The hardened runner's job network has no internet access, so `apk add` and
downloading addlicense from GitHub cannot work. git, curl, jq and addlicense
are baked into the runner's job image (infra/gitea-runner/ci-tools.Dockerfile).
The license bot service (Dcntrlized/license-bot) is authoritative: it amends
missing AGPL headers into the PR head commit, including for fork PRs, and
reports the license-bot / addlicense commit status. This workflow now only
reports an honest advisory signal, holds no secrets and never writes.
Admin