license_patrol 1.2.0 → 1.2.1

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: bfadea16931d270ad27f48e5db7d22d95751c39335299a0375b037b192d88925
-  data.tar.gz: acba13bf06366eb312bde648d1aefc653576ff2fa67cae75a2cbddf9d697a84b
+  metadata.gz: b6ab801f8c2ec50887f574cd31ff918dc078b2a3d2a6b733da4d758c4bc9dc9b
+  data.tar.gz: 2b1ea4a322bbf350a0037731c4f9288c05a721a8c2e3b96f50bbeb7ab5fe6e5d
 SHA512:
-  metadata.gz: bd3c0356c36aa7aae5ed0891ce8e4b4baff329fdbbd21f26316f87f13d6de4daf9f4d3b6ed1831f4b1cbac9a7763f0224ef371d9cc2a87abf8ea67e760ad8a10
-  data.tar.gz: ba987bba63a5b6161407ad3fb73c904d15e6d4d2438cf6ce8cfea6e867dfb7435e8cfab1be6c7f2b3c2bb34bd19ff955de05155356d0cff3519c58863f7ac89d
+  metadata.gz: ceabc84d0fb8a6ff14355946086eb3139382ee855d761038378713db056cf2ea99ea32c1cd37f9edb85dd3da3032aad3da1dd198d78768fb8145d758b3016580
+  data.tar.gz: cf939b1b461cedd5fca2470e556d2e183fa635db030698c86c0cbf784f669ba4f79fa92115de740423bc432b3c6081bd6ffb3318fd5d1ca1bc7af0a32a2d78af

data/.github/dependabot.yml

@@ -7,10 +7,16 @@ updates:
     time: "20:00"
     timezone: America/Los_Angeles
   open-pull-requests-limit: 10
-- package-ecosystem: docker 
+  commit-message:
+    prefix: chore
+    include: scope
+- package-ecosystem: docker
   directory: "/"
   schedule:
     interval: daily
     time: "20:00"
     timezone: America/Los_Angeles
   open-pull-requests-limit: 10
+  commit-message:
+    prefix: chore
+    include: scope

data/.github/workflows/license_patrol.yml

@@ -8,6 +8,7 @@ jobs:
     uses: powerhome/github-actions-workflows/.github/workflows/ruby-gem.yml@main
     with:
       package: ${{ github.workflow }}
+      release-tag: false
       ruby: '["3.3"]'
       before_build: .github/workflows/install-test-tools.sh
     secrets: inherit

data/.github/workflows/pr-title.yml

@@ -0,0 +1,21 @@
+# Managed by https://github.com/powerhome/software. Do not make changes here, they will be reverted.
+
+name: PR title
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+
+permissions:
+  pull-requests: read
+
+jobs:
+  pr-title:
+    name: Conventional Commit title
+    runs-on: ubuntu-latest
+    steps:
+      # The repository squash-merges with the PR title as the commit subject,
+      # so the title is what has to be a Conventional Commit.
+      - uses: amannn/action-semantic-pull-request@2252a14e810aa9b85c2d560bd7070c802206ecf6 # v6.1.2
+        env:
+          GITHUB_TOKEN: ${{ github.token }}

data/.github/workflows/release-please.yml

@@ -0,0 +1,42 @@
+name: release-please
+
+# Keeps a release pull request open against master that bumps the gem to the
+# next version, pins it in Gemfile.lock and adds it to CHANGELOG.md, worked out
+# from the Conventional Commit titles merged since the last release. Merging
+# that pull request tags the release vX.Y.Z and creates its GitHub Release, and
+# the tag's push publishes the gem. See release/instructions.md.
+#
+# It runs as the release GitHub App, not GITHUB_TOKEN: a pull request or tag
+# GITHUB_TOKEN creates starts no workflows, so the release pull request would
+# never get its required checks and the tag would never publish the gem. The
+# App's key is in the release environment, which only master can deploy to, so
+# no run from another branch or a tag can read it.
+
+on:
+  push:
+    branches: [master]
+
+permissions: {}
+
+concurrency:
+  group: ${{ github.workflow }}
+  cancel-in-progress: false
+
+jobs:
+  release-please:
+    name: Release pull request
+    runs-on: ubuntu-latest
+    environment: release
+    steps:
+      - name: Create GitHub App token
+        id: app-token
+        uses: actions/create-github-app-token@64ab729a6294000f5aa4a4bc0b73d1f32bc45510 # v3.3.0
+        with:
+          client-id: ${{ vars.RELEASE_APP_CLIENT_ID }}
+          private-key: ${{ secrets.RELEASE_APP_PRIVATE_KEY }}
+          permission-contents: write
+          permission-pull-requests: write
+      - name: Open or update the release pull request, or tag a merged one
+        uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
+        with:
+          token: ${{ steps.app-token.outputs.token }}

data/.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "1.2.1"
+}

data/.rubocop.yml

@@ -1,5 +1,5 @@
 AllCops:
-  TargetRubyVersion: 2.6.0
+  TargetRubyVersion: 3.0
   Exclude:
     - 'lib/license_patrol/reports/**/*'
     - 'features/fixtures/**/*'

data/CHANGELOG.md

@@ -1,4 +1,18 @@
-# [1.2.0] / 2026-10-28
+# Changelog
+
+Notable changes to LicensePatrol are documented in this file. After 1.2.0,
+release-please writes each release's entry from the Conventional Commit titles
+of its pull requests; see [release/instructions.md](release/instructions.md).
+Entries before 1.0.0 are LicenseFinder's history.
+
+## [1.2.1](https://github.com/powerhome/license_patrol/compare/v1.2.0...v1.2.1) (2026-11-12)
+
+
+### Fixed
+
+* **deps:** Require rubyzip 3.4 to patch path traversal ([#11](https://github.com/powerhome/license_patrol/issues/11)) ([81e2049](https://github.com/powerhome/license_patrol/commit/81e20497365375ff8401279581f8fbd401ba5e35))
+
+## [1.2.0] / 2026-10-28
 
 ### Fixed
 * Yarn 2, 3 and 4 projects scan without the third-party licenses plugin, reading packages from the built-in `yarn info` - [6a46a083](https://github.com/powerhome/license_patrol/commit/6a46a083) - Carlos Palhares
@@ -6,18 +20,18 @@
 ### Changed
 * Yarn 2+ no longer reports workspaces as packages, and `--prepare` only runs `yarn install` - [6a46a083](https://github.com/powerhome/license_patrol/commit/6a46a083) - Carlos Palhares
 
-# [1.1.0] / 2026-10-21
+## [1.1.0] / 2026-10-21
 
 ### Added
 * `bundler_gemfiles` option to scan many gemfiles, such as Appraisal's `gemfiles/*.gemfile`, in one run - [5d7e1372](https://github.com/powerhome/license_patrol/commit/5d7e1372) - Carlos Palhares
 
-# [1.0.0] / 2026-10-21
+## [1.0.0] / 2026-10-21
 
 First release as `license_patrol`, forked from LicenseFinder 7.2.1. Earlier entries are LicenseFinder's history.
 
