semaphore-third-party-licenses

Automate third-party license attribution by running a collect and generate workflow that extracts raw license data from Go and npm dependencies, checks compliance policy, and renders a human-friendly THIRD-PARTY-LICENSES.md file. It handles both backend and frontend production dependencies automatically.

An SBOM-like inventory for OSS licenses is a comprehensive list of all third-party dependency names, versions, licenses, and sources. You need to generate one when satisfying customer compliance requirements, performing audits after adding dependencies, or fulfilling OSS attribution agreements.

This license compliance workflow focuses primarily on production dependencies for both the Go backend and Vue.js frontend. However, it does provide optional dev-dependency analysis to give you a more comprehensive view of your project's OSS license landscape if needed.

Enforce OSS license policy and generate a NOTICE file by collecting raw data with go-licenses and license-checker, validating the results against a Python policy script, and rendering the final markdown attribution document through the standard generate workflow.

The best way to update OSS notices after adding new dependencies is to trigger the standard license-collection workflow, which re-scans your Go and npm dependency trees, validates them against your compliance policy, and regenerates the THIRD-PARTY-LICENSES.md file.

Your generated license attribution file fails the compliance check when scripts/check_policy.py detects restricted or incompatible OSS licenses within your collected Go or npm dependencies. You must review the policy violations and remove or replace the non-compliant third-party packages.