First-party source files carry the ASF header. The audit recognizes the header inside the file type's comment syntax and permits a preceding shebang. Third-party source keeps its original attribution.
node scripts/asf-license-headers.mjs check node scripts/asf-license-headers.mjs check --report node scripts/asf-license-headers.mjs write
check audits source files, including unignored new files; --report lists resolved exclusions. write adds headers to covered files. The pre-commit hook uses check-staged to inspect staged bytes. CI and source-release verification run the repository audit.
Covered extensions and names, exclusions, and reviewed provenance decisions live in scripts/asf-license-headers.mjs. Exclusions identify specific files or bounded source sets and state why a header does not belong. They cover upstream source and license texts, generated or verbatim payloads, byte-significant fixtures, formats without comments and binary assets. A failing audit alone is not a reason to add an exclusion.
SPDX identifiers, copyright lines and adaptation notices require a reviewed provenance decision before a whole-file ASF header is accepted. The scanner can identify these markers; it cannot establish ownership or licensing by itself. Keep third-party and mixed-origin attribution in LICENSE, NOTICE and the relevant source record. Ownership questions require project review.
When adding a source format, update the coverage rules and run the writer. When changing an exclusion, review the resolved file list so the rule does not silently exempt unrelated files.