Relicense under PolyForm Noncommercial, add CI badges and testing docs

.github/workflows/codeql.yml

@@ -0,0 +1,37 @@
+name: CodeQL
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+  schedule:
+    - cron: "0 5 * * 1"
+
+permissions:
+  contents: read
+  security-events: write
+
+jobs:
+  analyze:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Setup .NET
+        uses: actions/setup-dotnet@v4
+        with:
+          global-json-file: global.json
+
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: csharp
+
+      - name: Build
+        run: dotnet build --no-incremental -c Release
+
+      - name: Perform CodeQL analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:csharp"

.github/workflows/dependency-review.yml

@@ -0,0 +1,21 @@
+name: Dependency Review
+
+on:
+  pull_request:
+    branches: [main]
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Dependency review
+        uses: actions/dependency-review-action@v4
+        with:
+          fail-on-severity: high
+          comment-summary-in-pr: always

LICENSE

@@ -0,0 +1,133 @@
+# PolyForm Noncommercial License 1.0.0
+
+<https://polyformproject.org/licenses/noncommercial/1.0.0>
+
+Required Notice: Copyright TenOfNine (https://github.com/TenOfNine/AzureHosted-DMARC-Analyzer)
+
+## Acceptance
+
+In order to get any license under these terms, you must agree
+to them as both strict obligations and conditions to all
+your licenses.
+
+## Copyright License
+
+The licensor grants you a copyright license for the
+software to do everything you might do with the software
+that would otherwise infringe the licensor's copyright
+in it for any permitted purpose. However, you may
+only distribute the software according to [Distribution
+License](#distribution-license) and make changes or new works
+based on the software according to [Changes and New Works
+License](#changes-and-new-works-license).
+
+## Distribution License
+
+The licensor grants you an additional copyright license
+to distribute copies of the software. Your license
+to distribute covers distributing the software with
+changes and new works permitted by [Changes and New Works
+License](#changes-and-new-works-license).
+
+## Notices
+
+You must ensure that anyone who gets a copy of any part of
+the software from you also gets a copy of these terms or the
+URL for them above, as well as copies of any plain-text lines
+beginning with `Required Notice:` that the licensor provided
+with the software. For example:
+
+> Required Notice: Copyright TenOfNine (https://github.com/TenOfNine/AzureHosted-DMARC-Analyzer)
+
+## Changes and New Works License
+
+The licensor grants you an additional copyright license to
+make changes and new works based on the software for any
+permitted purpose.
+
+## Patent License
+
+The licensor grants you a patent license for the software that
+covers patent claims the licensor can license, or becomes able
+to license, that you would infringe by using the software.
+
+## Noncommercial Purposes
+
+Any noncommercial purpose is a permitted purpose.
+
+## Personal Uses
+
+Personal use for research, experiment, and testing for
+the benefit of public knowledge, personal study, private
+entertainment, hobby projects, amateur pursuits, or religious
+observance, without any anticipated commercial application,
+doesn't count as a commercial purpose.
+
+## Noncommercial Organizations
+
+Use by any charitable organization, educational institution,
+public research organization, public safety or health
+organization, environmental protection organization,
+or government institution is a permitted purpose regardless
+of the source of funding or obligations resulting from the
+funding.
+
+## Fair Use
+
+You may have "fair use" rights for the software under the
+law. These terms do not limit them.
+
+## No Other Rights
+
+These terms do not allow you to sublicense or transfer any of
+your licenses to anyone else, or prevent the licensor from
+granting licenses to anyone else. These terms do not imply
+any other licenses.
+
+## Patent Defense
+
+If you make any written claim that the software infringes or
+contributes to infringement of any patent, your patent license
+for the software granted under these terms ends immediately. If
+your company makes such a claim, your patent license ends
+immediately for work on behalf of your company.
+
+## Violations
+
+The first time you are notified in writing that you have
+violated any of these terms, or done anything with the software
+not covered by your licenses, your licenses can nonetheless
+continue if you come into full compliance with these terms,
+and take practical steps to correct past violations, within
+32 days of receiving notice. Otherwise, all your licenses
+end immediately.
+
+## No Liability
+
+***As far as the law allows, the software comes as is, without
+any warranty or condition, and the licensor will not be liable
+to you for any damages arising out of these terms or the use
+or nature of the software, under any kind of legal claim.***
+
+## Definitions
+
+The **licensor** is the individual or entity offering these
+terms, and the **software** is the software the licensor makes
+available under these terms.
+
+**You** refers to the individual or entity agreeing to these
+terms.
+
+**Your company** is any legal entity, sole proprietorship,
+or other kind of organization that you work for, plus all
+organizations that have control over, are under the control of,
+or are under common control with that organization. **Control**
+means ownership of substantially all the assets of an entity,
+or the power to direct its management and policies by vote,
+contract, or otherwise. Control can be direct or indirect.
+
+**Your licenses** are all the licenses granted to you for the
+software under these terms.
+
+**Use** means anything you do with the software requiring one
+of your licenses.

README.md

@@ -1,5 +1,11 @@
 # DMARC Analyzer
 
+![CI](https://github.com/TenOfNine/AzureHosted-DMARC-Analyzer/actions/workflows/ci.yml/badge.svg)
+![CodeQL](https://github.com/TenOfNine/AzureHosted-DMARC-Analyzer/actions/workflows/codeql.yml/badge.svg)
+![License](https://img.shields.io/badge/license-PolyForm%20Noncommercial%201.0.0-blue)
+![.NET](https://img.shields.io/badge/.NET-8-512BD4)
+![Tests](https://img.shields.io/badge/tests-62%20passing-brightgreen)
+
 A self-hosted DMARC report analyzer, deployed as an Azure App Service. It ingests RUA/RUF reports
 from Exchange Online shared mailboxes via Microsoft Graph, and goes beyond just showing what a
 report claims: it independently re-checks each sending domain's **current** SPF record and DKIM
@@ -125,6 +131,27 @@ against Graph before anything is saved, then the secret is written straight to K
 domains and mailboxes, and setting the retention window. A fresh deployment redirects here
 automatically until all of it is complete.
 