-# [7.2.1] / 2024-05-08
+## [7.2.1] / 2024-05-08
 
-# [7.2.0] / 2024-05-07
+## [7.2.0] / 2024-05-07
 
 ### Added
 * Support for Ruby 3.3.x - [3bbe12f7](https://github.com/pivotal/LicenseFinder/commit/3bbe12f76d5305879df89d856d90f0b9eaf967d4)
@@ -43,7 +57,7 @@ First release as `license_patrol`, forked from LicenseFinder 7.2.1. Earlier entr
 * Remove Ruby 2.6 tests- [c48ddb74](https://github.com/pivotal/LicenseFinder/commit/c48ddb745bb85971fc14e21d2c3c308c849ef2a3)
 * Remove Dep package manager for jammy release - [42bed10d](https://github.com/pivotal/LicenseFinder/commit/42bed10d80e4b0e6fac1c62dd5eca2097ffc3517) 
 
-# [7.1.0] / 2022-11-28
+## [7.1.0] / 2022-11-28
 
 ### Added
 * Missing New BSD alternative name - [64d425d9](https://github.com/pivotal/LicenseFinder/commit/64d425d9210794c6b45c60bf730931e459a1e959) 
@@ -62,13 +76,13 @@ First release as `license_patrol`, forked from LicenseFinder 7.2.1. Earlier entr
 ### Changed
 * - Bump docker image golang version to 1.17.13 - [4f3df246](https://github.com/pivotal/LicenseFinder/commit/4f3df246d2f5245681a943a6fb6dee49e3ed3ed1) 
 
-# [7.0.1] / 2022-03-18
+## [7.0.1] / 2022-03-18
 ### Fixed
 * Maven Wrapper command path must be relative to working directory - [298a733a](https://github.com/pivotal/LicenseFinder/commit/298a733a67f34341ffabc7dfbf2ee5c27574b979) - jbmgrtn 
 * Support yarn license command for yarn v2+ - [ed3b319b](https://github.com/pivotal/LicenseFinder/commit/ed3b319b64bf9c72c12fd5a365952137cf7f33b6)
 
 
-# [7.0.0] / 2022-03-04
+## [7.0.0] / 2022-03-04
 
 ### Added
 * Ruby 3.x Support - [02497dfb](https://github.com/pivotal/LicenseFinder/commit/02497dfb60d458e51a43ef26568389b5fcf302af)
@@ -83,7 +97,7 @@ First release as `license_patrol`, forked from LicenseFinder 7.2.1. Earlier entr
 ### Deprecated
 * Remove support for Ruby 2.3 - [02497dfb](https://github.com/pivotal/LicenseFinder/commit/02497dfb60d458e51a43ef26568389b5fcf302af)
 
-# [6.15.0] / 2021-12-17
+## [6.15.0] / 2021-12-17
 
 ### Added
 * Add Yarn2 support - [7f08790c](https://github.com/pivotal/LicenseFinder/commit/7f08790ce1d7cd12ccd0aa9de114ca3366ab408c)
@@ -94,12 +108,12 @@ First release as `license_patrol`, forked from LicenseFinder 7.2.1. Earlier entr
 ### Fixed
 * Fix docker Conan and swift - [66031df9](https://github.com/pivotal/LicenseFinder/commit/66031df912c2e1e21aa794a4b897fc61c9ec6b02) 
 
-# [6.14.2] / 2021-10-27
+## [6.14.2] / 2021-10-27
 
 ### Added
 * Zlib License - [0f004b52](https://github.com/pivotal/LicenseFinder/commit/0f004b528d436b4d53db8bd373ede0594c07d9e8) - blooper05
 
-# [6.14.1] / 2021-06-25
+## [6.14.1] / 2021-06-25
 
 First two commit were supposed to show up in v6.14.0, but GPG bug prevented a correct build. Therefore, a follow up patch build was made to include the GPG fix.
 
@@ -117,46 +131,46 @@ First two commit were supposed to show up in v6.14.0, but GPG bug prevented a co
   Thanks to Joern Schneeweisz Staff Security Engineer, Security Research | GitLab for raising the issue
 
 
-# [6.13.0] / 2021-04-27
+## [6.13.0] / 2021-04-27
 
 ### Fixed
 * Ignore packages with nil modules - [4eca0ec1](https://github.com/pivotal/LicenseFinder/commit/4eca0ec15dc6266afa48b74b3742278351246eb8) 
 
-# [6.12.2] / 2021-04-14
+## [6.12.2] / 2021-04-14
 
 ### Changed
 * exit when go mod list command fails - [fcf1f707](https://github.com/pivotal/LicenseFinder/commit/fcf1f7076dee2ff730e3c8b608381aca22de0e92) - Jeff Jun
 
-# [6.12.1] / 2021-04-12
+## [6.12.1] / 2021-04-12
 
-# [6.12.0] / 2021-03-05
+## [6.12.0] / 2021-03-05
 
 ### Added
 * Provide homepage information for GoDep and Go15Vendor package managers - [bae1bda9](https://github.com/pivotal/LicenseFinder/commit/bae1bda9d76cb922405d7efca9c67e2583db70d4) - Jeff Jun
 
-# [6.11.0] / 2021-03-04
+## [6.11.0] / 2021-03-04
 
 ### Added
 * Add homepage for go_modules package manager - [912394a8](https://github.com/pivotal/LicenseFinder/commit/912394a8a6ab4c31b6918a21da9f37d5b368ed6b) 
 
-# [6.10.1] / 2021-01-08
+## [6.10.1] / 2021-01-08
 
-# [6.10.0] / 2020-11-27
+## [6.10.0] / 2020-11-27
 
-# [6.9.0] / 2020-10-05
+## [6.9.0] / 2020-10-05
 
 ### Changed
 * to recognize permitted licenses with AND in the name [#173997648] - [eab14250](https://github.com/pivotal/LicenseFinder/commit/eab14250d188153f8c2b0b5c0191fec19bcddf55) - Raymond Lee
 
-# [6.8.2] / 2020-09-08
+## [6.8.2] / 2020-09-08
 
-# [6.8.1] / 2020-08-13
+## [6.8.1] / 2020-08-13
 
-# [6.8.0] / 2020-08-06
+## [6.8.0] / 2020-08-06
 
-# [6.7.0] / 2020-07-23
+## [6.7.0] / 2020-07-23
 
-# [6.6.2] / 2020-07-09
+## [6.6.2] / 2020-07-09
 
 ### Added
 * support for rebar3 - [b20e7444](https://github.com/pivotal/LicenseFinder/commit/b20e7444c147d8dbfa46eb4e8e549e03be751e02) - Jeff Jun
@@ -173,16 +187,16 @@ First two commit were supposed to show up in v6.14.0, but GPG bug prevented a co
 * support for rebar2 [#173637980] - [b20e7444](https://github.com/pivotal/LicenseFinder/commit/b20e7444c147d8dbfa46eb4e8e549e03be751e02) - Jeff Jun
 * Removed the unnecessary prepare command for Go modules - [284cc5c8](https://github.com/pivotal/LicenseFinder/commit/284cc5c821270a6e56275e32bac836a3e451f46b)
 
