ci: add license-check workflow

[Seth-Schmidt]

Summary

Adds a PR gate that fails when a package introduces a production dependency
under a disallowed license. Addresses compliance finding 3-1 (License Check).

Scope is what we distribute: contract bytecode and scripts/ source. Packages with known-but-pending or
peer-install-only exceptions are suppressed via exact name@version exclusions
in the Makefile.

Changes

• Makefile — make check-licenses

  • Iterates all contract packages plus scripts/fhevm-cli and
    scripts/governance-proposal-builder.
  • Allow-list: MIT, BSD variants, Apache-2.0, ISC, etc.
  • EXCLUDE_PACKAGES: LGPL Safe (cleared), LZBL LayerZero v2 packages (legal
    pending), BUSL peers not compiled into our Solidity (v1, Chainlink CCIP,
    lz-v2-utilities).

• .github/workflows/license-check.yml

  • license-check/check-licenses (bpr)

• package.json / lockfiles — move deployed Solidity deps from
  devDependencies → dependencies in governance, token, solanaOFT,
  staking, safe, and scripts/fhevm-cli so --production scans the real
  compile-time tree. Lockfiles regenerated to match.

[melanciani]

is this the only rule that we allow ? also: i thought it was ok for tooling/testing (ie non-smart contract libraries), which I don't think we differentiate here

you can check an old work of mine here (in the makefile) if you're curious : https://github.com/zama-ai/protocol-apps/pull/14/changes

[Seth-Schmidt]

@claude review

[claude]

Claude finished @Seth-Schmidt's request. — View run

[claude]

[AUTOMATED]

Code Review — ci: add license-check workflow

The workflow is well-structured and follows established repository conventions (SHA-pinned actions, least-privilege permissions, concurrency groups, persist-credentials: false, (bpr) naming). The shell logic for discovering affected packages in a monorepo is sound.

However, the license-checking step has a critical issue that defeats the purpose of the workflow.

Summary

Category	Result
Guideline Compliance	✅ Fully compliant with repo conventions
Error Handling	✅ Adequate (set -euo pipefail, proper aggregate gate)
Security	✅ Least-privilege, pinned actions, no credential exposure
Bug / Correctness	⚠️ 1 issue found (see inline comment)

[claude]

[AUTOMATED]

Bug: --failOn uses exact string matching — copyleft licenses will slip through

license-checker's --failOn compares the full license string against each entry using literal equality (source). The values "GPL", "AGPL", and "LGPL" do not match real-world SPDX identifiers like GPL-2.0-only, GPL-3.0-only, AGPL-3.0-only, LGPL-2.1-only, etc.

As a result, every copyleft-licensed package will silently pass this check, defeating the purpose of the workflow.

Options to fix:

1. Enumerate the specific SPDX identifiers (and common non-SPDX variants reported by npm):

   npx --yes license-checker --production --failOn \
     "GPL-1.0-only;GPL-1.0-or-later;GPL-2.0-only;GPL-2.0-or-later;GPL-3.0-only;GPL-3.0-or-later;AGPL-1.0-only;AGPL-1.0-or-later;AGPL-3.0-only;AGPL-3.0-or-later;LGPL-2.0-only;LGPL-2.0-or-later;LGPL-2.1-only;LGPL-2.1-or-later;LGPL-3.0-only;LGPL-3.0-or-later"

2. Use --onlyAllow instead (allowlist approach — --onlyAllow does substring matching, so it's safer):

   npx --yes license-checker --production --onlyAllow \
     "MIT;ISC;Apache-2.0;BSD-2-Clause;BSD-3-Clause;0BSD;CC0-1.0;Unlicense;CC-BY-3.0;CC-BY-4.0;Python-2.0;BlueOak-1.0.0"

3. Switch to a fork with SPDX-aware matching, e.g. license-checker-rseidelsohn (actively maintained) or @onebeyond/license-checker (enforces valid SPDX).

Confidence: 95/100

[claude]

The review has been posted successfully. Here's a summary of the review:

Review Summary for PR #217: ci: add license-check workflow

What was reviewed

A new GitHub Actions workflow (153 lines) that gates PRs on copyleft license detection across npm packages in a monorepo.

Findings

✅ Guideline Compliance — Fully compliant with all repository conventions (SHA-pinned actions, least-privilege permissions, concurrency groups, persist-credentials: false, (bpr) naming pattern).

✅ Security — Proper least-privilege permissions, no credential exposure, SHA-pinned actions.

✅ Error Handling — Adequate use of set -euo pipefail, proper aggregate gate job with if: always().

⚠️ 1 Bug Found (Critical) — The --failOn "GPL;AGPL;LGPL" flag on license-checker uses exact string matching, not substring matching. Real-world SPDX identifiers like GPL-2.0-only, GPL-3.0-only, AGPL-3.0-only, LGPL-2.1-only etc. will not be caught, silently defeating the purpose of the workflow. Three fix options were provided in the inline comment.