Harden ACS beta runtime and SDK contracts #50
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: License scan | |
| on: | |
| pull_request: | |
| push: | |
| branches: [main] | |
| workflow_dispatch: | |
| permissions: | |
| contents: read | |
| jobs: | |
| license-compatibility: | |
| name: License compatibility | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 30 | |
| steps: | |
| - name: Checkout | |
| uses: actions/checkout@v4 | |
| - name: Set up Python | |
| uses: actions/setup-python@v5 | |
| with: | |
| python-version: "3.12" | |
| - name: Set up Node.js | |
| uses: actions/setup-node@v4 | |
| with: | |
| node-version: "20" | |
| cache: npm | |
| cache-dependency-path: sdk/node/package-lock.json | |
| - name: Set up .NET | |
| uses: actions/setup-dotnet@v4 | |
| with: | |
| dotnet-version: | | |
| 8.0.x | |
| 9.0.x | |
| - name: Install stable Rust | |
| run: | | |
| rustup toolchain install stable --profile minimal | |
| rustup default stable | |
| - name: Install license tooling | |
| run: cargo install cargo-deny --locked | |
| - name: Rust license policy | |
| run: cargo deny check licenses | |
| - name: Node license policy | |
| working-directory: sdk/node | |
| run: | | |
| # Scan only the production dependency footprint that ACS actually | |
| # distributes. The framework adapters (@anthropic-ai/sdk, langchain, | |
| # openclaw, @openai/agents, ...) are devDependencies/peerDependencies | |
| # the integrator brings themselves; their transitive trees legitimately | |
| # contain copyleft and public-domain licenses (MPL-2.0, Unlicense, a | |
| # GPL-dual option) that ACS never ships. The published package has zero | |
| # third-party runtime dependencies, so the omit-dev/omit-peer tree is | |
| # the correct surface to gate on. | |
| npm ci --omit=dev --omit=peer | |
| npx --yes license-checker-rseidelsohn --production --onlyAllow 'MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;0BSD;CC0-1.0;BlueOak-1.0.0;Python-2.0;Unicode-DFS-2016;Unicode-3.0' | |
| - name: Python dependency licenses | |
| run: | | |
| python -m venv .venv-license | |
| . .venv-license/bin/activate | |
| python -m pip install --upgrade pip | |
| python -m pip install pip-licenses pyyaml jsonschema | |
| pip-licenses --packages pyyaml jsonschema --fail-on 'GPL;AGPL;LGPL;SSPL;EPL;CDDL' --format=plain-vertical | |
| deactivate | |
| rm -rf .venv-license | |
| - name: .NET dependency license scope | |
| run: | | |
| set -euo pipefail | |
| # The shipped .NET surface is the core package (dependency-free) plus | |
| # the opt-in adapter packages under src/, each of which bears a single | |
| # framework dependency (Microsoft.Extensions.AI, Microsoft.Agents.AI, | |
| # AutoGen.Core, Microsoft.SemanticKernel). The tests/ integration | |
| # projects pull additional framework SDKs (Azure.AI.OpenAI, | |
| # Anthropic.SDK, ...) purely for local verification and are not | |
| # published, so they are out of scope for the distributed-license gate | |
| # (mirrors the Node --omit=dev scan). Verify the full transitive | |
| # license closure of every shipped package against the permissive | |
| # allowlist using nuget-license (the .NET analogue of license-checker | |
| # and cargo-deny). | |
| dotnet tool install --global nuget-license >/dev/null 2>&1 || dotnet tool update --global nuget-license >/dev/null | |
| export PATH="$PATH:$HOME/.dotnet/tools" | |
| cat > "$RUNNER_TEMP/acs-dotnet-allowed-licenses.json" <<'JSON' | |
| ["MIT","Apache-2.0","BSD-2-Clause","BSD-3-Clause","ISC","0BSD","CC0-1.0","BlueOak-1.0.0","Python-2.0","Unicode-DFS-2016","Unicode-3.0"] | |
| JSON | |
| shopt -s nullglob | |
| for proj in sdk/dotnet/src/*/*.csproj; do | |
| echo "::group::license scan $proj" | |
| dotnet restore "$proj" | |
| nuget-license -i "$proj" -t -a "$RUNNER_TEMP/acs-dotnet-allowed-licenses.json" --error-only -o Table | |
| echo "::endgroup::" | |
| done |