Skip to content

Add dependency license audit workflow and report #3

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
thomasvanwijk wants to merge 1 commit into
base: main
Choose a base branch
from
Open

Add dependency license audit workflow and report #3

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
31 changes: 31 additions & 0 deletions .github/workflows/license-check.yml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,31 @@
name: License check

on:
push:
branches: [ main ]
pull_request:
branches: [ main ]

jobs:
license-check:
runs-on: ubuntu-latest
steps:
- uses: actions/checkout@v4
- name: Use Node.js
uses: actions/setup-node@v4
with:
node-version: '18.x'

- name: Install dependencies (CLI)
run: cd cli && npm install

- name: License check (CLI)
run: cd cli && npx license-checker --production --onlyAllow 'MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;0BSD' --excludePrivatePackages

- name: Install dependencies (agenticflow-memory-mcp)
run: cd agenticflow-memory-mcp && npm install

- name: License check (agenticflow-memory-mcp)
# We allow LGPL-3.0-or-later for sharp-libvips which is dynamically linked, 0BSD, BlueOak-1.0.0, and Apache* (used by flatbuffers).
# We exclude the chroma packages that incorrectly report UNKNOWN and Custom licenses but are Apache 2.0.
run: cd agenticflow-memory-mcp && npx license-checker --production --onlyAllow 'MIT;Apache-2.0;BSD-2-Clause;BSD-3-Clause;ISC;0BSD;BlueOak-1.0.0;Apache*;LGPL-3.0-or-later' --excludePrivatePackages --excludePackages "@chroma-core/ai-embeddings-common@0.1.10;@chroma-core/default-embed@0.1.9;agenticflow-memory-mcp@0.2.0"
245 changes: 245 additions & 0 deletions licenses-node.csv
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,245 @@
"module name","license","repository"
"@esbuild/linux-x64@0.27.3","MIT","https://github.com/evanw/esbuild"
"@types/node@25.3.3","MIT","https://github.com/DefinitelyTyped/DefinitelyTyped"
"agenticflow-cli@1.0.0","ISC",""
"ansi-escapes@4.3.2","MIT","https://github.com/sindresorhus/ansi-escapes"
"ansi-regex@5.0.1","MIT","https://github.com/chalk/ansi-regex"
"ansi-styles@4.3.0","MIT","https://github.com/chalk/ansi-styles"
"base64-js@1.5.1","MIT","https://github.com/beatgammit/base64-js"
"bcryptjs@3.0.3","BSD-3-Clause","https://github.com/dcodeIO/bcrypt.js"
"bl@4.1.0","MIT","https://github.com/rvagg/bl"
"buffer@5.7.1","MIT","https://github.com/feross/buffer"
"chalk@4.1.2","MIT","https://github.com/chalk/chalk"
"chardet@0.7.0","MIT","https://github.com/runk/node-chardet"
"cli-cursor@3.1.0","MIT","https://github.com/sindresorhus/cli-cursor"
"cli-spinners@2.9.2","MIT","https://github.com/sindresorhus/cli-spinners"
"cli-width@3.0.0","ISC","https://github.com/knownasilya/cli-width"
"clone@1.0.4","MIT","https://github.com/pvorb/node-clone"
"color-convert@2.0.1","MIT","https://github.com/Qix-/color-convert"
"color-name@1.1.4","MIT","https://github.com/colorjs/color-name"
"commander@14.0.3","MIT","https://github.com/tj/commander.js"
"defaults@1.0.4","MIT","https://github.com/sindresorhus/node-defaults"
"dotenv@17.3.1","BSD-2-Clause","https://github.com/motdotla/dotenv"
