Third-Party Code Review

Use this skill when reviewing or generating code that is copied from, adapted from, or substantially based on an external project.

Purpose and scope

Use this skill for licensing, attribution, notices, and repository bookkeeping around third-party-derived code.

Core rule

• Do not add third-party-derived code unless its license allows redistribution and modification compatible with this repository.
• Preserve upstream attribution and required notices.
• Track the imported/adapted component in the repository's third-party inventory.

Request changes when

• third-party-derived code is added without a matching third-party-programs.txt entry;
• a colocated LICENSE file is missing;
• upstream attribution or license text is removed or weakened;
• license compatibility has not been verified for copied or adapted code.

Required actions for new third-party-derived code

• Add or update an entry in third-party-programs.txt.
• Add a colocated LICENSE file in the relevant component or subtree.
• Name the upstream project and author/source in that LICENSE file.
• Include the upstream license text or required notice in that LICENSE file.
• Keep the anomalib-side copyright/SPDX notice pattern when the repository's existing third-party examples do so.

Required actions for updates to existing third-party-derived code

• Preserve existing attribution, SPDX tags, and license text.
• Do not remove or weaken upstream notices.
• Update third-party-programs.txt if the tracked component, source, or licensing metadata changes.

Repo-grounded review anchors

• third-party-programs.txt
• src/**/LICENSE

Review prompts

• Is this code copied or adapted from a third-party source?
• If yes, is there a matching entry in third-party-programs.txt?
• Is there a colocated LICENSE file with upstream attribution and license text?
• Are required notices preserved in modified files and surrounding documentation?
• Has anyone verified that the upstream license is compatible with redistribution in this repository?

Reviewer checklist

• Check whether the code is third-party-derived.
• Check third-party-programs.txt.
• Check the colocated LICENSE file.
• Check attribution and compatibility.