ci: license checker

[jamesbhobbs]

Fixes OSS-107

Summary by CodeRabbit

• Chores
  • Added an automated license compliance check to CI, adding a dedicated license-check job and a CI step to run license auditing so build runs surface disallowed or unapproved dependencies.
  • Added a local npm script to audit third‑party licenses against an approved list (excluding private packages and specified exceptions) to ensure consistent local and CI license reports.

[coderabbitai]

📝 Walkthrough

Walkthrough

Adds a CI "Check licenses" step to .github/workflows/ci.yml (runs npm run check-licenses) and introduces a top-level check_licenses workflow job that checks out the repo, sets up Node.js, runs npm ci, and executes the same script. Adds a check-licenses npm script to package.json that runs npx license-checker-rseidelsohn with an explicit allowlist and excludes private packages and specified packages. No other files or runtime behavior changed.

Sequence Diagram(s)

sequenceDiagram
  autonumber
  actor Dev as Developer
  participant GH as GitHub Actions
  participant Job as check_licenses
  participant NPM as npm
  participant LC as license-checker-rseidelsohn

  Dev->>GH: Push / open PR
  GH->>Job: trigger check_licenses job
  Job->>Job: checkout, setup-node, npm ci
  Job->>NPM: run "npm run check-licenses"
  NPM->>LC: invoke with allowlist & exclusions
  LC-->>NPM: produce report + exit code
  alt exit code 0
    Job-->>GH: job succeeds
    GH-->>Dev: success status
  else exit code != 0
    Job-->>GH: job fails with report
    GH-->>Dev: failure status
  end

Loading

Possibly related PRs

• ci: add license check job deepnote#18 — Adds a CI license-checking job and a package.json script using license-checker (strongly related).

Pre-merge checks

❌ Failed checks (2 warnings)

Check name	Status	Explanation	Resolution
Linked Issues Check	⚠️ Warning	The changes introduce CI license checks but do not add the Apache 2.0 license file required by OSS-107, so the primary objective of adding a license is unmet.	Please include an Apache 2.0 LICENSE file at the repository root to satisfy OSS-107 before merging.
Out of Scope Changes Check	⚠️ Warning	All modifications focus on CI license checks and a new npm script rather than adding the actual license file, making them unrelated to the linked issue.	Limit this PR to adding the Apache 2.0 license file or split the CI checks into a separate PR.

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title Check	✅ Passed	The title “ci: license checker” concisely and accurately highlights the main change of adding a CI license checking step.
Docstring Coverage	✅ Passed	No functions found in the changes. Docstring coverage check skipped.

---

📜 Recent review details

Configuration used: CodeRabbit UI

Review profile: ASSERTIVE

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between d9da660 and af00017.

📒 Files selected for processing (2)

• .github/workflows/ci.yml (1 hunks)
• package.json (1 hunks)

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[coderabbitai]

Actionable comments posted: 1

📜 Review details

Configuration used: CodeRabbit UI

Review profile: ASSERTIVE

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between c35f414 and 769042b.

📒 Files selected for processing (2)

• .github/workflows/ci.yml (1 hunks)
• package.json (1 hunks)

[coderabbitai]

Actionable comments posted: 1

♻️ Duplicate comments (1)

package.json (1)

2058-2058: Fix Windows quoting for --onlyAllow.

Single quotes break the allowlist on Windows shells; we still need escaped double quotes so the CI is portable.

-"check-licenses": "npx license-checker-rseidelsohn --onlyAllow 'MIT;Apache-2.0;ISC;BSD-2-Clause;BSD-3-Clause;0BSD;Python-2.0;CC0-1.0;CC-BY-3.0;CC-BY-4.0;Unlicense;BlueOak-1.0.0;MPL-2.0' --excludePrivatePackages --excludePackages 'bootstrap-less@3.3.8'",
+"check-licenses": "npx license-checker-rseidelsohn --onlyAllow \"MIT;Apache-2.0;ISC;BSD-2-Clause;BSD-3-Clause;0BSD;Python-2.0;CC0-1.0;CC-BY-3.0;CC-BY-4.0;Unlicense;BlueOak-1.0.0;MPL-2.0\" --excludePrivatePackages --excludePackages \"bootstrap-less@3.3.8\"",

📜 Review details

Configuration used: CodeRabbit UI

Review profile: ASSERTIVE

Plan: Pro

📥 Commits

Reviewing files that changed from the base of the PR and between 769042b and d9da660.

📒 Files selected for processing (2)

• .github/workflows/ci.yml (1 hunks)
• package.json (1 hunks)

🧰 Additional context used

🪛 GitHub Actions: CI

.github/workflows/ci.yml

[warning] 1-1: Code style issues found in the file. Run Prettier to fix.