"emoji-regex@8.0.0","MIT","https://github.com/mathiasbynens/emoji-regex"
"esbuild@0.27.3","MIT","https://github.com/evanw/esbuild"
"escape-string-regexp@1.0.5","MIT","https://github.com/sindresorhus/escape-string-regexp"
"external-editor@3.1.0","MIT","https://github.com/mrkmg/node-external-editor"
"figures@3.2.0","MIT","https://github.com/sindresorhus/figures"
"get-tsconfig@4.13.6","MIT","https://github.com/privatenumber/get-tsconfig"
"has-flag@4.0.0","MIT","https://github.com/sindresorhus/has-flag"
"iconv-lite@0.4.24","MIT","https://github.com/ashtuchkin/iconv-lite"
"ieee754@1.2.1","BSD-3-Clause","https://github.com/feross/ieee754"
"inherits@2.0.4","ISC","https://github.com/isaacs/inherits"
"inquirer@8.2.5","MIT","https://github.com/SBoudrias/Inquirer.js"
"is-fullwidth-code-point@3.0.0","MIT","https://github.com/sindresorhus/is-fullwidth-code-point"
"is-interactive@1.0.0","MIT","https://github.com/sindresorhus/is-interactive"
"is-unicode-supported@0.1.0","MIT","https://github.com/sindresorhus/is-unicode-supported"
"json5@2.2.3","MIT","https://github.com/json5/json5"
"lodash@4.17.23","MIT","https://github.com/lodash/lodash"
"log-symbols@4.1.0","MIT","https://github.com/sindresorhus/log-symbols"
"mimic-fn@2.1.0","MIT","https://github.com/sindresorhus/mimic-fn"
"mute-stream@0.0.8","ISC","https://github.com/isaacs/mute-stream"
"onetime@5.1.2","MIT","https://github.com/sindresorhus/onetime"
"ora@5.4.1","MIT","https://github.com/sindresorhus/ora"
"os-tmpdir@1.0.2","MIT","https://github.com/sindresorhus/os-tmpdir"
"readable-stream@3.6.2","MIT","https://github.com/nodejs/readable-stream"
"resolve-pkg-maps@1.0.0","MIT","https://github.com/privatenumber/resolve-pkg-maps"
"restore-cursor@3.1.0","MIT","https://github.com/sindresorhus/restore-cursor"
"run-async@2.4.1","MIT","https://github.com/SBoudrias/run-async"
"rxjs@7.8.2","Apache-2.0","https://github.com/reactivex/rxjs"
"safe-buffer@5.2.1","MIT","https://github.com/feross/safe-buffer"
"safer-buffer@2.1.2","MIT","https://github.com/ChALkeR/safer-buffer"
"signal-exit@3.0.7","ISC","https://github.com/tapjs/signal-exit"
"string-width@4.2.3","MIT","https://github.com/sindresorhus/string-width"
"string_decoder@1.3.0","MIT","https://github.com/nodejs/string_decoder"
"strip-ansi@6.0.1","MIT","https://github.com/chalk/strip-ansi"
"supports-color@7.2.0","MIT","https://github.com/chalk/supports-color"
"through@2.3.8","MIT","https://github.com/dominictarr/through"
"tmp@0.0.33","MIT","https://github.com/raszi/node-tmp"
"tslib@2.8.1","0BSD","https://github.com/Microsoft/tslib"
"tsx@4.21.0","MIT","https://github.com/privatenumber/tsx"
"type-fest@0.21.3","(MIT OR CC0-1.0)","https://github.com/sindresorhus/type-fest"
"typescript@5.9.3","Apache-2.0","https://github.com/microsoft/TypeScript"
"undici-types@7.18.2","MIT","https://github.com/nodejs/undici"
"util-deprecate@1.0.2","MIT","https://github.com/TooTallNate/util-deprecate"
"wcwidth@1.0.1","MIT","https://github.com/timoxley/wcwidth"
"wrap-ansi@7.0.0","MIT","https://github.com/chalk/wrap-ansi"
"yaml@2.8.2","ISC","https://github.com/eemeli/yaml"
"zod@4.3.6","MIT","https://github.com/colinhacks/zod"
