Skip to content

#119 [High] Add a dependency license-compliance gate to CI #328

Description

@james2177

Description: .github/workflows/ci.yml's vulnerability-scan job only checks for known security vulnerabilities (npm audit --audit-level=high) — nothing checks the licenses of the dependency tree in package.json for compatibility with the project's own license (added in issue #107). Add a CI job (e.g. using license-checker or an equivalent tool) that fails the build if a dependency introduces an incompatible or copyleft license outside an explicit allow-list.

Problem Statement & Context: A project actively recruiting external contributors and planning to publish an SDK package (issue #108) needs a clean, verifiable license posture — an unnoticed GPL-licensed transitive dependency, for example, could create real legal exposure for downstream consumers of the published @vortex-protocol/backend-sdk package, and there's currently zero automated check for this.

Scope & Acceptance Criteria:

  • Add a CI job scanning all dependencies and devDependencies in package.json (and their transitive tree) against an explicit license allow-list, failing on anything outside it or unlicensed.
  • Reconcile the allow-list with whatever license is chosen in issue Add e2e coverage for intent expiry via the sweeper #107 (e.g. permissive-only allow-list if the project itself is MIT/Apache-2.0).
  • Out of scope: resolving any license conflicts the scan uncovers on first run — file those as follow-up issues; this issue delivers the scanning gate.

Implementation Guidelines:

  1. Key files: package.json, .github/workflows/ci.yml, LICENSE (from issue Add e2e coverage for intent expiry via the sweeper #107, for allow-list rationale).
  2. Add as a new CI job alongside the existing secrets-scan/vulnerability-scan jobs, following the same job-isolation pattern already used in ci.yml.
  3. Distinguish dependencies (ship in the published SDK and the runtime image) from devDependencies (build-time only, generally lower legal risk) if the chosen tool supports scoping — document the distinction and why the allow-list may differ between them.
  4. Testing: run the scan against the current dependency tree and document the actual result (clean pass, or a list of findings requiring follow-up) in the PR; if a violation is found, do not silently permit it — either resolve it in this PR or file a tracked follow-up before merging.

Definition of Done:

  • License-scanning CI job added, current dependency tree scanned and results documented.
  • Acceptance criteria met.
  • PR passes CI, includes scan output.
  • Reviewed and approved.

Resources: package.json, .github/workflows/ci.yml, LICENSE

Complexity: High (200 points)

Metadata

Metadata

Assignees

No one assigned

    Labels

    No labels
    No labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions