[Desperado]

qmax-code v1.38.0 replaces its source-available license with Apache 2.0 immediately, with no waiting period or non-compete restriction. The README, contributor terms, changelog, and full release announcement explain the new license and the boundary between the open-source CLI and hosted QualityMax.

Release archives include LICENSE, NOTICE, and licenses for runtime dependencies across all six target platforms. GitHub release notes use the versioned announcement and are copied to the public binary mirror.

Validation: release-stamped Go build and version smoke check, go vet, golangci-lint, dependency notice collection, shell syntax checks, and six-platform archive packaging checks. Full Go suite runs in CI. QualityMax blog publication is prepared separately.

[qualitymaxapp]

QualityMax Review

Verdict: COMMENT · Confidence: model judgment; findings have not been reproduced

Re-review: Open the QualityMax check and select Re-review after it completes.

Files eligible: 4 · Files reviewed: 4 · Files with findings: 1 · Findings: 1 · Inline cards: 0

Priority findings

priority	location	finding
—	—	No blocking findings

Review gates

gate	status
AI diff review	completed · eligible 4, reviewed 4 · MODEL-ONLY findings are advisory · batches reviewed 1 of 1 · LLM · served gemini-3.1-flash-lite
SAST	completed · eligible 9, reviewed 9 · hybrid · served qwen3.7-plus
Overall review evidence	non-blocking findings remain
Inline evidence	not needed

Important files

file	risk	note	next step
—	—	No findings	—

Advisory MODEL-ONLY candidates (1)

These model judgments do not block this PR and are not posted inline. Check reachable callers and existing protections, and reproduce a concrete failure before treating a candidate as a defect. A second model's confirmation or a model-reviewed patch does not reproduce a failure.

location	candidate	served model
.github/workflows/release.yml:50	The 'while read -r module version dir' loop assumes that the output of 'go list' does not contain spaces in the directory path. If the build path contains spaces, the 'read' command will incorrectly split the path into multiple variables, causing the subsequent license file lookup to fail.	gemini-3.1-flash-lite

Change diagram — Flow

flowchart TD
    A[Start Release Job] --> B[Build Binaries]
    B --> C[Collect Third-Party Notices]
    C --> D[Create Archives with Notices]
    D --> E[Prepare Release Notes]
    E --> F[Create GitHub Release]
    F --> G[Clone Releases Repo]
    G --> H[Copy Artifacts & Notices]
    H --> I[Commit & Push to Releases Repo]
    I --> J[Create Release on Releases Repo]

Loading

Review lifecycle

Use the inline cards to inspect evidence and suggested remediation. Re-run the QualityMax review after pushing a fix; unchanged cards are identified by their stable finding marker. Dismiss with a reason through the existing QualityMax/GitHub review feedback flow. 0 prior card(s) are stale/resolved on this head. @qmax Q&A is tracked separately.

Proof legend: GROUNDED deterministic scanner evidence · MODEL-ONLY advisory model judgment · MODEL-REVIEWED patch model judgment, not reproduction.

QualityMax project results are available in the configured project.

_{Receipt · commit 1f7e20f3b628324632fe0aace2d11f0a628196ca · run 2026-10-14T08:29:24+00:00 · model served gemini-3.1-flash-lite · model requested gemini-3.1-flash-lite · model review recorded — 2604 model output tokens · model source not recorded · re-review 2 · proof counts {'MODEL-ONLY': 1}}

[qualitymaxapp]

⚠️ QualityMax Diff Analysis — WARN

The PR introduces a new license compliance step in the CI pipeline and updates the project license to Apache 2.0. While the workflow logic is generally sound, the parsing of 'go list' output is brittle and will fail if the build directory path contains spaces, which is a common occurrence in some CI environments.

🟡 Finding 1: logic

File: .github/workflows/release.yml:50 | Severity: warning

What: The 'while read -r module version dir' loop assumes that the output of 'go list' does not contain spaces in the directory path. If the build path contains spaces, the 'read' command will incorrectly split the path into multiple variables, causing the subsequent license file lookup to fail.

Fix: Use a delimiter that is unlikely to appear in file paths (e.g., a null byte) with 'go list -f' and 'read -d $'\0'' to safely parse the output.

Fix with your LLM agent

<your-llm-agent> "Fix the logic issue in .github/workflows/release.yml at line 50: The 'while read -r module version dir' loop assumes that the output of 'go list' does not contain spaces in the directory path. If the build path contains spaces, the 'read' command will incorrectly split the path into multiple variables, causing the subsequent license file lookup to fail."

Fix all findings with your LLM agent

<your-llm-agent> "Fix all QualityMax review findings in this PR:\n- logic in .github/workflows/release.yml:50: The 'while read -r module version dir' loop assumes that the output of 'go list' does not contain spaces in the directory path. If the build path contains spaces, the 'read' command will incorrectly split the path into multiple variables, causing the subsequent license file lookup to fail."

Change diagram — Flow

flowchart TD
    A[Start Release Job] --> B[Build Binaries]
    B --> C[Collect Third-Party Notices]
    C --> D[Create Archives with Notices]
    D --> E[Prepare Release Notes]
    E --> F[Create GitHub Release]
    F --> G[Clone Releases Repo]
    G --> H[Copy Artifacts & Notices]
    H --> I[Commit & Push to Releases Repo]
    I --> J[Create Release on Releases Repo]

Loading

_{Analyzed commit 1f7e20f3 with gemini-3.1-flash-lite (4 files, 9165 tokens) | Customize review preferences}

[qualitymaxapp]

QualityMax Review — canonical overview updated; no inline findings were created for this review.

[qualitymaxapp]

⚠️ QualityMax Pipeline

Gate	Result
🔍 AI diff review	ℹ️ 1 advisory MODEL-ONLY candidate(s) · gemini-3.1-flash-lite · completed · 4 eligible / 4 reviewed · gemini-3.1-flash-lite
🔍 SAST	completed · 9 eligible / 9 reviewed · qwen3.7-plus
🔍 Canonical PR review delivery	completed · 0 eligible / 0 reviewed · exact-head review #5515119728 and overview #6164188201 confirmed
🧪 Repo Tests	✅ 844/844 passed (go)
🤖 AI Tests	⚠️ 51/56 passed

_{Powered by QualityMax — AI-Powered Test Automation}