"@chroma-core/ai-embeddings-common@0.1.10","UNKNOWN",""
"@chroma-core/default-embed@0.1.9","Custom: http://localhost",""
"@hono/node-server@1.19.10","MIT","https://github.com/honojs/node-server"
"@huggingface/jinja@0.5.5","MIT","https://github.com/huggingface/huggingface.js"
"@huggingface/transformers@3.8.1","Apache-2.0","https://github.com/huggingface/transformers.js"
"@img/colour@1.1.0","MIT","https://github.com/lovell/colour"
"@img/sharp-libvips-linux-x64@1.2.4","LGPL-3.0-or-later","https://github.com/lovell/sharp-libvips"
"@img/sharp-libvips-linuxmusl-x64@1.2.4","LGPL-3.0-or-later","https://github.com/lovell/sharp-libvips"
"@img/sharp-linux-x64@0.34.5","Apache-2.0","https://github.com/lovell/sharp"
"@img/sharp-linuxmusl-x64@0.34.5","Apache-2.0","https://github.com/lovell/sharp"
"@isaacs/fs-minipass@4.0.1","ISC","https://github.com/npm/fs-minipass"
"@modelcontextprotocol/sdk@1.27.1","MIT","https://github.com/modelcontextprotocol/typescript-sdk"
"@protobufjs/aspromise@1.1.2","BSD-3-Clause","https://github.com/dcodeIO/protobuf.js"
"@protobufjs/base64@1.1.2","BSD-3-Clause","https://github.com/dcodeIO/protobuf.js"
"@protobufjs/codegen@2.0.4","BSD-3-Clause","https://github.com/dcodeIO/protobuf.js"
"@protobufjs/eventemitter@1.1.0","BSD-3-Clause","https://github.com/dcodeIO/protobuf.js"
"@protobufjs/fetch@1.1.0","BSD-3-Clause","https://github.com/dcodeIO/protobuf.js"
"@protobufjs/float@1.0.2","BSD-3-Clause","https://github.com/dcodeIO/protobuf.js"
"@protobufjs/inquire@1.1.0","BSD-3-Clause","https://github.com/dcodeIO/protobuf.js"
"@protobufjs/path@1.1.2","BSD-3-Clause","https://github.com/dcodeIO/protobuf.js"
"@protobufjs/pool@1.1.0","BSD-3-Clause","https://github.com/dcodeIO/protobuf.js"
"@protobufjs/utf8@1.1.0","BSD-3-Clause","https://github.com/dcodeIO/protobuf.js"
"@types/node@20.19.35","MIT","https://github.com/DefinitelyTyped/DefinitelyTyped"
"accepts@2.0.0","MIT","https://github.com/jshttp/accepts"
"agenticflow-memory-mcp@0.2.0","UNKNOWN",""
"ajv-formats@3.0.1","MIT","https://github.com/ajv-validator/ajv-formats"
"ajv@8.18.0","MIT","https://github.com/ajv-validator/ajv"
"anymatch@3.1.3","ISC","https://github.com/micromatch/anymatch"
"argparse@1.0.10","MIT","https://github.com/nodeca/argparse"
"binary-extensions@2.3.0","MIT","https://github.com/sindresorhus/binary-extensions"
"body-parser@2.2.2","MIT","https://github.com/expressjs/body-parser"
"boolean@3.2.0","MIT","https://github.com/thenativeweb/boolean"
"braces@3.0.3","MIT","https://github.com/micromatch/braces"
"bytes@3.1.2","MIT","https://github.com/visionmedia/bytes.js"
"call-bind-apply-helpers@1.0.2","MIT","https://github.com/ljharb/call-bind-apply-helpers"
"call-bound@1.0.4","MIT","https://github.com/ljharb/call-bound"
"chokidar@3.6.0","MIT","https://github.com/paulmillr/chokidar"
"chownr@3.0.0","BlueOak-1.0.0","https://github.com/isaacs/chownr"
"chromadb-js-bindings-linux-x64-gnu@1.3.1","MIT","https://github.com/chroma-core/chroma"
"chromadb@3.3.1","Apache-2.0",""
"content-disposition@1.0.1","MIT","https://github.com/jshttp/content-disposition"
"content-type@1.0.5","MIT","https://github.com/jshttp/content-type"
