third-party-code

# Third-Party Code Review Use this skill when reviewing or generating code that is copied from, adapted from, or substantially based on an external project. ## Purpose and scope Use this skill for licensing, attribution, notices, and repository bookkeeping around third-party-derived code. ## Core rule - Do not add third-party-derived code unless its license allows redistribution and modification compatible with this repository. - Preserve upstream attribution and required notices. - Track the imported/adapted component in the repository's third-party inventory. ## Request changes when - third-party-derived code is added without a matching `third-party-programs.txt` entry; - a colocated `LICENSE` file is missing; - upstream attribution or license text is removed or weakened; - license compatibility has not been verified for copied or adapted code. ## Required actions for new third-party-derived code - Add or update an entry in `third-party-programs.txt`. - Add a colocated `LICENSE` file in the relevant component or subtree. - Name the upstream project and author/source in that `LICENSE` file. - Include the upstream license text or required notice in that `LICENSE` file. - Keep the anomalib-side copyright/SPDX notice pattern when the repository's existing third-party examples do so. ## Required actions for updates to existing third-party-derived code - Preserve existing attribution, SPDX tags, and license text. - Do not remove or weaken upstream notices. - Update `third-party-programs.txt` if the tracked component, source, or licensing metadata changes. ## Repo-grounded review anchors - `third-party-programs.txt` - `src/**/LICENSE` ## Review prompts - Is this code copied or adapted from a third-party source? - If yes, is there a matching entry in `third-party-programs.txt`? - Is there a colocated `LICENSE` file with upstream attribution and license text? - Are required notices preserved in modified files and surrounding documentation? - Has anyone verified that the upstream license is compatible with redistribution in this repository? ## Reviewer checklist - Check whether the code is third-party-derived. - Check `third-party-programs.txt`. - Check the colocated `LICENSE` file. - Check attribution and compatibility.