chore(licenses): add a license gate and notices - #154
Merged
Conversation
The audit job already blocks vulnerable dependencies, but nothing watched what those dependencies are licensed under. A transitive package arriving under AGPL or SSPL would have landed silently, and Section 3.d of LICENSE promises attribution the repository could not actually produce. The check reads package-lock.json rather than node_modules: the lockfile records a license on every entry, so the result is deterministic, needs no install, and does not change with the host platform (sharp's libvips binaries only install on the platform they target). Scope is the runtime tree; build-time-only packages ship nowhere. The allowlist is deliberate. An unreviewed license fails the build instead of being waved through, which is the only version of this check that keeps working once someone stops paying attention. The current tree is clean: 523 runtime packages, permissive except weak copyleft (LGPL-3.0 libvips, MPL-2.0, EPL-2.0), each documented with what it actually requires. The generated notices are checked for staleness too, so a dependency change that skips the regeneration step fails rather than drifting.
develop moved a lot since this branch was cut: the SSO plugin arrived, next went to 16.3, and two override floors were added. 523 runtime packages became 548, and the gate refuses a stale file by design.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Allowlist-based license check over the runtime dependency tree, the generated
THIRD-PARTY-NOTICES.md, and a CI job in the Security workflow.Reads
package-lock.jsonrather thannode_modules, so the result is deterministic, needs no install and does not vary with the host platform. Scope is the runtime tree; build-time-only packages ship nowhere.The allowlist is deliberate: an unreviewed license fails the build instead of being waved through. Current tree is clean, 548 runtime packages, permissive except weak copyleft (LGPL-3.0 libvips, MPL-2.0, EPL-2.0), each documented with what it actually requires. Two packages ship a LICENSE file but no metadata field; both were read by hand and are recorded with the quote.
The notices are checked for staleness too, so a dependency change that skips the regeneration fails rather than drifting.