"cookie-signature@1.2.2","MIT","https://github.com/visionmedia/node-cookie-signature"
"cookie@0.7.2","MIT","https://github.com/jshttp/cookie"
"cors@2.8.6","MIT","https://github.com/expressjs/cors"
"cross-spawn@7.0.6","MIT","https://github.com/moxystudio/node-cross-spawn"
"debug@4.4.3","MIT","https://github.com/debug-js/debug"
"define-data-property@1.1.4","MIT","https://github.com/ljharb/define-data-property"
"define-properties@1.2.1","MIT","https://github.com/ljharb/define-properties"
"depd@2.0.0","MIT","https://github.com/dougwilson/nodejs-depd"
"detect-libc@2.1.2","Apache-2.0","https://github.com/lovell/detect-libc"
"detect-node@2.1.0","MIT","https://github.com/iliakan/detect-node"
"dunder-proto@1.0.1","MIT","https://github.com/es-shims/dunder-proto"
"ee-first@1.1.1","MIT","https://github.com/jonathanong/ee-first"
"encodeurl@2.0.0","MIT","https://github.com/pillarjs/encodeurl"
"es-define-property@1.0.1","MIT","https://github.com/ljharb/es-define-property"
"es-errors@1.3.0","MIT","https://github.com/ljharb/es-errors"
"es-object-atoms@1.1.1","MIT","https://github.com/ljharb/es-object-atoms"
"es6-error@4.1.1","MIT","https://github.com/bjyoungblood/es6-error"
"escape-html@1.0.3","MIT","https://github.com/component/escape-html"
"escape-string-regexp@4.0.0","MIT","https://github.com/sindresorhus/escape-string-regexp"
"esprima@4.0.1","BSD-2-Clause","https://github.com/jquery/esprima"
"etag@1.8.1","MIT","https://github.com/jshttp/etag"
"eventsource-parser@3.0.6","MIT","https://github.com/rexxars/eventsource-parser"
"eventsource@3.0.7","MIT","git://git@github.com/EventSource/eventsource"
"express-rate-limit@8.2.1","MIT","https://github.com/express-rate-limit/express-rate-limit"
"express@5.2.1","MIT","https://github.com/expressjs/express"
"extend-shallow@2.0.1","MIT","https://github.com/jonschlinkert/extend-shallow"
"fast-deep-equal@3.1.3","MIT","https://github.com/epoberezkin/fast-deep-equal"
"fast-uri@3.1.0","BSD-3-Clause","https://github.com/fastify/fast-uri"
"fill-range@7.1.1","MIT","https://github.com/jonschlinkert/fill-range"
"finalhandler@2.1.1","MIT","https://github.com/pillarjs/finalhandler"
"flatbuffers@1.12.0","Apache*","https://github.com/google/flatbuffers"
"flatbuffers@25.9.23","Apache-2.0","https://github.com/google/flatbuffers"
"forwarded@0.2.0","MIT","https://github.com/jshttp/forwarded"
"fresh@2.0.0","MIT","https://github.com/jshttp/fresh"
"function-bind@1.1.2","MIT","https://github.com/Raynos/function-bind"
"get-intrinsic@1.3.0","MIT","https://github.com/ljharb/get-intrinsic"
"get-proto@1.0.1","MIT","https://github.com/ljharb/get-proto"
"glob-parent@5.1.2","ISC","https://github.com/gulpjs/glob-parent"
"global-agent@3.0.0","BSD-3-Clause","https://github.com/gajus/global-agent"
"globalthis@1.0.4","MIT","https://github.com/ljharb/System.global"
"gopd@1.2.0","MIT","https://github.com/ljharb/gopd"
"gray-matter@4.0.3","MIT","https://github.com/jonschlinkert/gray-matter"
"guid-typescript@1.0.9","ISC","https://github.com/NicolasDeveloper/guid-typescript"
"has-property-descriptors@1.0.2","MIT","https://github.com/inspect-js/has-property-descriptors"
