backport of commit 2a4dbc1

.copywrite.hcl

@@ -1,8 +1,8 @@
 schema_version = 1
 
 project {
-  license        = "BUSL-1.1"
-  copyright_year = 2023
+  license        = "MPL-2.0"
+  copyright_year = 2015
 
   # (OPTIONAL) A list of globs that should not have copyright/license headers.
   # Supports doublestar glob patterns for more flexibility in defining which
@@ -11,11 +11,6 @@ project {
     "builtin/credential/aws/pkcs7/**",
     "ui/node_modules/**",
     "enos/modules/k8s_deploy_vault/raft-config.hcl",
-    "plugins/database/postgresql/scram/**",
-    # licensed under MPL - ignoring for now until the copywrite tool can support
-    # multiple licenses per repo.
-    "sdk/**",
-    "api/**",
-    "shamir/**'"
+    "plugins/database/postgresql/scram/**"
   ]
 }

.github/ISSUE_TEMPLATE/config.yml

@@ -1,5 +1,5 @@
 # Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
+# SPDX-License-Identifier: MPL-2.0
 
 contact_links:
   - name: Ask a question

.github/ISSUE_TEMPLATE/plugin-submission.md

@@ -7,7 +7,7 @@ assignees: ''
 
 ---
 
-Please provide details for the plugin to be listed. All fields are required for a submission to be included in the [Vault Integrations](https://developer.hashicorp.com/vault/integrations) page.
+Please provide details for the plugin to be listed. All fields are required for a submission to be included in the [Plugin Portal](https://www.vaultproject.io/docs/plugin-portal) page.
 
 **Plugin Information**
 Name as it would appear listed:

.github/actionlint.yaml

@@ -1,5 +1,5 @@
 # Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
+# SPDX-License-Identifier: MPL-2.0
 
 self-hosted-runner:
   # Labels of self-hosted runner in array of string

.github/actions/set-up-go/action.yml

@@ -1,6 +1,3 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
 ---
 name: Set up Go with a shared module cache
 description: Set up Go with a shared module cache

.github/actions/set-up-gotestsum/action.yml

@@ -1,6 +1,3 @@
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
 ---
 name: Set up gotestsum from Github releases
 description: Set up gotestsum from Github releases

.github/scripts/gh_comment.sh

@@ -1,7 +1,4 @@
 #!/bin/bash
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
 
 set -e
 
@@ -19,8 +16,7 @@ function update_or_create_comment {
                  -H "Accept: application/vnd.github+json" \
                  -H "X-GitHub-Api-Version: 2022-11-28" \
                  --paginate \
-                 /repos/hashicorp/"$REPO"/issues/"$PR_NUMBER"/comments |
-                 jq -r --arg SEARCH_KEY "$SEARCH_KEY" '.[] | select (.body | startswith($SEARCH_KEY)) | .id')
+                 /repos/hashicorp/"$REPO"/issues/"$PR_NUMBER"/comments | jq -r --arg SEARCH_KEY "$SEARCH_KEY" '.[] | select (.body | contains($SEARCH_KEY)) | .id')
 
   if [[ "$comment_id" != "" ]]; then
     # update the comment with the new body

.github/scripts/report_failed_builds.sh

@@ -1,7 +1,4 @@
 #!/bin/bash
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
 
 set -e
 

.github/scripts/report_failed_tests.sh

@@ -1,7 +1,4 @@
 #!/bin/bash
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
 
 set -e
 MAX_TESTS=10

.github/scripts/verify_changes.sh

@@ -1,7 +1,4 @@
 #!/bin/bash
-# Copyright (c) HashiCorp, Inc.
-# SPDX-License-Identifier: BUSL-1.1
-
 #  This script validates if the git diff contains only docs/ui changes
 
 event_type=$1 # GH event type (pull_request)

.github/workflows/build-vault-oss.yml

@@ -83,7 +83,7 @@ jobs:
           version: ${{ inputs.vault-version }}
           maintainer: HashiCorp
           homepage: https://github.com/hashicorp/vault
-          license: BUSL-1.1
+          license: MPL-2.0
           binary: dist/${{ inputs.package-name }}
           deb_depends: openssl
           rpm_depends: openssl

.github/workflows/build.yml

@@ -314,7 +314,7 @@ jobs:
     steps:
       - run: |
           tr -d '\n' <<< '${{ toJSON(needs.*.result) }}' | grep -q -v -E '(failure|cancelled)'
-
+  
   notify-completed-successfully-failures-oss:
     if: ${{ always() && github.repository == 'hashicorp/vault' && needs.completed-successfully.result == 'failure' && (github.ref_name == 'main' || startsWith(github.ref_name, 'release/')) }}
     runs-on: ubuntu-latest

