Require SPDX copyright tags in source headers

[jmccaffrey-nv]

Summary

• require non-empty SPDX copyright and license tags in first-party source headers
• allow contributor-specific and multiple copyright notices
• standardize contributor and agent guidance on the concise two-line SPDX form

Validation

• executed the extracted CI header-check script across tracked source files
• verified NVIDIA, individual contributor, and contributor-group notices pass
• verified empty and whitespace-only copyright values fail
• parsed the workflow YAML and ran git diff --check

[copy-pr-bot]

This pull request requires additional validation before any workflows can run on NVIDIA's runners.

Pull request vetters can view their responsibilities here.

Contributors can view more details about this message here.

[jmccaffrey-nv]

/ready to test 18f27e2

[jmccaffrey-nv]

/ok to test 18f27e2

[greptile-apps]

Greptile Summary

The PR strengthens source-header validation by requiring non-empty copyright and license tags and aligns contributor and agent documentation with the concise two-line SPDX form. The attempted string/docstring exclusion remains incomplete because bare * lines are accepted across all source languages.

• Separates missing-copyright and missing-license diagnostics.
• Documents contributor-specific and multiple copyright notices.
• Standardizes SPDX guidance across contributor and agent documentation.

Confidence Score: 4/5

The PR should not merge until the header matcher prevents bare * text in non-C source strings or docstrings from satisfying the SPDX policy.

The attempted fix still applies a bare-* alternative to Python, shell, Dockerfile, and C-family files alike, so headerless non-C source can pass when SPDX-like lines occur inside a string or docstring.

Files Needing Attention: .github/workflows/reuse-lint.yml

Important Files Changed

Filename	Overview
.github/workflows/reuse-lint.yml	Adds non-empty, comment-anchored SPDX checks, but bare * matching still permits docstring or string text to pass for non-C languages.
CONTRIBUTING.md	Replaces the long boilerplate example with concise SPDX guidance supporting actual copyright holders and multiple notices.
skills/maintaining-oss-state/SKILL.md	Aligns OSS maintenance guidance with the new two-tag workflow policy.
skills/python-docstring-style/SKILL.md	Updates Python header guidance to the concise two-line SPDX form and clarifies contributor attribution.

_{Reviews (3): Last reviewed commit: "Anchor SPDX checks to comment headers" | Re-trigger Greptile}

[jmccaffrey-nv]

/ok to test cdc6b61

[greptile-apps]

Bare stars bypass headers

When a Python, shell, or Dockerfile string or docstring contains * SPDX-FileCopyrightText: and * SPDX-License-Identifier: lines within its first 20 lines, the shared patterns treat them as source comments, causing a file without an actual SPDX comment header to pass the workflow.