"has-symbols@1.1.0","MIT","https://github.com/inspect-js/has-symbols"
"hasown@2.0.2","MIT","https://github.com/inspect-js/hasOwn"
"hono@4.12.4","MIT","https://github.com/honojs/hono"
"http-errors@2.0.1","MIT","https://github.com/jshttp/http-errors"
"iconv-lite@0.7.2","MIT","https://github.com/pillarjs/iconv-lite"
"inherits@2.0.4","ISC","https://github.com/isaacs/inherits"
"ip-address@10.0.1","MIT","https://github.com/beaugunderson/ip-address"
"ipaddr.js@1.9.1","MIT","https://github.com/whitequark/ipaddr.js"
"is-binary-path@2.1.0","MIT","https://github.com/sindresorhus/is-binary-path"
"is-extendable@0.1.1","MIT","https://github.com/jonschlinkert/is-extendable"
"is-extglob@2.1.1","MIT","https://github.com/jonschlinkert/is-extglob"
"is-glob@4.0.3","MIT","https://github.com/micromatch/is-glob"
"is-number@7.0.0","MIT","https://github.com/jonschlinkert/is-number"
"is-promise@4.0.0","MIT","https://github.com/then/is-promise"
"isexe@2.0.0","ISC","https://github.com/isaacs/isexe"
"jose@6.1.3","MIT","https://github.com/panva/jose"
"js-yaml@3.14.2","MIT","https://github.com/nodeca/js-yaml"
"json-schema-traverse@1.0.0","MIT","https://github.com/epoberezkin/json-schema-traverse"
"json-schema-typed@8.0.2","BSD-2-Clause","https://github.com/RemyRylan/json-schema-typed"
"json-stringify-safe@5.0.1","ISC","https://github.com/isaacs/json-stringify-safe"
"kind-of@6.0.3","MIT","https://github.com/jonschlinkert/kind-of"
"long@5.3.2","Apache-2.0","https://github.com/dcodeIO/long.js"
"matcher@3.0.0","MIT","https://github.com/sindresorhus/matcher"
"math-intrinsics@1.1.0","MIT","https://github.com/es-shims/math-intrinsics"
"media-typer@1.1.0","MIT","https://github.com/jshttp/media-typer"
"merge-descriptors@2.0.0","MIT","https://github.com/sindresorhus/merge-descriptors"
"mime-db@1.54.0","MIT","https://github.com/jshttp/mime-db"
"mime-types@3.0.2","MIT","https://github.com/jshttp/mime-types"
"minipass@7.1.3","BlueOak-1.0.0","https://github.com/isaacs/minipass"
"minizlib@3.1.0","MIT","https://github.com/isaacs/minizlib"
"ms@2.1.3","MIT","https://github.com/vercel/ms"
"negotiator@1.0.0","MIT","https://github.com/jshttp/negotiator"
"normalize-path@3.0.0","MIT","https://github.com/jonschlinkert/normalize-path"
"object-assign@4.1.1","MIT","https://github.com/sindresorhus/object-assign"
"object-inspect@1.13.4","MIT","https://github.com/inspect-js/object-inspect"
"object-keys@1.1.1","MIT","https://github.com/ljharb/object-keys"
"on-finished@2.4.1","MIT","https://github.com/jshttp/on-finished"
"once@1.4.0","ISC","https://github.com/isaacs/once"
"onnxruntime-common@1.20.1","MIT","https://github.com/Microsoft/onnxruntime"
"onnxruntime-common@1.21.0","MIT","https://github.com/Microsoft/onnxruntime"
"onnxruntime-common@1.22.0-dev.20250409-89f8206ba4","MIT","https://github.com/Microsoft/onnxruntime"
"onnxruntime-node@1.21.0","MIT","https://github.com/Microsoft/onnxruntime"
"onnxruntime-web@1.20.1","MIT","https://github.com/Microsoft/onnxruntime"
"onnxruntime-web@1.22.0-dev.20250409-89f8206ba4","MIT","https://github.com/Microsoft/onnxruntime"
"parseurl@1.3.3","MIT","https://github.com/pillarjs/parseurl"
"path-key@3.1.1","MIT","https://github.com/sindresorhus/path-key"