.github/workflows/ci.yml

@@ -119,25 +119,6 @@ jobs:
       enterprise: ${{ needs.setup.outputs.enterprise }}
     secrets: inherit
 
-  test-go-testonly:
-    name: Run Go tests tagged with testonly
-    needs:
-      - setup
-      - verify-changes
-    # Don't run this job for docs/ui only PRs
-    if: |
-      needs.verify-changes.outputs.is_docs_change == 'false' &&
-      needs.verify-changes.outputs.is_ui_change == 'false'
-    uses: ./.github/workflows/test-go.yml
-    with:
-      testonly: true
-      total-runners: 2 # test runners cannot be less than 2
-      go-arch: amd64
-      go-tags: '${{ needs.setup.outputs.go-tags }},deadlock,testonly'
-      runs-on: ${{ needs.setup.outputs.compute-large }}
-      enterprise: ${{ needs.setup.outputs.enterprise }}
-    secrets: inherit
-
   test-go-race:
     name: Run Go tests with data race detection
     needs:
@@ -280,7 +261,7 @@ jobs:
           name: test-results-ui
           path: ui/test-results
         if: success() || failure()
-      - uses: test-summary/action@62bc5c68de2a6a0d02039763b8c754569df99e3f # v2.1
+      - uses: test-summary/action@62bc5c68de2a6a0d02039763b8c754569df99e3f  # TSCCR: no entry for repository "test-summary/action"
         with:
           paths: "ui/test-results/qunit/results.xml"
           show: "fail"
@@ -376,11 +357,7 @@ jobs:
       needs.test-go-fips.result == 'success' ||
       needs.test-go-fips.result == 'failure' ||
       needs.test-go-race.result == 'success' ||
-      needs.test-go-race.result == 'failure') &&
-      (github.repository == 'hashicorp/vault' &&
-      (github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name))
-    # The last check ensures this doesn't run on community-contributed PRs, who
-    # won't have the permissions to run this job.
+      needs.test-go-race.result == 'failure')
     needs:
       - test-go
       - test-go-fips

.github/workflows/code-checker.yml

@@ -43,29 +43,6 @@ jobs:
         # godoc for the function.
       - run: make ci-vet-codechecker
         name: Check custom linters
-      - run: |
-          make bootstrap
-          make protolint
-        name: Protobuf lint
-
-  generate-delta:
-    name: Protobuf generate delta
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
-      - uses: ./.github/actions/set-up-go
-        with:
-          github-token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
-      - name: Check generate delta
-        run: |
-          make bootstrap
-          # Delete all protobuf files first, in case we removed a protobuf file
-          find . -type f -name '*.pb.go' -delete
-          make proto
-          if ! git diff --exit-code; then
-            echo "Protobuf files need regenerating. Run 'make proto' to fix"
-            exit 1
-          fi
 
   format:
     name: Format
@@ -84,15 +61,6 @@ jobs:
             echo "Code has formatting errors. Run 'make fmt' to fix"
             exit 1
           fi
-      - name: Protobuf format
-        run: |
-          make bootstrap
-          echo "Using buf version $(go run github.com/bufbuild/buf/cmd/buf --version)"
-          make protofmt
-          if ! git diff --exit-code; then
-            echo "Protobuf code has formatting errors. Run 'make protofmt' to fix"
-            exit 1
-          fi
 
   semgrep:
     name: Semgrep

.github/workflows/milestone-checker.yml

@@ -15,9 +15,8 @@ on:
 jobs:
   # checks that a milestone entry is present for a PR
   milestone-check:
-    # If there is a `pr/no-milestone` label, or this comes from a fork (community contributor) we ignore this check
-    if: ${{ (github.repository == 'hashicorp/vault' && (github.event.pull_request.head.repo.full_name == github.event.pull_request.base.repo.full_name))
-      && (!contains(github.event.pull_request.labels.*.name, 'pr/no-milestone')) }}
+    # If there is a `pr/no-milestone` label we ignore this check
+    if: "!contains(github.event.pull_request.labels.*.name, 'pr/no-milestone')"
     runs-on: ubuntu-latest
     steps:
       - name: Check milestone

.github/workflows/oss.yml

@@ -68,7 +68,7 @@ jobs:
       - if: github.event.pull_request != null && steps.changes.outputs.ui == 'true'
         run: echo "PROJECT=171" >> "$GITHUB_ENV"
 
-      - uses: actions/add-to-project@31b3f3ccdc584546fc445612dec3f38ff5edb41c # v0.5.0
+      - uses: actions/add-to-project@a9f041ddd462ed185893ea1024cec954f50dbe42 # v0.3.0 # TSCCR: no entry for repository "actions/add-to-project"
         with:
           project-url: https://github.com/orgs/hashicorp/projects/${{ env.PROJECT }}
           github-token: ${{ secrets.TRIAGE_GITHUB_TOKEN }}