-# [6.6.1] / 2020-06-30
+## [6.6.1] / 2020-06-30
 
 ### Changed
 * Handle multiple solution files for nuget [#173021333] - [040d9559](https://github.com/pivotal/LicenseFinder/commit/040d9559a4bda07490255cc34c1a7891081bc511) 
 * matches license names from pypi api call with known licenses to avoid returning misformatted licenses [#173421573] - [6b96d746](https://github.com/pivotal/LicenseFinder/commit/6b96d74600034abcacee6ed2b322aa3abfaa0992) - Jeff Jun
 * Update Nuget Package Manager prepare command - [6ac07066](https://github.com/pivotal/LicenseFinder/commit/6ac070668955bc034da1647658440ce5bb0d9bd2) - Jason Smith
 
-# [6.6.0] / 2020-06-22
+## [6.6.0] / 2020-06-22
 
-# [6.5.0] / 2020-06-01
+## [6.5.0] / 2020-06-01
 
 ### Added
 * Support legacy nuget projects [#172950097] - [0cccbcf9](https://github.com/pivotal/LicenseFinder/commit/0cccbcf9aa92f4297ef0174242bdb19da1babc65) 
@@ -190,7 +204,7 @@ First two commit were supposed to show up in v6.14.0, but GPG bug prevented a co
 ### Changed
 * Upgrade to golang 1.14.3. Update dotnet-sdk to 3.1 - [0969e98f](https://github.com/pivotal/LicenseFinder/commit/0969e98fde4a82f8931601baa4dd96dc01300a14) 
 
-# [6.4.0] / 2020-05-22
+## [6.4.0] / 2020-05-22
 
 Big shout out to @forelabs for introducing many new features and improvements for this release. Thanks again!!
 
@@ -212,7 +226,7 @@ Big shout out to @forelabs for introducing many new features and improvements fo
 * Significantly improve the license text matching file to be more dynamic - [acf5705](https://github.com/pivotal/LicenseFinder/commit/acf570573b4a2414d9c43212dea5d4ecb157319e)
 * Update Ruby version to 2.7.1 [#172295831] - [475e2948](https://github.com/pivotal/LicenseFinder/commit/475e2948ec1ad859aee59e77aa9ce2a51e1a5029) 
 
-# [6.3.0] / 2020-05-06
+## [6.3.0] / 2020-05-06
 
 ### Added
 * OFL License - [d475bbb1](https://github.com/pivotal/LicenseFinder/commit/d475bbb1380e217f154f262caaa73c12f5b9792b) - Sven Dunemann
@@ -229,7 +243,7 @@ Big shout out to @forelabs for introducing many new features and improvements fo
 * GoModules: fix compute with vendor mod - [067eb19](https://github.com/pivotal/LicenseFinder/commit/067eb1916ce024039631bdbd4114ababa6c02c3a) - forelabs
 * Do not set Bundle path. Bundler will figure it out. - [6319a7a](https://github.com/pivotal/LicenseFinder/commit/6319a7a281bd9cc997c08c903674ab51fcc6545e) - mvz
 
-# [6.2.0] / 2020-04-07
+## [6.2.0] / 2020-04-07
 
 ### Fixed
 * Break dependency of specs on released license_finder gem - [ef69fa00](https://github.com/pivotal/LicenseFinder/commit/ef69fa00deb7a8f8ebd74312afa9f130be2d9fda) - Matijs van Zuijlen
@@ -239,9 +253,9 @@ Big shout out to @forelabs for introducing many new features and improvements fo
 * Run glide install in folder containing glide.lock - [cec3ff47](https://github.com/pivotal/LicenseFinder/commit/cec3ff4759f1c06df2cd0c39ac8004fcd156a6e6) - Jeff Jun
 * specify path for bundle install [#168042947] - [431355dc](https://github.com/pivotal/LicenseFinder/commit/431355dc1d0172c65444d2f4bcb5b4416fc52af7) 
 
-# [6.1.2] / 2020-03-16
+## [6.1.2] / 2020-03-16
 
-# [6.1.0] / 2020-02-21
+## [6.1.0] / 2020-02-21
 
 ### Fixed
 * Testing dsl now correctly creates gem project - [6158d767](https://github.com/pivotal/LicenseFinder/commit/6158d76758f4232f3efd652729a83aa632a67dee) - Jeff Jun
@@ -250,7 +264,7 @@ Big shout out to @forelabs for introducing many new features and improvements fo
 * Upgrade golang version to 1.13.3 - [51ecbcbc](https://github.com/pivotal/LicenseFinder/commit/51ecbcbc7992366c1baed2e8b805a7f820f70160) 
 * Uses correct package management command for pip based on options that are passed in - [3f4034ab](https://github.com/pivotal/LicenseFinder/commit/3f4034ab3479da23088174ad8cf56828b3cda9ad) 
 
-# [6.0.0] / 2020-01-22
+## [6.0.0] / 2020-01-22
 
 ### Added
 * License Finder now recognizes pip requirement markers - [99fbc184](https://github.com/pivotal/LicenseFinder/commit/99fbc18463ef45f920ad506a72dc0b3a93d0f5bf) - Jason Smith
@@ -277,7 +291,7 @@ Big shout out to @forelabs for introducing many new features and improvements fo
 ### Deprecated
 * Remove support for jruby 9.1* [#169590215] - [81e75f8c](https://github.com/pivotal/LicenseFinder/commit/81e75f8cd61ca35e30562352dee2579b1b6c991e) 
 
-# [5.11.1] / 2019-11-05
+## [5.11.1] / 2019-11-05
 
 ### Fixed
 * Crash when gradle runs with project roots recursive [#169465210] - [08e0df85](https://github.com/pivotal/LicenseFinder/commit/08e0df857c7fa4273eb6e2e4a7c01bb46550a91f) 
@@ -286,7 +300,7 @@ Big shout out to @forelabs for introducing many new features and improvements fo
 * Bump docker ruby version to 2.6.5 [#169539985] - [26b6d4b2](https://github.com/pivotal/LicenseFinder/commit/26b6d4b25133fa50dbf92265a20bed2350305245) 
 * Gradle version updated to 5.6.4 - [9e32228f](https://github.com/pivotal/LicenseFinder/commit/9e32228fae3dacae38e7827946a0e0412a20ccb0) 
 
