WIP: acknowledgements for third-party libraries

.github/workflows/ci.yml

@@ -37,6 +37,10 @@ jobs:
     name: Test Swift
     uses: ./.github/workflows/swift-test.yml
 
+  license_compliance:
+    name: License Compliance
+    uses: ./.github/workflows/license-compliance.yml
+
   required:
     name: Check required jobs
     runs-on: ubuntu-24.04

.github/workflows/license-compliance.yml

@@ -0,0 +1,76 @@
+name: License Compliance
+
+on:
+  workflow_call:
+    outputs:
+      matrix-result:
+        description: "Matrix job result"
+        value: ${{ jobs.acknowledgements.result }}
+
+jobs:
+  acknowledgements:
+    name: Verify that ACKNOWLEDGEMENTS.md is up to date
+    runs-on: ubuntu-24.04
+    steps:
+      - name: Checkout Repository
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # 5.0.0
+
+      - name: Cache Dependencies
+        uses: swatinem/rust-cache@f13886b937689c021905a6b90929199931d60db1 # 2.8.1
+
+      - name: Install `cargo-about`
+        run: cargo install cargo-about --version 0.8.2
+
+      - name: Generate ACKNOWLEDGEMENTS.md
+        run: cargo about generate --locked ACKNOWLEDGEMENTS.md.hbs > ACKNOWLEDGEMENTS.md
+
+      - name: Verify ACKNOWLEDGEMENTS.md is unchanged
+        id: verify
+        run: git diff --quiet ACKNOWLEDGEMENTS.md
+
+      - name: Upload generated ACKNOWLEDGEMENTS.md for debugging
+        if: failure() && steps.verify.outcome == 'failure'
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # 4.6.2
+        with:
+          name: generated-acknowledgements
+          path: ACKNOWLEDGEMENTS.md
+          retention-days: 7
+
+      - name: Output helpful error message
+        if: failure() && steps.verify.outcome == 'failure'
+        run: |
+          echo "::error::ACKNOWLEDGEMENTS.md is out of date."
+          cat >> $GITHUB_STEP_SUMMARY << 'EOF'
+          ## License acknowledgements outdated ❌
+
+          The `ACKNOWLEDGEMENTS.md` file is out of date with the current dependencies. Maintaining an up-to-date acknowledgements is required to comply with most open source licenses, as we distribute compiled copies of dependency code in our binaries.
+
+          ### Why did this check fail? 🤔
+
+          There are several reasons why this check might have failed. Typically, this happens if one of the following scenarios occurred, and the `ACKNOWLEDGEMENTS.md` file was not updated:
+            - A (transitive) dependency was added, removed, or updated.
+            - As `cargo-about` fetches some license data from external services, the external service might have changed the license text.
+
+          ### How to debug 🔍
+
+          1. **Check the diff above** to see what changed
+          2. **Download the artifact**: The CI-generated `ACKNOWLEDGEMENTS.md` file has been uploaded as an artifact named `generated-acknowledgements`. You can download it from the workflow run summary page.
+          3. **Compare locally**: Download the artifact and compare it with your local version to identify platform-specific differences.
+
+          ### How to fix 🛠️
+
+          First, ensure you have `cargo-about` installed:
+
+          ```sh
+          cargo install cargo-about --version 0.8.2
+          ```
+
+          Then, generate the `ACKNOWLEDGEMENTS.md` file:
+
+          ```sh
+          cargo about generate --locked ACKNOWLEDGEMENTS.md.hbs > ACKNOWLEDGEMENTS.md
+          ```
+
+          Finally, commit the changes and push them to this PR 🚀
+          EOF
+          exit 1