The repository ships a license file whose license matches the package manifest
Without a license file the default is exclusive copyright, so nobody may legally use the code. A manifest field saying MIT while the file says Apache-2.0 forces every downstream legal review to stop and ask.
Observable check
a license file exists at the repository root under a name the forge's own detector reads, which on GitHub means a basename of LICENSE, LICENCE, UNLICENSE, or COPYING, bare or carrying a .md, .markdown, .txt, or .html extension, and every package manifest that declares a license names the license that file contains. Do not fail a repository for the spelling of a filename the forge already resolves.
Where this comes from
- https://baseline.openssf.org/versions/2026-02-19
- https://github.com/licensee/licensee/blob/main/lib/licensee/project_files/license_file.rb
Last read against these sources on 2026-07-31.
OSPS-LE-03.01, Maturity 1-3: 'While active, the license for the source code MUST be maintained in the corresponding repository's LICENSE file, COPYING file, or LICENSE/ directory.' The Check named only LICENSE and LICENSE.md until 2026-07-31, which failed a repository shipping LICENSE.txt and made it rename a working file. licensee, the detector GitHub itself runs, matches basenames on /(un)?licen[sc]e/i and /copying/i and accepts the extensions md, markdown, txt, and html, so the forge resolved a file this standard rejected. The Check now names what licensee reads. Two divergences from the Baseline remain deliberate: this rule still says root, and it does not accept a LICENSE/ directory, because a manifest comparison needs one file to read.