-# [5.11.0] / 2019-10-24
+## [5.11.0] / 2019-10-24
 
 ### Fixed
 * Fix crash in LF for null deps in godep - [aec335e5](https://github.com/pivotal/LicenseFinder/commit/aec335e574b65c1e9927787e88fb95f1296cdd26) 
@@ -295,30 +309,30 @@ Big shout out to @forelabs for introducing many new features and improvements fo
 * Exclude Gradle subprojects from project roots - [4efea4c8](https://github.com/pivotal/LicenseFinder/commit/4efea4c8892f48c24ed6ec46a4be85cb06dc6672) - Jason Smith
 * project_roots will skip maven subprojects - [61b88513](https://github.com/pivotal/LicenseFinder/commit/61b885135bd02cf2b5c6be4bc1fba85020d42f6a) - Peter Tran
 
-# [5.10.2] / 2019-09-03
+## [5.10.2] / 2019-09-03
 
 ### Added
 * Added bzr app to image - [8fd43f01](https://github.com/pivotal/LicenseFinder/commit/8fd43f01a5de575596c92bcfc38a5e9ba7bf6b3d) 
 
-# [5.10.1] / 2019-08-28
+## [5.10.1] / 2019-08-28
 
 ### Fixed
 * Mix bailing early when elixir is not installed - [13b120e](https://github.com/pivotal/LicenseFinder/commit/13b120ed7c121243be987f449cc29d00ec6e6450) 
 
-# [5.10.0] / 2019-08-26
+## [5.10.0] / 2019-08-26
 
 ### Changed
 * Dotnet projects only detected if csproj is at root level - [b9f810d](https://github.com/pivotal/LicenseFinder/commit/b9f810d96f92f458fcfe4855307fdddfb7f1082b) 
 * sha for composer-setup.php - [64b782a](https://github.com/pivotal/LicenseFinder/commit/64b782a137a287980a317fcb48f595b6e93f85d0) - Debbie Chen
 
-# [5.9.2] / 2019-07-02
+## [5.9.2] / 2019-07-02
 
 ### Changed
 * Bump ruby version to 2.6.3 - [dcdcc1c](https://github.com/pivotal/LicenseFinder/commit/dcdcc1c3e4fd29ec4d180a54fb67b2aa07e932de) 
 
-# [5.9.1] / 2019-06-10
+## [5.9.1] / 2019-06-10
 
-# [5.9.0] / 2019-06-10
+## [5.9.0] / 2019-06-10
 
 ### Added
 * composer PHP support - [c671309](https://github.com/pivotal/LicenseFinder/commit/c671309d89c54a4dfac3ac40aab1bf70e3c3f6a2) 
@@ -332,7 +346,7 @@ Big shout out to @forelabs for introducing many new features and improvements fo
 ### Changed
 * Fix license definition tests - [15b524f](https://github.com/pivotal/LicenseFinder/commit/15b524fa52f63e04a82d160a7fc3d49c288d01e8) 
 
-# [5.8.0] / 2019-05-22
+## [5.8.0] / 2019-05-22
 
 ### Added
 * Trash Package Manager - [3a3d854](https://github.com/pivotal/LicenseFinder/commit/3a3d8541c4ea64607df6b120111aff324f93778d) 
@@ -340,9 +354,9 @@ Big shout out to @forelabs for introducing many new features and improvements fo
 ### Fixed
 * Prefer to use `origin` over `path` for govendor - [31c6041](https://github.com/pivotal/LicenseFinder/commit/31c6041926a27b61c35c05c6433a87d0af78c1e5) 
 
-# [5.7.1] / 2019-03-08
+## [5.7.1] / 2019-03-08
 
-# [5.7.0] / 2019-03-01
+## [5.7.0] / 2019-03-01
 
 ### Added
 * Ruby 2.6.1 support - [8d60ed1](https://github.com/pivotal/LicenseFinder/commit/8d60ed13f99b830cc1352900f90e2b298105f518) 
@@ -350,14 +364,14 @@ Big shout out to @forelabs for introducing many new features and improvements fo
 ### Changed
 * Conan version is locked to 1.11.2 to avoid breaking changes - [72b766a](https://github.com/pivotal/LicenseFinder/commit/72b766a948be5b0f8eade75e716796f50ea9ebf3) 
 
-# [5.6.2] / 2019-01-28
+## [5.6.2] / 2019-01-28
 
-# [5.6.1] / 2019-01-25
+## [5.6.1] / 2019-01-25
 
 ### Changed
 * Updated GOLANG to 1.11.4 in Docker image [#163424880] - [67e5e1f](https://github.com/pivotal/LicenseFinder/commit/67e5e1ffef19acf3a63cac55c5aa3626fb4c7491)
 
-# [5.6.0] / 2018-12-19
+## [5.6.0] / 2018-12-19
 
 ### Added
 * Add support for JSON reports [#161595251] - [5a1f735](https://github.com/pivotal/LicenseFinder/commit/5a1f73515c83cbf8ce17275c4c9d1af43d0db772) 
@@ -376,12 +390,12 @@ Revert "* Go modules reports incorrect install paths" - [fcead98](https://github
 ### Changed
 * Updated go-lang to 1.11.2 in the Docker - [d720f9c](https://github.com/pivotal/LicenseFinder/commit/d720f9c16f82044b5024213bec41b8e9f34cf306) 
 
-# [5.5.2] / 2018-10-17
+## [5.5.2] / 2018-10-17
 
 ### Fixed
 * go mod prepare command being incorrect - [480c465](https://github.com/pivotal/LicenseFinder/commit/480c4654cde7342456318ed4e28b6cebd4a09e4b) 
 
-# [5.5.1] / 2018-10-16
+## [5.5.1] / 2018-10-16
 
 ### Added
 * Documentation for asterisks being added to license names [#158960018] - [154b727](https://github.com/pivotal/LicenseFinder/commit/154b7273b1c18e64afa48799b50588251f99e982) 
@@ -390,7 +404,7 @@ Revert "* Go modules reports incorrect install paths" - [fcead98](https://github
 ### Fixed
 * Go modules are forced to be enabled on go mod package managers - [cf9123d](https://github.com/pivotal/LicenseFinder/commit/cf9123d654b98cdef872d3b21631e69960abe365) 
 
-# [5.5.0] / 2018-10-11
+## [5.5.0] / 2018-10-11
 
 ### Added
 * Go Module support - [8a20210](https://github.com/pivotal/LicenseFinder/commit/8a202109e942316434978befd33854aa985dd872)
@@ -407,13 +421,13 @@ Revert "* Go modules reports incorrect install paths" - [fcead98](https://github
 * dlf gemfile directory issues [#160758436 finish] - [2db3972](https://github.com/pivotal/LicenseFinder/commit/2db397261654bca89771e85984b4ae6819274e55) 
 Revert "* dlf gemfile directory issues [#160758436 finish]" - [6b17ddc](https://github.com/pivotal/LicenseFinder/commit/6b17ddc4202518ffd167c8d38a2045a36eb00144) 
 