+## Testing
+
+```
+Passed!  - Failed: 0, Passed: 62, Skipped: 0, Total: 62
+```
+
+62 xUnit tests cover the RFC 7489 XML parser, the RFC 7208 SPF evaluator (CIDR boundaries,
+recursive `include`, `redirect`, the 10-lookup limit, all qualifiers), the DKIM selector checker,
+the sender-legitimacy scoring rules, and the ingestion pipeline (dedupe, per-message failure
+isolation, sender-reputation aggregation) — all against hand-written fakes for Graph/DNS, so the
+suite needs no network access and runs the same locally as in CI.
+
+Every pull request and push to `main` runs three workflows, all required to be green before
+merging:
+
+| Workflow | What it checks |
+| --- | --- |
+| [`ci.yml`](.github/workflows/ci.yml) | `dotnet build`, `dotnet format --verify-no-changes` (lint), `dotnet test` with code coverage collection |
+| [`codeql.yml`](.github/workflows/codeql.yml) | [CodeQL](https://codeql.github.com/) static analysis for C#, plus a weekly scheduled scan |
+| [`dependency-review.yml`](.github/workflows/dependency-review.yml) | Flags newly introduced dependencies with known vulnerabilities or high-severity advisories |
+
 ## Development
 
 ```bash
@@ -134,3 +161,11 @@ dotnet test
 
 Running the app locally requires a reachable SQL Server and a real Azure Key Vault your local
 identity has access to — see [`docs/deployment.md`](docs/deployment.md#local-development).
+
+## License
+
+Licensed under the [PolyForm Noncommercial License 1.0.0](LICENSE) — free to use, modify, and
+self-host for any noncommercial purpose; commercial use (including resale or offering it as a
+paid/commercial service) requires a separate agreement with the copyright holder. Vendored
+front-end assets under `src/DmarcAnalyzer.Web/wwwroot/lib/` (Bootstrap, jQuery, Chart.js) keep
+their own original MIT licenses.

docs/technical-specification.md

@@ -4,7 +4,7 @@
 
 | | |
 |---|---|
-| **Document version** | 1.1 |
+| **Document version** | 1.2 |
 | **Date written** | 2026-08-10 (last updated 2026-08-10 — see [§7.4 Change log](#74-change-log)) |
 | **Document status** | Final — describes the as-built system on `main` plus this update's pending pull request |
 | **Repository** | `TenOfNine/AzureHosted-DMARC-Analyzer` |
@@ -340,6 +340,8 @@ resource group for a new organization without name collisions (supports G-5/FR-C
 | Workflow | Trigger | Steps |
 |---|---|---|
 | `.github/workflows/ci.yml` | Pull request → `main`, push → `main` | `dotnet restore` → `dotnet build -c Release` → `dotnet format --verify-no-changes` → `dotnet test` (with coverage collection) → upload test results artifact. No Azure credentials used or needed. |
+| `.github/workflows/codeql.yml` | Pull request → `main`, push → `main`, weekly schedule | `github/codeql-action` static analysis for C#, uploaded to the repository's Security tab. |
+| `.github/workflows/dependency-review.yml` | Pull request → `main` | `actions/dependency-review-action` fails the check on newly introduced dependencies with high-severity vulnerability advisories. |
 | `.github/workflows/deploy.yml` | `workflow_run` after CI succeeds on `main`, or manual `workflow_dispatch` | `azure/login` via **OIDC federated credentials** (no stored client secret) → Bicep deploy (`azure/arm-deploy`) → grant the Web App's managed identity DB access (`tools/GrantSqlAccess`, using `Authentication=Active Directory Default`) → build + apply an EF Core migrations bundle → `dotnet publish` → `azure/webapps-deploy`. |
 
 ## 5. Non-Functional Requirements
@@ -499,3 +501,4 @@ automated test suite before merge, not merely style issues:
 |---|---|---|
 | 1.0 | 2026-08-10 | Initial specification, describing the system as of commit `844b4ac`. |
 | 1.1 | 2026-08-10 | Added §3.5 Sender legitimacy scoring (FR-LEGIT-1–7): the `SenderReputation` aggregate, `SenderLegitimacyEvaluator` heuristic, reverse-DNS/FCrDNS check, the domain-detail page's sender-legitimacy table, and cross-cutting filter/sort capability on both detail tables. Renumbered the former §3.5/§3.6 to §3.6/§3.7 accordingly. Retired the standalone `IVerifiedSenderClassifier` abstraction and its two-state Verified/Unverified badge — superseded by the four-tier legitimacy verdict everywhere it was used; its override-matching logic survives as `SenderOverrideMatcher`. Updated data model, architecture/sequence diagrams, NFRs, and verification evidence (41 → 62 tests) accordingly. |
+| 1.2 | 2026-08-10 | Relicensed the project under the PolyForm Noncommercial License 1.0.0 (`LICENSE`) — noncommercial use, modification, and self-hosting permitted; commercial resale requires a separate agreement. Added two CI/CD checks (§4.6): `codeql.yml` (CodeQL static analysis for C#, on every PR/push plus a weekly schedule) and `dependency-review.yml` (fails PRs introducing high-severity vulnerable dependencies). Added a README Testing section documenting current pass/fail results and status badges. |