Open-source license compliance

Scan tool commands and CI blocking configuration

license-checker / FOSSA CLI scanning

# license-checker (Node.js projects)
npx license-checker --production \
  --onlyAllow 'MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;CC0-1.0' \
  --excludePackages 'myapp@1.0.0' \
  --json > license-report.json

# List all licenses (with dependency tree)
npx license-checker --production --csv > licenses.csv

# FOSSA CLI scan (requires FOSSA_API_KEY)
fossa analyze --branch main
fossa test --timeout 600  # non-zero exit means policy violation

# Python projects — pip-licenses
pip install pip-licenses
pip-licenses --format=json \
  --with-urls \
  --with-authors \
  --output-file=licenses.json

# Auto-generate NOTICE file
npx license-checker --production \
  --customFormat='{"name":"","version":"","licenses":"","copyright":""}' \
  --out NOTICE \
  --customPath notice-template.json

CI blocking for GPL libraries (GitHub Actions)

# .github/workflows/license-check.yml
name: License Compliance
on: [pull_request]
jobs:
  check:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: actions/setup-node@v4
        with: { node-version: '20' }
      - run: npm ci --production
      - name: Check licenses (deny GPL)
        run: |
          npx license-checker --production \
            --onlyAllow 'MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;CC0-1.0;Unlicense' \
            --excludePackages 'approved-exception@1.0.0' || \
            (echo "::error::Disallowed license detected, check license-report.json" && exit 1)
      - name: Upload report
        uses: actions/upload-artifact@v4
        with:
          name: license-report
          path: license-report.json

Compliance flow (lockfile → scan → SBOM)

  [ Align lockfile / build graph with org allowlist ]
        │
        ▼
  ┌─────────────┐     Parse SPDX License Expressions; flag UNKNOWN / OR / AND
  │ Dependency scan │──── Conflicts: copyleft × closed-source distribution, patent grants, additional obligations
  └─────────────┘
        │
        ▼
  ┌─────────────┐     CycloneDX / SPDX JSON: licenseDeclared / licenseConcluded per component
  │  SBOM output  │──── Version drift: diff license fields → trigger compliance review ticket
  └─────────────┘
        │
        ▼
  ┌─────────────┐     NOTICE / source obligations / UI credits; exception log with expiry
  │ Distribution  │──── Not legal advice → escalate major risks to legal
  └─────────────┘

License compatibility matrix

Common license usage constraints across different distribution scenarios (not legal advice—escalate major decisions to legal):

• NOASSERTION: use as SBOM field placeholder when metadata is missing and not yet manually confirmed.
• Scanner-output UNKNOWN must enter a review queue; must not be silently mapped to allowed.

License fields in SBOMs and review

CycloneDX licenses and SPDX JSON licenseDeclared / licenseConcluded should share provenance with CI scans and the lockfile; on merge, diff the previous SBOM’s license set.

Allowlists, distribution shape, and NOTICE

Static vs dynamic linking, containers, and pure SaaS change “source offer—and “copyright notice—duties; the SKILL should list files that ship (LICENSE, NOTICE, third-party list) per delivery shape.

Version the org allow table and align it with pipeline gates; exceptions need ticket, approver, and re-review date. Generate “About / open source—pages from the SBOM or build-time credits—avoid hand-copy drift.

SPDX JSON package fragment lab

Fill coordinates and an SPDX license expression to produce a single packages[] element for SPDX 2.3 JSON (you still need document root SPDXID, relationships, etc.).