-# [5.4.1] / 2018-09-18
+## [5.4.1] / 2018-09-18
 
 ### Fixed
 * Extra dependencies showing up for some go projects [#160438065] - [dfb1367](https://github.com/pivotal/LicenseFinder/commit/dfb136724721843c1196e74a6b4c762538af62ba) 
 * remove workspace-aggregator as a yarn dependency [#159612717 finish] - [4e0afd0](https://github.com/pivotal/LicenseFinder/commit/4e0afd0ba79623f5bb4c055d42a76ba77ce1c785) 
 
-# [5.4.0] / 2018-08-20
+## [5.4.0] / 2018-08-20
 
 ### Added
 * NuGet + mono installation to Dockerfile
@@ -422,7 +436,7 @@ Revert "* dlf gemfile directory issues [#160758436 finish]" - [6b17ddc](https://
 ### Changed
 * Upgrades Dockerfile base to Xenial
 
-# [5.3.0] / 2018-06-05
+## [5.3.0] / 2018-06-05
 
 ### Added
 * Experimental support for Rust dependencies with Cargo - [2ef3129](https://github.com/pivotal/LicenseFinder/commit/2ef31290f7abf51db5b7173302d1e535508bbd7a)
@@ -431,19 +445,19 @@ Revert "* dlf gemfile directory issues [#160758436 finish]" - [6b17ddc](https://
 ### Removed
 * Remove HTTParty dependency - [c52d014](https://github.com/pivotal/LicenseFinder/commit/c52d014df1ca9cd3838d03c60daa6fad954c5579) 
 
-# [5.2.3] / 2018-05-14
+## [5.2.3] / 2018-05-14
 
-# [5.2.1] / 2018-05-14
+## [5.2.1] / 2018-05-14
 
 ### Changed
 * Updated go-lang to 1.10.2 in the Docker * Updated Maven to 3.5.3 in the Docker - [1decf6a](https://github.com/pivotal/LicenseFinder/commit/1decf6ad27c9edf96b4f5cccd9a7ca0955fed9f2) - Mark Fioravanti
 
-# [5.2.0] / 2018-05-09
+## [5.2.0] / 2018-05-09
 
 ### Fixed
 * Support for pip 10.0.1 - [286f679](https://github.com/pivotal/LicenseFinder/commit/286f6790dc71c97c0e93ecdfe0c6fddad75165cc)
 
-# [5.1.1] / 2018-05-08
+## [5.1.1] / 2018-05-08
 
 ### Added
 * CC License detection
@@ -453,7 +467,7 @@ Revert "* dlf gemfile directory issues [#160758436 finish]" - [6b17ddc](https://
 * in_umbrella: true dependencies for Mix
 * Pivotal Repo Renamed to pivotal
 
-# [5.1.0] / 2018-04-02
+## [5.1.0] / 2018-04-02
 
 ### Added
 * Support for Ruby 2.5.1 - [9c82a84](https://github.com/pivotal/LicenseFinder/commit/9c82a84a3cff0765a45fa28dc2b05ab32880fb00) 
@@ -469,13 +483,13 @@ Revert "* dlf gemfile directory issues [#160758436 finish]" - [6b17ddc](https://
 * Support for Ruby 2.2 
 * Support for jruby - [9c82a84](https://github.com/pivotal/LicenseFinder/commit/9c82a84a3cff0765a45fa28dc2b05ab32880fb00) 
 
-# [5.0.3] / 2018-02-13
+## [5.0.3] / 2018-02-13
 
 ### Changed
 * Add the -vendor-only flag to dep-ensure calls - [e305bd1](https://github.com/pivotal/LicenseFinder/commit/e305bd1d5b2d9653f828c3940b59a12903904699) 
 * Update detected paths for Nuget - [3fe8995](https://github.com/pivotal/LicenseFinder/commit/3fe89955d82c3467628abbd2ca9ba159bfeb7df6)
 
-# [5.0.2] / 2018-02-06
+## [5.0.2] / 2018-02-06
 
 ### Fixed
 * Add conditional production flag to npm - [533f9b8](https://github.com/pivotal/LicenseFinder/commit/533f9b8fda250655f3613444da49fdce60215237) 
@@ -485,7 +499,7 @@ Revert "* dlf gemfile directory issues [#160758436 finish]" - [6b17ddc](https://
 
 * Fix yarn not working with --project_path option - [c6ed08d](https://github.com/pivotal/LicenseFinder/commit/c6ed08dd8342dec9fcc3e6377f88d5ef01600928) 
 
-# [5.0.0] / 2018-01-15
+## [5.0.0] / 2018-01-15
 
 ### Added
 * NPM prepare - [e7a0d30](https://github.com/pivotal/LicenseFinder/commit/e7a0d30cb77e5503b5a934b26dbd3dc272dc5605) 
@@ -501,20 +515,20 @@ Revert "* dlf gemfile directory issues [#160758436 finish]" - [6b17ddc](https://
 ### Changed
 * Package Manager will now log if prepare step fails. Instead of erroring out - [54da71e](https://github.com/pivotal/LicenseFinder/commit/54da71e98f14cd199c39dfd7b762030fcac60ccb) 
 
-# [4.0.2] / 2017-11-16
+## [4.0.2] / 2017-11-16
 
 ### Fixed
 
 * Fixed --quiet not being available on the report task
 * Fixed --recursive not being available on the action_items task
 
-# [4.0.1] / 2017-11-14
+## [4.0.1] / 2017-11-14
 
 ### Fixed
 
 * Add missing toml dependency to gemspec
 
-# [4.0.0] / 2017-11-10
+## [4.0.0] / 2017-11-10
 
 ### Changed
 
@@ -525,7 +539,7 @@ Revert "* dlf gemfile directory issues [#160758436 finish]" - [6b17ddc](https://
 
 * Fixed issue where dangling symbolic link would cause License Finder to crash and not continue. Instead, License Finder will now warn about the issue and continue.
 
