[no-ci] check_spdx.py: require explicit license decisions for top-level paths and related cleanup

[rwgk]

Accident note

The PR description below does not match what was actually merged into main in a8805e5.

GitHub merged the earlier branch state ending at c719fce, which is what GitHub restored for rwgk:expected_license_identifiers_cont. The later follow-up changes described below were not pushed due to an unknown oversight.

Those later changes are now preserved for reference on rwgk:expected_license_identifiers_cont_recovered (see comment below for more details). Please read the remainder of this PR description as describing that recovered branch, not the merged result on main.

The missing commits were added to #1948 (comment) (needed there to guide fixing license identifiers).

---

Follow-on to PR #1897

Summary

• Enforce an explicit SPDX license identifier for every top-level directory in the repository, so new paths can't slip in without a reviewed license decision.

• Keep top-level files on an explicit default of Apache-2.0.

• Continue to accommodate special cases, but treat them as exceptions we want to minimize rather than the default mechanism.

• Update cuda_bindings/pixi.toml to LicenseRef-NVIDIA-SOFTWARE-LICENSE.

• Fix the current non-benchmark special cases by updating

  • .coveragerc
  • cuda_python_test_helpers/cuda_python_test_helpers/nvvm_bitcode.py
  • toolshed/build_static_bitcode_input.py
  • toolshed/dump_cutile_b64.py

  to Apache-2.0.

• Keep cuda_bindings/benchmarks/ as the only remaining special cases for now; those mixed-license cases will be handled in follow-on PRs (see comment below).

Technical details

• Replace the old prefix-only SPDX policy handling in toolshed/check_spdx.py with explicit TOP_LEVEL_DIRS_LICENSE_IDENTIFIERS and SPECIAL_CASE_LICENSE_IDENTIFIERS mappings.
• Normalize repo-relative paths before matching so the checker behaves consistently across platforms.
• Make the checker fail when a file lives under a top-level directory that does not have an explicit expected license.
• Apply special cases by exact path or glob pattern, with longest-match wins so narrower overrides can coexist with broader rules.
• Improve license parsing by trimming common comment suffixes and decoding with replacement so malformed bytes still produce deterministic comparisons instead of being treated as missing headers.

[copy-pr-bot]

Auto-sync is disabled for draft pull requests in this repository. Workflows must be run manually.

Contributors can view more details about this message here.

[danielfrg]

We agreed to move it the benchmarks to {repo}/benchmarks/{pkg} and that way we can keep the Apache license. I'll move them on my next PR for the benchmarks.

[github-actions]

Doc Preview CI
Preview removed because the pull request was closed or merged.

[rwgk]

Forensics note on this PR

I dug into why toolshed/check_spdx.py on main did not match the state I remembered locally.

The key point is that GitHub restored this PR branch exactly as GitHub last saw it at merge time. The restored branch rwgk:expected_license_identifiers_cont comes back at c719fce, and the PR still shows only the early commits that were present when this PR was merged into a8805e5.

I also recovered a previously local-only branch tip with additional follow-up commits (c656fba, 8b80715, 3f86b82, c31b4fc) that never made it to GitHub, so they were not part of the merged PR.

I pushed that recovered history to rwgk:expected_license_identifiers_cont_recovered for reference. Most likely I either forgot to run git push, or I overlooked an error message when trying to switch branches. Sorry for the accident.

The practical result is that the later work to make the top-level SPDX decisions explicit, handle the mixed-license cuda_bindings/benchmarks case, and fix the remaining license identifiers existed only locally and did not actually land in main through this PR. I will add a note to the PR description, and will follow up separately with the missing changes on top of current main.