fix: ship complete third-party license bundle

.github/workflows/build-artifacts.yml

@@ -104,6 +104,14 @@ jobs:
           go build -tags wails,production -trimpath -buildvcs=false -ldflags="${{ matrix.target.desktop_ldflags }} $version_ldflag" -o "bin/oneagent-desktop${{ matrix.target.suffix }}" ./cmd/oneagent-desktop
           go build -trimpath -buildvcs=false -ldflags="-w -s $version_ldflag" -o "bin/oneagent${{ matrix.target.suffix }}" ./cmd/oneagent
 
+      - name: Verify production Go dependency inventory
+        shell: bash
+        run: |
+          python3 scripts/generate_third_party_licenses.py \
+            --verify-platform "${{ matrix.target.platform }}-${{ matrix.arch }}" \
+            --verify-go-binary "bin/oneagent-desktop${{ matrix.target.suffix }}" \
+            --verify-go-binary "bin/oneagent${{ matrix.target.suffix }}"
+
       - name: Package macOS app
         if: matrix.target.platform == 'macos'
         shell: bash
@@ -118,6 +126,35 @@ jobs:
           codesign --force --deep --sign - "bin/OneAgent.app"
           rm "bin/oneagent-desktop"
 
+      - name: Add license material to artifact
+        shell: bash
+        run: |
+          cp LICENSE NOTICE third_party/THIRD_PARTY_NOTICES.md bin/
+          cp -R third_party/licenses bin/licenses
+          if [[ "${{ matrix.target.platform }}" == "macos" ]]; then
+            compliance="bin/OneAgent.app/Contents/Resources/compliance"
+            mkdir -p "$compliance"
+            cp LICENSE NOTICE third_party/THIRD_PARTY_NOTICES.md "$compliance/"
+            cp -R third_party/licenses "$compliance/licenses"
+          fi
+
+      - name: Verify artifact license material
+        shell: bash
+        run: |
+          test -f bin/LICENSE
+          test -f bin/NOTICE
+          test -f bin/THIRD_PARTY_NOTICES.md
+          test -f bin/licenses/go/github.com_go-ole_go-ole@v1.3.0/LICENSE
+          test -f bin/licenses/npm/react-router@7.18.1/LICENSE.md
+          test -f bin/licenses/npm/scheduler@0.27.0/LICENSE
+          test -f bin/licenses/npm/cookie@1.0.1/LICENSE
+          test -f bin/licenses/npm/set-cookie-parser@2.6.0/LICENSE
+          if [[ "${{ matrix.target.platform }}" == "macos" ]]; then
+            test -f bin/OneAgent.app/Contents/Resources/compliance/LICENSE
+            test -f bin/OneAgent.app/Contents/Resources/compliance/NOTICE
+            test -f bin/OneAgent.app/Contents/Resources/compliance/THIRD_PARTY_NOTICES.md
+          fi
+
       - name: Upload artifact
         uses: actions/upload-artifact@v7
         with:

.github/workflows/ci.yml

@@ -31,9 +31,41 @@ jobs:
       # thing a plain run will not exercise.
       - run: go test -race ./...
 
+      # The Linux CI runner does not provide Wails' GTK/WebKitGTK native
+      # libraries. The default package graph still checks the portable Go code;
+      # target-specific release builds run in build-artifacts.yml.
       - uses: dominikh/staticcheck-action@v1.4.1
+
+  compliance:
+    name: Release compliance
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+
+      - uses: actions/setup-go@v7
         with:
-          build-tags: wails,production
+          go-version-file: go.mod
+          cache-dependency-path: go.sum
+
+      - uses: pnpm/action-setup@v6
+        with:
+          version: 11.17.0
+
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 26
+          cache: pnpm
+          cache-dependency-path: frontend/pnpm-lock.yaml
+
+      - name: Install frontend dependencies
+        working-directory: frontend
+        run: pnpm install --frozen-lockfile
+
+      - name: Test license generator
+        run: python3 -m unittest scripts/test_generate_third_party_licenses.py
+
+      - name: Verify third-party license bundle
+        run: python3 scripts/generate_third_party_licenses.py --check
 
   docs:
     name: Docs

NOTICE

@@ -9,25 +9,14 @@ Licensed under the Apache License, Version 2.0. See LICENSE for the full text.
 Third-party software redistributed in OneAgent binaries
 ================================================================================
 
-The following components are compiled into, or bundled with, the OneAgent
-desktop application and CLI. Their license texts are reproduced in the
-directories named below, inside each dependency's own distribution.
-
-Go modules (linked into the binary)
-
-  github.com/wailsapp/wails/v3        v3.0.0-beta.3    MIT
-  github.com/pelletier/go-toml/v2     v2.4.3           MIT
-  github.com/adrg/xdg                 v0.5.3           MIT
-  github.com/mattn/go-isatty          v0.0.24          MIT
-  golang.org/x/sys                    v0.47.0          BSD-3-Clause
-
-JavaScript packages (bundled into the embedded frontend)
-
-  react                               19.2.8           MIT
-  react-dom                           19.2.8           MIT
-  react-router-dom                    7.18.1           MIT
-  lucide-react                        1.25.0           ISC
-  @wailsio/runtime                    3.0.0-alpha2.117 MIT
+The target-specific dependency inventory is generated from the production Go
+build graph and the frozen frontend production dependency graph. The complete
+inventory is distributed as THIRD_PARTY_NOTICES.md, with the corresponding
+license and notice texts under licenses/ in every binary artifact.
+
+The tracked source of that generated material is third_party/. Run
+`scripts/generate_third_party_licenses.py --check` to verify that it still
+matches go.mod, go.sum, frontend/package.json and frontend/pnpm-lock.yaml.
 
 ================================================================================
 Third-party software downloaded at runtime, not redistributed

docs/distribution-compliance-policy.md

@@ -42,12 +42,12 @@ Every public release contains at least:
 - The OneAgent binary archive.
 - The SHA-256 matching that archive.
 - The version, the build time, the target environments, and the release status.
-- The third-party licence inventory. This is currently carried by [NOTICE](../NOTICE) at
-  the repository root; it also separates the components redistributed inside the package
-  from the components downloaded at run time and no longer redistributed (Node.js, uv,
-  Agent packages). `cmd/oneagent-release`, which generated this inventory, was removed
-  in `23805b0`, so `NOTICE` is now a hand-maintained source of truth and must be updated
-  whenever a bundled dependency or an in-app third-party marking is added.
+- The third-party licence inventory and full licence texts. The generated source is
+  [third_party/THIRD_PARTY_NOTICES.md](../third_party/THIRD_PARTY_NOTICES.md), with
+  dependency texts under `third_party/licenses/`; every binary artifact carries the same
+  files at its root. `scripts/generate_third_party_licenses.py --check` derives the
+  inventory from the production Go targets and frozen frontend dependency graph, and CI
+  blocks a stale or incomplete bundle.
 - The Agent version pinning manifest and the official sources.
 - Release notes, known issues, and a withdrawal contact.