-# [3.1.0] / 2017-11-10
+## [3.1.0] / 2017-11-10
 
 ### Added
 
@@ -550,7 +564,7 @@ Revert "* dlf gemfile directory issues [#160758436 finish]" - [6b17ddc](https://
 * `build-essential` was added back into the Dockerfile after accidentally being removed
 * Ignore leading prefixes such as 'The' when looking for licenses
 
-# [3.0.4] / 2017-09-14
+## [3.0.4] / 2017-09-14
 
 ### Added
 * Added concourse pipeline file for Docker image process (#335, #337)
@@ -560,9 +574,9 @@ Revert "* dlf gemfile directory issues [#160758436 finish]" - [6b17ddc](https://
 ### Fixed
 * Fixed NPM stack too deep issue (#327, #329)
 
-# [3.0.3] / Skipped because of accidentally yanking gem
+## [3.0.3] / Skipped because of accidentally yanking gem
 
-# [3.0.2] / 2017-07-27:
+## [3.0.2] / 2017-07-27:
 
 ### Added
 
@@ -574,7 +588,7 @@ Revert "* dlf gemfile directory issues [#160758436 finish]" - [6b17ddc](https://
 * Use different env-var to indicate ruby version for tests (#303)
 * Resolve NPM circular dependencies (#306, #307, #311, #313, #314, #319, #322)
 
-# [3.0.1] / 2017-07-12:
+## [3.0.1] / 2017-07-12:
 
 ### Added
 
@@ -591,7 +605,7 @@ Revert "* dlf gemfile directory issues [#160758436 finish]" - [6b17ddc](https://
 * Fix dockerfile by explicitly using rvm stable (#303)
 * Report multiple versions of the same NPM dependency (#310)
 
-# [3.0.0] / 2016-03-02
+## [3.0.0] / 2016-03-02
 
 ### Added
 
@@ -620,14 +634,14 @@ Revert "* dlf gemfile directory issues [#160758436 finish]" - [6b17ddc](https://
 * Add JSON lib attribute to handle deeply nested JSON (#269. Thanks, @antongurov!)
 * Use the fully qualified name of the license-maven-plugin (#284)
 
-# 2.1.2 / 2016-06-10
+## 2.1.2 / 2016-06-10
 
 Bugfixes:
 
 * NuGet limits its recursive search for .nupkg packages to the `vendor` subdirectory. (#228)
 
 
-# 2.1.1 / 2016-06-09
+## 2.1.1 / 2016-06-09
 
 Features:
 
@@ -639,7 +653,7 @@ Bugfixes:
 * NuGet now correctly chooses a directory with vendored .nupkg packages
 
 
-# 2.1.0 / 2016-04-01
+## 2.1.0 / 2016-04-01
 
 * Features
   * support a `groups` in reports (#210) (Thanks, Jon Wolski!)
@@ -675,21 +689,21 @@ Bugfixes:
   * gradle's use of termcaps avoided (#194)
 
 
-# 2.0.4 / 2015-04-16
+## 2.0.4 / 2015-04-16
 
 * Features
 
   * Allow project path to be set in a command line option (Thanks, @robertclancy!)
 
 
-# 2.0.3 / 2015-03-18
+## 2.0.3 / 2015-03-18
 
 * Bugfixes
 
   * Ignoring subdirectories of a LICENSE directory. (#143) (Thanks, @pmeskers and @yuki24!)
 
 
-# 2.0.2 / 2015-03-14
+## 2.0.2 / 2015-03-14
 
 * Features
 
@@ -705,14 +719,14 @@ Bugfixes:
     distributions, which may include distributions from other projects. #119
 
 
-# 2.0.1 / 2015-03-02
+## 2.0.1 / 2015-03-02
 
 * Features
 
   * Support for rebar projects
 
 
-# 2.0.0 / 2015-03-02
+## 2.0.0 / 2015-03-02
 
 * Features
 
@@ -741,14 +755,14 @@ Bugfixes:
   * `license_finder` does not write anything to the file system, #94, #114, #117
 
 
-# 1.2.1 / unreleased
+## 1.2.1 / unreleased
 
 * Features
 
   * Can list dependencies that were added manually
 
 
-# 1.2 / 2014-11-10
+## 1.2 / 2014-11-10
 
 * Features
 
@@ -759,7 +773,7 @@ Bugfixes:
     packages, dependencies and where each license was discovered.
 
 
-# 1.1.1 / 2014-07-29
+## 1.1.1 / 2014-07-29
 
 * Bugfixes
 
@@ -768,7 +782,7 @@ Bugfixes:
   * Allow license_finder to process incorrectly-defined dependencies.
 
 
-# 1.0.1 / 2014-05-28
+## 1.0.1 / 2014-05-28
 
 * Features
 
@@ -783,14 +797,14 @@ Bugfixes:
   * Dependency reports generate when config is changed through the command line
 
 
-# 1.0.0.1 / 2014-05-23
+## 1.0.0.1 / 2014-05-23
 
 * Bugfixes
 
   * LicenseFinder detects its own license
 
 
-# 1.0.0 / 2014-04-03
+## 1.0.0 / 2014-04-03
 
 * Features
 
@@ -800,14 +814,14 @@ Bugfixes:
     the shell.
 
 
-# 0.9.5.1 / 2014-01-30
+## 0.9.5.1 / 2014-01-30
 
 * Features
 
   * Adds homepage for Bower, NPM, and PIP packages
 
 
-# 0.9.5 / 2014-01-30
+## 0.9.5 / 2014-01-30
 
 * Features
 
@@ -821,7 +835,7 @@ Bugfixes:
   * Clean up directories created during test runs
 
 
-# 0.9.4 / 2014-01-05
+## 0.9.4 / 2014-01-05
 
 * Features
 
@@ -836,7 +850,7 @@ Bugfixes:
   * Use all dependencies by default for npm as bundler does
 
 
-# 0.9.3 / 2013-10-01
+## 0.9.3 / 2013-10-01
 
 * Features
 
@@ -847,7 +861,7 @@ Bugfixes:
   * Fix problem which prevented license finder from running in rails < 3.2
 
 
-# 0.9.2 / 2013-08-17
+## 0.9.2 / 2013-08-17
 
 * Features
 
@@ -858,7 +872,7 @@ Bugfixes:
   * Fix HTML output in firefox
 
 
-# 0.9.1 / 2013-07-30
+## 0.9.1 / 2013-07-30
 
 * Features
 
@@ -877,7 +891,7 @@ Bugfixes:
   * dependencies.txt is now dependencies.csv (It was always a csv in spirit)
 
 
-# 0.9.0 / 2013-07-16
+## 0.9.0 / 2013-07-16
 
 * Features
 
@@ -891,7 +905,7 @@ Bugfixes:
   * Using license_finder in a non-RVM environment now works (Issue #35)
 
 
-# 0.8.2 / 2013-07-09
+## 0.8.2 / 2013-07-09
 
 * Features
 
@@ -907,7 +921,7 @@ Bugfixes:
   * Upgrading from 0.7.2 no longer removes non-gem dependencies (Issue #20)
 
 
-# 0.8.1 / 2013-04-14
+## 0.8.1 / 2013-04-14
 
 * Features
 
@@ -920,7 +934,7 @@ Bugfixes:
   * Fix ruby 1.9.2 support.
 
 
-# 0.8.0 / 2013-04-03
+## 0.8.0 / 2013-04-03
 
 * Features
 
@@ -942,14 +956,14 @@ Bugfixes:
     files.
 
 
-# 0.7.2 / 2013-02-18
+## 0.7.2 / 2013-02-18
 
 * Features
 
   * Dependency cleanup.
 
 
-# 0.7.1 / 2013-02-18
+## 0.7.1 / 2013-02-18
 
 * Features
 
@@ -957,7 +971,7 @@ Bugfixes:
   * Remove README files from data persistence.
 
