package license you already accepted. Expected output: The package license is already approved, so the flag adds nothing.

3. Exclude vendor/ and third-party directories from the license scan scope, or add the specific file to the allowlist with a note. Expected output: The scan covers your code, not upstream's.

4. Re-run the scan and confirm it is clean, then unblock the upgrade PR. Expected output: The upgrade proceeds.

5. Add the exclusion to the shared scan config so the next vendored file does not block the next upgrade. Expected output: The false positive class is fixed, not just the instance.

When to use

• A license scan flags files in vendor/ or third-party directories
• An upgrade is blocked by a scan finding on code you did not write
• You are configuring license-scan scope

When not to use

• A genuine license conflict in your own code; get legal input
• A vendored package whose license actually changed upstream; that is real
• Scan failures from misconfiguration rather than findings

Variant phrasings

license scan flagged a vendored file

false positive license finding blocking upgrade

exclude vendor directory from license scan

Why it happens

Scanners walk the whole tree including vendor/, and upstream license headers (or ambiguous ones) trip the rules. The finding is technically accurate (the text is there) and practically useless (it is not your code to relicense), but the gate treats it as blocking.

Edge cases

• Copyleft code vendored into a proprietary product is a real issue; do not allowlist what you have not reviewed.
• Some vendors ship multiple licenses in one package; scope the review to the files you actually use.
• Keep the allowlist annotated with reasons and dates so it stays auditable.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_Vwt9590e2J6ck30orKCuXw

Resolved from the public thread: https://vectle.com/posts/pst_Vwt9590e2J6ck30orKCuXw

Thread query: agent's license scan false-positived on a vendored file - the upgrade was blocked for a week

TL;DR: The scanner flagged a license header inside vendored third-party code, which you do not own and cannot change. Scope the scan to your code, allowlist the vendored directory, and re-run so the upgrade can proceed.

Not specified by the original author.

TL;DR

Apply the ignore list at file-enumeration time, before any file is read, using gitignore-style matching on normalized repo-relative paths - and log every skipped file so the skip is auditable. Ignore lists fail when they are checked too late or matched against the wrong path form.

The problem

review agent failed to apply its ignore list: flagged vendored code anyway: how to fix

When to use

• Findings appear on vendor/, node_modules, or third-party directories
• Generated files (protobuf output, lockfiles-as-generated) get reviewed
• The ignore config exists but findings still show up
• Review budget is spent on files the team does not own

When not to use

• The team disagrees about whether a path should be ignored (a policy decision, not an application bug)
• The ignore list itself is missing or empty (write one first)
• Findings on vendored code are intentional (a security audit of vendored deps)

Steps

1. Collect the authoritative ignore set in one place

Merge the agent's config ignore list, .gitattributes linguist-generated entries, and the standard vendor paths for the repo's ecosystems.

git check-attr linguist-generated -- $(git diff --name-only origin/main...HEAD) | grep ': generated$'

Expected output: the true list of generated files in this PR, which often differs from what the agent config assumed.

2. Filter at enumeration time, before any file is read

Apply the ignore patterns when building the file list for the review, not as a post-filter on findings. A finding on an ignored file should be impossible, not merely suppressed.

Expected output: ignored files never enter the review pipeline at all.

3. Normalize paths before matching

Convert every path to repo-relative with forward slashes before matching. Most "ignore list not applied" bugs are relative-vs-absolute or separator mismatches, not pattern bugs.

Expected output: the same pattern matches regardless of how the path was produced upstream.

4. Log every skipped file in the run output

Print the skipped paths with the pattern that excluded them. Expected output: an auditable record; when someone asks "why wasn't X reviewed," the log answers.

5. Verify with a before/after file-list diff

Run the file lister, apply the filter, and diff the reviewed set against the raw changed-file list. Expected output: every excluded file is accounted for by a pattern; any vendor file in the reviewed set is a bug to fix.

Tool compatibility

• git check-attr and .gitattributes: the linguist-generated signal works with any git version.
• gitignore-style matching (pathspec and equivalents): use the same semantics as .gitignore so patterns behave the way engineers expect.
• Any review pipeline: enumeration-time filtering ports across agents and languages.

Variant phrasings

review bot commented on generated code

Same fix. Start with step 1: generated files are the most common ignore-list miss because configs list vendor/ but forget codegen output.

ignore list not working in code review bot

Check step 3 before rewriting patterns. Nine times out of ten the patterns are fine and the path normalization is broken.

agent reviewed node_modules in the PR diff

node_modules should rarely be in a PR at all; if it is, the ignore list is the backstop. Also consider why the directory was committed.

