From e8c6e259a4e54d20a7d4e47ee2ffe94f50c02021 Mon Sep 17 00:00:00 2001
From: Taylor Buchanan <me+dev.git@taylorbuchanan.com>
Date: Tue, 2 Jun 2026 08:48:23 -0500
Subject: [PATCH] Allow CC-BY/Python-2.0 licenses, waive lightningcss MPL

Add CC-BY-3.0, CC-BY-4.0, and Python-2.0 to allow-licenses. All are
permissive/attribution-only (no copyleft) and appear only as dev-only
transitive deps: spdx-exceptions (CC-BY-3.0), caniuse-lite (CC-BY-4.0),
argparse (Python-2.0).

Waive lightningcss (and its platform binaries) via
allow-dependencies-licenses rather than allow-listing MPL-2.0 globally,
so any future MPL dependency still trips the CI gate. lightningcss is a
dev-only build tool pulled transitively through vite/vitest.

This is the shared policy file; consumers inherit it through the
dependency-review.yml config-file default.
---
 .github/dependency-review-config.yml | 21 +++++++++++++++++++++
 1 file changed, 21 insertions(+)

diff --git a/.github/dependency-review-config.yml b/.github/dependency-review-config.yml
index f744c6e..13f997d 100644
--- a/.github/dependency-review-config.yml
+++ b/.github/dependency-review-config.yml
@@ -1,4 +1,20 @@
 ---
+allow-dependencies-licenses:
+  # lightningcss MPL-2.0 (dev-only build tool): excluded by name rather
+  # than allow-listing MPL globally, so future MPL deps still get gated.
+  # All platform binaries enumerated (no wildcard support).
+  - pkg:npm/lightningcss
+  - pkg:npm/lightningcss-android-arm64
+  - pkg:npm/lightningcss-darwin-arm64
+  - pkg:npm/lightningcss-darwin-x64
+  - pkg:npm/lightningcss-freebsd-x64
+  - pkg:npm/lightningcss-linux-arm-gnueabihf
+  - pkg:npm/lightningcss-linux-arm64-gnu
+  - pkg:npm/lightningcss-linux-arm64-musl
+  - pkg:npm/lightningcss-linux-x64-gnu
+  - pkg:npm/lightningcss-linux-x64-musl
+  - pkg:npm/lightningcss-win32-arm64-msvc
+  - pkg:npm/lightningcss-win32-x64-msvc
 # Permissive OSS licenses accepted for direct + transitive dependencies.
 # SPDX identifiers — see https://spdx.org/licenses/.
 # Add new entries with care; license terms vary materially.
@@ -8,7 +24,12 @@ allow-licenses:
   - BlueOak-1.0.0
   - BSD-2-Clause
   - BSD-3-Clause
+  # Attribution-only data licenses (no copyleft, no share-alike).
+  - CC-BY-3.0
+  - CC-BY-4.0
   - CC0-1.0
   - ISC
   - MIT
+  # BSD-class permissive (CPython's license).
+  - Python-2.0
   - Unlicense