 
-# 0.7.0 / 2012-09-25
+## 0.7.0 / 2012-09-25
 
 * Features
 
@@ -965,7 +979,7 @@ Bugfixes:
   * Dependencies licenses can be set via CLI.
 
 
-# 0.6.0 / 2012-09-15
+## 0.6.0 / 2012-09-15
 
 * Features
 
@@ -981,7 +995,7 @@ Bugfixes:
   * Fix formatting of `rake license:action_items` output.
 
 
-# 0.5.0 / 2012-09-12
+## 0.5.0 / 2012-09-12
 
 * Features
 
@@ -1000,7 +1014,7 @@ Bugfixes:
   * Better support for non-US word spellings.
 
 
-# 0.4.5 / 2012-09-09
+## 0.4.5 / 2012-09-09
 
 * Features
 

data/CONTRIBUTING.md

@@ -6,7 +6,7 @@
 * Create a feature branch.
 * Make your feature addition or bug fix. Please make sure there is appropriate test coverage.
 * Rebase on top of master.
-* Send a pull request with commit messages tagged with an entry specified here: https://keepachangelog.com/en/1.0.0/.
+* Send a pull request with a [Conventional Commit](https://www.conventionalcommits.org/) title, which release-please turns into the changelog entry. See [release/instructions.md](release/instructions.md).
 
 ## Running Tests
 

data/lib/license_patrol/license/text.rb

@@ -3,21 +3,21 @@
 module LicensePatrol
   class License
     module Text
-      SPACES = /\s+/.freeze
-      QUOTES = /['`"]{1,2}/.freeze
-      YEAR_PLACEHOLDERS = /<year>/.freeze
-      PLACEHOLDERS = /<[^<>]+>/.freeze
-      SPECIAL_SINGLE_QUOTES = /[‘’]/.freeze
-      SPECIAL_DOUBLE_QUOTES = /[“”„«»]/.freeze
-      ALPHABET_ORDERED_LIST = /\\\([a-z]\\\)\\\s/.freeze
+      SPACES = /\s+/
+      QUOTES = /['`"]{1,2}/
+      YEAR_PLACEHOLDERS = /<year>/
+      PLACEHOLDERS = /<[^<>]+>/
+      SPECIAL_SINGLE_QUOTES = /[‘’]/
+      SPECIAL_DOUBLE_QUOTES = /[“”„«»]/
+      ALPHABET_ORDERED_LIST = /\\\([a-z]\\\)\\\s/
       ALPHABET_ORDERED_LIST_OPTIONAL = '(\([a-z]\)\s)?'
-      LIST_BULLETS = /(\d{1,2}\\\.|\\\*|\\-)\\\s/.freeze
+      LIST_BULLETS = /(\d{1,2}\\\.|\\\*|\\-)\\\s/
       LIST_BULLETS_OPTIONAL = '(\d{1,2}.|\*|\-)?\s*'
-      NEWLINE_CHARACTER = /\n+/.freeze
-      QUOTE_COMMENT_CHARACTER = /^\s*>+/.freeze
-      ESCAPED_QUOTES = /\\"/.freeze
-      SPECIAL_CHARACTERS = /§/.freeze
-      SPECIAL_DASHES = /–/.freeze
+      NEWLINE_CHARACTER = /\n+/
+      QUOTE_COMMENT_CHARACTER = /^\s*>+/
+      ESCAPED_QUOTES = /\\"/
+      SPECIAL_CHARACTERS = /§/
+      SPECIAL_DASHES = /–/
 
       def self.normalize_punctuation(text)
         text.dup.force_encoding('UTF-8')

data/lib/license_patrol/package_managers/go_workspace.rb

@@ -8,7 +8,7 @@ module LicensePatrol
 
   class GoWorkspace < PackageManager
     Submodule = Struct.new :install_path, :revision
-    ENVRC_REGEXP = /GOPATH|GO15VENDOREXPERIMENT/.freeze
+    ENVRC_REGEXP = /GOPATH|GO15VENDOREXPERIMENT/
 
     def initialize(options = {})
       super

data/lib/license_patrol/package_utils/license_files.rb

@@ -5,7 +5,7 @@ require 'license_patrol/package_utils/possible_license_file'
 module LicensePatrol
   class LicenseFiles
     CANDIDATE_FILE_NAMES = %w[LICENSE License license LICENCE Licence licence COPYING copying README readme].freeze
-    CANDIDATE_PATH_WILDCARD = "*{#{CANDIDATE_FILE_NAMES.join(',')}}*"
+    CANDIDATE_PATH_WILDCARD = "*{#{CANDIDATE_FILE_NAMES.join(',')}}*".freeze
 
     def self.find(install_path, options = {})
       new(install_path).find(options)

data/lib/license_patrol/package_utils/notice_files.rb

@@ -5,8 +5,8 @@ require 'license_patrol/package_utils/possible_license_file'
 module LicensePatrol
   class NoticeFiles
     CANDIDATE_FILE_NAMES = %w[NOTICE Notice].freeze
-    CANDIDATE_PATH_WILDCARD_STRICT = "{#{CANDIDATE_FILE_NAMES.join(',')}}*"
-    CANDIDATE_PATH_WILDCARD = "*#{CANDIDATE_PATH_WILDCARD_STRICT}"
+    CANDIDATE_PATH_WILDCARD_STRICT = "{#{CANDIDATE_FILE_NAMES.join(',')}}*".freeze
+    CANDIDATE_PATH_WILDCARD = "*#{CANDIDATE_PATH_WILDCARD_STRICT}".freeze
 
     def self.find(install_path, options = {})
       new(install_path).find(options)

data/lib/license_patrol/packages/pip_package.rb

@@ -4,7 +4,7 @@ require 'set'
 
 module LicensePatrol
   class PipPackage < Package
-    LICENSE_FORMAT = /^License.*::\s*(.*)$/.freeze
+    LICENSE_FORMAT = /^License.*::\s*(.*)$/
     INVALID_LICENSES = ['', 'UNKNOWN'].to_set
 
     def self.license_names_from_spec(spec)

data/lib/license_patrol/version.rb

@@ -1,6 +1,5 @@
 # frozen_string_literal: true
 
 module LicensePatrol
-  root    = File.expand_path('../..', __dir__)
-  VERSION = File.read("#{root}/VERSION").strip
+  VERSION = '1.2.1'
 end

data/license_patrol.gemspec

@@ -1,11 +1,11 @@
 # frozen_string_literal: true
 
-version = File.read(File.expand_path('VERSION', __dir__)).strip
+require_relative 'lib/license_patrol/version'
 
 Gem::Specification.new do |s|
-  s.required_ruby_version = '>= 2.6.0'
+  s.required_ruby_version = '>= 3.0.0'
   s.name        = 'license_patrol'
-  s.version     = version
+  s.version     = LicensePatrol::VERSION
 
   s.authors = [
     'Ryan Collins',
@@ -45,7 +45,7 @@ Gem::Specification.new do |s|
 
   s.add_dependency 'bundler'
   s.add_dependency 'csv', '~> 3.2'
-  s.add_dependency 'rubyzip', '>=1', '<3'
+  s.add_dependency 'rubyzip', '>= 3.4', '< 4'
   s.add_dependency 'thor', '~> 1.2'
   s.add_dependency 'tomlrb', '>= 1.3', '< 2.1'
   s.add_dependency 'with_env', '1.1.0'

data/release/instructions.md

@@ -1,8 +1,60 @@
-## Release
+# Release
 
-Releasing involves building a package, tagging its version on github and
-pushing it to http://rubygems.org.
+LicensePatrol follows [Semantic Versioning](https://semver.org/). The version
+lives in `lib/license_patrol/version.rb` (`LicensePatrol::VERSION`).
 
-Like other gems, you can build, tag and release `license_patrol` with `rake
-release`.  You may want to run `rake -T` before releasing to confirm you are
-releasing the correct version.
+Don't change it by hand:
+[release-please](https://github.com/googleapis/release-please) does, along
+with `.release-please-manifest.json`, `Gemfile.lock` and the
+[CHANGELOG](../CHANGELOG.md).
+
+## Pull request titles
+
+Pull requests are squash-merged, so each title becomes the commit on `master`
+that release-please reads. Titles follow
+[Conventional Commits](https://www.conventionalcommits.org/), and the
+required `Conventional Commit title` check enforces it:
+
+| Title                                                              | Release | In the changelog |
+| ------------------------------------------------------------------ | ------- | ---------------- |
+| `feat: …`                                                          | minor   | Added            |
+| `fix: …`                                                           | patch   | Fixed            |
+| `perf: …`                                                          | patch   | Changed          |
+| `feat!: …`, or a `BREAKING CHANGE:` footer                         | major   | ⚠ BREAKING CHANGES |
+| `docs:`, `refactor:`, `test:`, `build:`, `ci:`, `chore:`, `style:` | none    | no               |
+
+The summary after the colon is the changelog line, so write it for the
+people who use the gem.
+
+## Releasing
+
+1. Every push to `master` makes the `release-please` workflow open or update
+   a release pull request. It bumps the version, pins it in `Gemfile.lock`,
+   and adds the release's changelog entry.
+2. Review the pull request and merge it when you want to release. To release
+   a different version than the one it proposes, merge a commit to `master`
+   with a `Release-As: 2.0.0` footer first.
+3. Merging it tags the commit `vMAJOR.MINOR.PATCH` and creates the GitHub
+   Release. The tag runs the `license_patrol` workflow, which publishes the
+   gem to RubyGems.
+
+If publishing fails, publish the gem by hand from the tag:
+
+```sh
+git checkout vMAJOR.MINOR.PATCH
+bundle exec rake build release:rubygem_push
+```
+
+## Credentials
+
+- The `release-please` workflow acts as a GitHub App, because pull requests
+  and tags made with the workflow's own `GITHUB_TOKEN` don't start other
+  workflows: the release pull request's required checks would never run, and
+  the tag would never publish the gem. The app needs read and write access to
+  contents and pull requests on this repository. Its `RELEASE_APP_CLIENT_ID`
+  variable and `RELEASE_APP_PRIVATE_KEY` secret live in the `release`
+  environment, which only `master` can deploy to, so no run from another
+  branch or a tag can read the key. Never add them as repository secrets or
+  variables.
+- The `license_patrol` workflow publishes the gem with the `RUBYGEMS_API_KEY`
+  secret.

data/release-please-config.json

@@ -0,0 +1,25 @@
+{
+  "$schema": "https://raw.githubusercontent.com/googleapis/release-please/main/schemas/config.json",
+  "include-component-in-tag": false,
+  "last-release-sha": "b95e9c438ee6bef949a938c38a0db2a99b4972c9",
+  "packages": {
+    ".": {
+      "release-type": "ruby",
+      "package-name": "license_patrol",
+      "version-file": "lib/license_patrol/version.rb",
+      "changelog-sections": [
+        { "type": "feat", "section": "Added" },
+        { "type": "fix", "section": "Fixed" },
+        { "type": "perf", "section": "Changed" },
+        { "type": "revert", "section": "Reverted" },
+        { "type": "docs", "section": "Documentation", "hidden": true },
+        { "type": "refactor", "section": "Refactoring", "hidden": true },
+        { "type": "test", "section": "Tests", "hidden": true },
+        { "type": "build", "section": "Build", "hidden": true },
+        { "type": "ci", "section": "CI", "hidden": true },
+        { "type": "style", "section": "Style", "hidden": true },
+        { "type": "chore", "section": "Chores", "hidden": true }
+      ]
+    }
+  }
+}

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: license_patrol
 version: !ruby/object:Gem::Version
-  version: 1.2.0
+  version: 1.2.1
 platform: ruby
 authors:
 - Ryan Collins
@@ -62,20 +62,20 @@ dependencies:
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '1'
+        version: '3.4'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '3'
+        version: '4'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - ">="
       - !ruby/object:Gem::Version
-        version: '1'
+        version: '3.4'
     - - "<"
       - !ruby/object:Gem::Version
-        version: '3'
+        version: '4'
 - !ruby/object:Gem::Dependency
   name: thor
   requirement: !ruby/object:Gem::Requirement
@@ -400,9 +400,12 @@ files:
 - ".github/dependabot.yml"
 - ".github/workflows/install-test-tools.sh"
 - ".github/workflows/license_patrol.yml"
+- ".github/workflows/pr-title.yml"
+- ".github/workflows/release-please.yml"
 - ".github/workflows/stale.yml"
 - ".gitignore"
 - ".pre-commit-hooks.yaml"
+- ".release-please-manifest.json"
 - ".rspec"
 - ".rubocop.yml"
 - CHANGELOG.md
@@ -413,7 +416,6 @@ files:
 - README.md
 - Rakefile
 - TODO.md
-- VERSION
 - bin/license_patrol
 - bin/license_patrol_pip.py
 - ci/pipelines/pull-request.yml.erb
@@ -591,6 +593,7 @@ files:
 - lib/license_patrol/shared_helpers/common_path.rb
 - lib/license_patrol/version.rb
 - license_patrol.gemspec
+- release-please-config.json
 - release/instructions.md
 - swift-all-keys.asc
 homepage: https://github.com/powerhome/license_patrol
@@ -604,7 +607,7 @@ required_ruby_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="
     - !ruby/object:Gem::Version
-      version: 2.6.0
+      version: 3.0.0
 required_rubygems_version: !ruby/object:Gem::Requirement
   requirements:
   - - ">="

data/VERSION

@@ -1 +0,0 @@
-1.2.0