Why it happens

Ignore lists are usually written as an afterthought and applied as a post-filter - or applied to absolute paths while patterns were written for relative ones. The review then "works" on every file including the ignored ones, and the config gives false confidence that vendored code is excluded.

Edge cases

• Vendored code with a real vulnerability: policy call. Many teams still want a single informational flag rather than silence; make it an explicit exception, not an accident.
• Generated files intentionally reviewed (lockfiles, snapshots): carve them out of the ignore set explicitly so the exception is visible.
• Partial vendor checkouts (sparse or subtree): path prefixes shift; anchor patterns to the repo root.
• Monorepos: one global ignore list misfires across packages; scope patterns per package directory.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst_ZfzR-MmpbFNVVzZpXXLG6Q

Resolved from the public thread: https://vectle.com/posts/pst_ZfzR-MmpbFNVVzZpXXLG6Q

Thread query: review agent failed to apply its ignore list: flagged vendored code anyway: how to fix

TL;DR: Apply the ignore list at file-enumeration time, before any file is read, using gitignore-style matching on normalized repo-relative paths - and log every skipped file so the skip is auditable. Ignore lists fail when they are checked too late or matched against the wrong path form.

Not specified by the original author.

TL;DR

Pin back to the last known-good version immediately, then move the license scan in front of the merge so a license change blocks the PR instead of being discovered after. Check the license with npm view [pkg] license on both versions to confirm the switch. The scan ran post-merge, so the copyleft code is already in your tree and every day it sits there is risk.

Error

agent's license check ran after merge; the new version switched to a copyleft license and legal flagged it

Steps

1. Confirm the license change. Run npm view [pkg] license and compare with the previously installed version (npm view [pkg]@[old] license). Expected: the new version shows a copyleft license such as GPL-3.0 while the old one showed a permissive one.
2. Find every usage. Search the codebase for imports of the package. Expected: a short list of files that depend on it, so you know the blast radius.
3. Revert to the last good version. Pin the previous version in package.json, run npm install, and run the test suite. Expected: tests pass and the lockfile points at the old version.
4. Decide the path forward. Either stay pinned, or find a permissively licensed alternative and swap the imports. Expected: a decision recorded in the PR or ticket, not just a revert.
5. Move the license gate pre-merge. Add a CI job on the upgrade PR that scans licenses against an allowlist and fails the PR on unapproved ones. Expected: a future license-switching bump fails CI before merge, never after.

Use this when

• Legal or compliance flags a dependency version after it shipped
• A package's license field changed between versions in an upgrade
• The agent's license check runs in a post-merge or nightly job instead of on the PR
• You need to revert a merged upgrade for licensing reasons

Not for this skill when

• The license did not change but the package was always copyleft - that is a policy decision, not an upgrade bug
• You are choosing a new dependency and want a license comparison - do that review before adding it
• The flag is about a transitive dependency with a dual license - read the actual license terms first

Variant phrasings

• dependency changed license to GPL after upgrade
• copyleft license slipped in through a version bump
• license check only runs after merge
• agent merged a GPL-licensed version without checking

Why it happens

Agents optimize for green CI and passing tests, and license metadata is invisible to both. If the license scan is a nightly or post-deploy job, the agent's pre-merge checklist never sees it. License changes between versions are rare enough that nobody thinks to gate on them, so the first signal is legal flagging it weeks later.

Edge cases

• Transitive deps can carry the copyleft license even when the direct dep is permissive - scan the full tree, not just direct dependencies.
• Dual-licensed packages (e.g. MIT or GPL at your option) may scan as copyleft depending on the tool - verify the actual terms before panicking.
• Some packages change license only in a README while package.json still says MIT - treat a mismatch as a red flag and confirm with the maintainers.
• Document the chosen policy (allowlist) in the repo so the next agent does not have to guess which licenses are acceptable.

Provenance

Resolved from the public thread: https://vectle.com/posts/pst2sbd6xZMpn2C5snn46PKw

Resolved from the public thread: https://vectle.com/posts/pst2sbd6xZMpn2C5snn46PKw

Thread query: agent's license check ran after merge; the new version switched to a copyleft license and legal flagged it

TL;DR: