[cpanato]

What kind of change does this PR introduce?

Bug fix: the License check's file search rejects .github/LICENSE, so a repository whose license is stored there can be reported as having no license.

• PR title follows the guidelines defined in our pull request documentation

What is the current behavior?

When the hosting API does not return a license, the filename heuristic only recognizes licenses at the repository root or within a root license directory. For example, moving LICENSE to .github/LICENSE makes it undetectable by this fallback.

What is the new behavior (if this is a feature change)?

Recognize the existing license filename formats under .github/ as well, preserving the full path and SPDX identifier in findings. Continue rejecting license files in unrelated directories such as vendor/, docs/, and .github/workflows/.

Update the documentation and describe the existing scoring policy as nine points for a detected license plus one for an FSF or OSI approved license.

• Tests for the changes have been added (for bug fixes/features)

Which issue(s) this PR fixes

Fixes #5068

Special notes for your reviewer

Validation:

• License filename tests pass, including with -race. The new .github/ cases failed before the fix.
• Tests for checks/evaluation, probes/hasLicenseFile, and probes/hasFSFOrOSIApprovedLicense pass.
• Documentation validation and git diff --check pass.
• golangci-lint run -c .golangci.yml --new-from-rev=HEAD ./checks/raw/... reported zero issues before committing.

The full checks/raw suite fails in TestMixedPinning and two TestCollectDockerfilePinning cases because Docker image remediations are missing. These failures also reproduce using the original license.go through a Go overlay.

Does this PR introduce a user-facing change?

The License check now recognizes license files in the repository's .github directory when using filename-based detection.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 78.37%. Comparing base (353ed60) to head (dd81368).
⚠️ Report is 434 commits behind head on main.

Additional details and impacted files

@@             Coverage Diff             @@
##             main    #5367       +/-   ##
===========================================
+ Coverage   66.80%   78.37%   +11.56%     
===========================================
  Files         230      251       +21     
  Lines       16602    14286     -2316     
===========================================
+ Hits        11091    11196      +105     
+ Misses       4808     3089     -1719     
+ Partials      703        1      -702     

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[cpanato]

ready for review @justaugustus