feat: auto-generate distribution LICENSE files and normalize license names to SPDX identifiers

[xuxiaowei-com-cn]

• I have read the CONTRIBUTING.md guidelines.
• I have registered the PR changes.

Ⅰ. Describe what this PR did

This PR introduces auto-generation of distribution/ LICENSE files using Apache SkyWalking Eyes (license-eye), replacing the previous manually-maintained approach. It also normalizes license names to SPDX identifiers and corrects the root LICENSE file.

Problems solved:

1. Unverifiable / unreproducible — Previously, LICENSE files were manually edited with no way to verify correctness against actual build dependencies. Now they are generated by license-eye from the project's Maven/npm dependency graph, making them fully reproducible.

2. Unsorted entries — Dependencies within each license section were not alphabetically sorted, making review and maintenance difficult. The auto-generation enforces consistent alphabetical ordering.

3. Inconsistent across files — The three LICENSE files had different section orders and formatting styles. Now all three follow the same consistent format.

Changes:

File	Description
.licenserc-distribution.yaml	license-eye config for distribution module (new)
.licenserc-namingserver.yaml	license-eye config for namingserver module (new)
.licenserc-server.yaml	license-eye config for server module (new)
.github/workflows/license-checker.yaml	Split into two jobs: check-license-header (existing license header + dependency check) and check-license-files (new — builds, generates LICENSE files, verifies they are up to date, and uploads a diff artifact on failure)
.gitignore	Added __pycache__/ to prevent Python bytecode cache from being committed
script/license/generate-license.py	Python script: resolves Maven/npm dependencies via license-eye, formats output in ASF-required LICENSE format (new)
script/license/generate-license.sh	Shell wrapper, ensures correct working directory and checks prerequisites (new)
Makefile	Added generate-license-all, generate-license-namingserver, generate-license-server, generate-license-distribution targets
LICENSE	Corrected to match official Apache License 2.0 text
changes/en-us/2.x.md	Added changelog entry for auto-generate distribution LICENSE
changes/zh-cn/2.x.md	Added changelog entry for auto-generate distribution LICENSE
distribution/console/src/main/resources/static/console-fe/package-lock.json	Added npm lock file for reproducible console frontend builds (required by license-eye for npm dependency resolution)
distribution/LICENSE	Regenerated — sorted, consistent, SPDX-normalized
distribution/LICENSE-namingserver	Regenerated — sorted, consistent, SPDX-normalized
distribution/LICENSE-server	Regenerated — sorted, consistent, SPDX-normalized

Key features of the generation tooling:

• Resolves transitive Maven and npm dependencies automatically
• Groups dependencies by license type with consistent alphabetical ordering
• Supports overrides for license-edge's incorrect identifications (e.g., Public Domain → MIT)
• Supports a comprehensive license override map (LICENSE_OVERRIDES) for 17 dependencies whose licenses cannot be auto-resolved
• Normalizes license names to SPDX identifiers via a normalization map (LICENSE_NORMALIZE) covering 20+ URL/text variants
• Handles multi-licensing (e.g., dual-license "EPL-1.0 and LGPL-2.1" → takes first per ASF convention)
• Handles bundled assets (fonts: Roboto, Alibaba icon font, @alicloud/console-components) via DISTRIBUTION_EXTRA_ENTRIES that license-eye cannot resolve
• Names licenses by SPDX identifiers (e.g., "MIT" not "MIT License", "Apache-2.0" not "Apache License 2.0")
• Includes a check-license-files CI job that:
  • Builds the project with Maven
  • Generates LICENSE files via generate-license.sh all
  • Checks if any uncommitted changes exist (i.e., LICENSE files are up to date)
  • Uploads a license-diff.diff artifact on failure for easy patching

Ⅱ. Does this pull request fix one issue?

Fixes #8193

Ⅲ. Why don't you add test cases (unit test/integration test)?

This change primarily introduces build/generation tooling and static LICENSE files. The verification mechanism is built into the tooling itself:

1. Reproducibility — Running make generate-license-all (or ./script/license/generate-license.sh all) on the same source should produce identical output; any diff indicates drift.
2. The generation script is deterministic — given the same Maven/npm dependency graph, it always produces the same output.

Ⅳ. Describe how to verify it

Prerequisites:

# Install license-eye
brew install license-eye
# or: go install github.com/apache/skywalking-eyes/cmd/license-eye@latest

# Build all modules to populate the local Maven repository
mvn install -DskipTests

Verify LICENSE files are correctly generated:

# Generate all LICENSE files
make generate-license-all
# or: ./script/license/generate-license.sh all

Manual inspection:

• Open distribution/LICENSE, distribution/LICENSE-namingserver, distribution/LICENSE-server
• Verify dependencies are grouped by license type (MIT, Apache-2.0, BSD-3-Clause, etc.)
• Verify dependencies within each section are alphabetically sorted
• Verify the root LICENSE matches the official Apache License 2.0 text

Ⅴ. Special notes for reviews

1. __pycache__ cleanup: The script/license/__pycache__/generate-license.cpython-314.pyc file was accidentally included in an earlier commit and has been removed. .gitignore has been updated with __pycache__/ to prevent future recurrence.

2. package-lock.json: The distribution/console/src/main/resources/static/console-fe/package-lock.json file was added — this contains the resolved npm dependency tree for the console frontend. It is checked in intentionally to ensure reproducible builds and is required by license-eye for npm dependency resolution.

3. License name normalization: License names have been changed to SPDX identifiers throughout. For example:

   • "MIT License" → "MIT"
   • "Apache License 2.0" → "Apache-2.0"
   • "BSD 3-Clause" → "BSD-3-Clause"
     This aligns with ASF best practices and makes the files machine-readable.

4. License overrides: generate-license.py includes a manual override map.

5. Future work:

   • Document the LICENSE generation process in the contributor guide

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 73.20%. Comparing base (e01f97c) to head (b2980ce).

Additional details and impacted files

@@             Coverage Diff              @@
##                2.x    #8194      +/-   ##
============================================
- Coverage     73.30%   73.20%   -0.11%     
- Complexity     1142     1146       +4     
============================================
  Files          1153     1153              
  Lines         42340    42340              
  Branches       5058     5058              
============================================
- Hits          31037    30994      -43     
- Misses         8821     8863      +42     
- Partials       2482     2483       +1     

see 31 files with indirect coverage changes

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.