"path-to-regexp@8.3.0","MIT","https://github.com/pillarjs/path-to-regexp"
"picomatch@2.3.1","MIT","https://github.com/micromatch/picomatch"
"pkce-challenge@5.0.1","MIT","https://github.com/crouchcd/pkce-challenge"
"platform@1.3.6","MIT","https://github.com/bestiejs/platform.js"
"protobufjs@7.5.4","BSD-3-Clause","https://github.com/protobufjs/protobuf.js"
"proxy-addr@2.0.7","MIT","https://github.com/jshttp/proxy-addr"
"qs@6.15.0","BSD-3-Clause","https://github.com/ljharb/qs"
"range-parser@1.2.1","MIT","https://github.com/jshttp/range-parser"
"raw-body@3.0.2","MIT","https://github.com/stream-utils/raw-body"
"readdirp@3.6.0","MIT","https://github.com/paulmillr/readdirp"
"require-from-string@2.0.2","MIT","https://github.com/floatdrop/require-from-string"
"roarr@2.15.4","BSD-3-Clause","https://github.com/gajus/roarr"
"router@2.2.0","MIT","https://github.com/pillarjs/router"
"safer-buffer@2.1.2","MIT","https://github.com/ChALkeR/safer-buffer"
"section-matter@1.0.0","MIT","https://github.com/jonschlinkert/section-matter"
"semver-compare@1.0.0","MIT","https://github.com/substack/semver-compare"
"semver@7.7.4","ISC","https://github.com/npm/node-semver"
"send@1.2.1","MIT","https://github.com/pillarjs/send"
"serialize-error@7.0.1","MIT","https://github.com/sindresorhus/serialize-error"
"serve-static@2.2.1","MIT","https://github.com/expressjs/serve-static"
"setprototypeof@1.2.0","ISC","https://github.com/wesleytodd/setprototypeof"
"sharp@0.34.5","Apache-2.0","https://github.com/lovell/sharp"
"shebang-command@2.0.0","MIT","https://github.com/kevva/shebang-command"
"shebang-regex@3.0.0","MIT","https://github.com/sindresorhus/shebang-regex"
"side-channel-list@1.0.0","MIT","https://github.com/ljharb/side-channel-list"
"side-channel-map@1.0.1","MIT","https://github.com/ljharb/side-channel-map"
"side-channel-weakmap@1.0.2","MIT","https://github.com/ljharb/side-channel-weakmap"
"side-channel@1.1.0","MIT","https://github.com/ljharb/side-channel"
"sprintf-js@1.0.3","BSD-3-Clause","https://github.com/alexei/sprintf.js"
"sprintf-js@1.1.3","BSD-3-Clause","https://github.com/alexei/sprintf.js"
"statuses@2.0.2","MIT","https://github.com/jshttp/statuses"
"strip-bom-string@1.0.0","MIT","https://github.com/jonschlinkert/strip-bom-string"
"tar@7.5.10","BlueOak-1.0.0","https://github.com/isaacs/node-tar"
"to-regex-range@5.0.1","MIT","https://github.com/micromatch/to-regex-range"
"toidentifier@1.0.1","MIT","https://github.com/component/toidentifier"
"type-fest@0.13.1","(MIT OR CC0-1.0)","https://github.com/sindresorhus/type-fest"
"type-is@2.0.1","MIT","https://github.com/jshttp/type-is"
"undici-types@6.21.0","MIT","https://github.com/nodejs/undici"
"unpipe@1.0.0","MIT","https://github.com/stream-utils/unpipe"
"vary@1.1.2","MIT","https://github.com/jshttp/vary"
"which@2.0.2","ISC","https://github.com/isaacs/node-which"
"wrappy@1.0.2","ISC","https://github.com/npm/wrappy"
"yallist@5.0.0","BlueOak-1.0.0","https://github.com/isaacs/yallist"
"zod-to-json-schema@3.25.1","ISC","https://github.com/StefanTerdell/zod-to-json-schema"
"zod@3.25.76","MIT","https://github.com/colinhacks/zod"