skills.rest
thachrocky12345
thachrocky12345COMMUNITY
Explore all skills by this author →
GitHub

notice-generate

Generate NOTICE attribution files for model, JS, Python, and C++ dependencies across a monorepo.

Updated May 11, 2026
Search Tags:#monorepo#attribution#spdx#license compliance#vcpkg#dependency scanning#notice
One-click install
npx skills add https://github.com/thachrocky12345/local-agent-train-workstation --skill notice-generate-thachrocky12345
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: notice-generate
Source: https://github.com/thachrocky12345/local-agent-train-workstation/tree/main/qvac/.cursor/skills/notice-generate
Command: npx skills add https://github.com/thachrocky12345/local-agent-train-workstation --skill notice-generate-thachrocky12345

SYSTEM DOCUMENTATION & REQUIREMENTS

💡 This Skill requires license-checker, pip-licenses, and includes scripts (resource) components.

What problem does it solve? Keeping third-party license attributions accurate across a large monorepo is tedious and error-prone. This Skill automates the generation of deterministic, sorted NOTICE files covering model, JavaScript, Python, and C++ dependencies for every package. ## Core Features & Use Cases - NOTICE Generation: Scans npm dependencies via license-checker, Python deps via pip-licenses, C++ deps via vcpkg portfiles and the GitHub API, and model attributions from models.prod.json, then writes per-package NOTICE files. - License Compliance Checking: Validates all discovered licenses against a configurable SPDX allowlist and writes FORBIDDEN_LICENSES.txt when violations are found. - License Overview Reports: Aggregates existing NOTICE files into NOTICE_FULL_REPORT.txt with global license distribution and per-package breakdowns. - Use Case: Before a release, run the generator with --all to refresh every package's NOTICE file, then review the diff and commit manually. ## Quick Start Ask the assistant to generate NOTICE files for all packages in the monorepo, or for a specific package such as sdk.

Frequently Asked Questions about notice-generate

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
How do I generate NOTICE files for all packages in a monorepo?▼

Source the .env file with GH_TOKEN, HF_TOKEN, and NPM_TOKEN, then run generate-notice.js with the --all flag. It scans models, JS, Python, and C++ dependencies and writes a sorted NOTICE file into each package directory.

How do I check dependencies for disallowed licenses?▼

Run check-forbidden-licenses.js with --all to compare every dependency license against the ALLOWED_LICENSES allowlist in constants.js. License strings are normalized to canonical SPDX ids, and violations are written to FORBIDDEN_LICENSES.txt with exit code 1.

Can I preview NOTICE generation without writing files?▼

Yes, pass the --dry-run flag to generate-notice.js or check-forbidden-licenses.js. All scans run fully, but NOTICE content is printed to the console and no files are written to disk.

What dependency types does the NOTICE generator scan?▼

It scans four types: model attributions from models.prod.json, production npm dependencies via license-checker, Python dependencies via pip-licenses in a temporary virtualenv, and C++ vcpkg dependencies resolved through GitHub API portfile parsing.

Why does the NOTICE generator fail with missing environment variables?▼

The scripts require GH_TOKEN for GitHub API access, NPM_TOKEN for private npm registries, and HF_TOKEN for model license verification. Source the .env file before running, or the scripts exit with an error listing the missing variables.

Related Skills

Explore More Software Engineering Skills→
RaNDoM6913RaNDoM6913
1

dependency-checker

Audit dependency manifests across multi-language projects and generate phased update plans.

Community
Advanced
tethertotetherto
395

notice-generate

Generate deterministic NOTICE files for monorepo dependencies and licenses.

Official
Intermediate
ewtoddewtodd

github-pr-workflow

Automates the GitHub pull request lifecycle from branch creation through CI monitoring and merge.

Community
Advanced
DTMC-marketplaceDTMC-marketplace

license-compliance

Analyze open-source license compatibility and track compliance obligations.

Official
Advanced