Skip to content

ci: check dependency licenses - #9

Merged
PHPCraftdream merged 14 commits into
mainfrom
ci/license-compliance
Nov 2, 2026
Merged

ci: check dependency licenses#9
PHPCraftdream merged 14 commits into
mainfrom
ci/license-compliance

Conversation

@PHPCraftdream

@PHPCraftdream PHPCraftdream commented Oct 28, 2026 •
edited
Loading

Copy link
Copy Markdown
Contributor

Summary

  • Check Cargo, npm and all discovered NuGet project dependencies with fail-closed policies.
  • Recognize verified MIT license metadata for the exact NETStandard.Library 2.0.0 and 2.0.3 packages, with source-license hash and package URL checks.
  • Include LICENSE-MIT and LICENSE-APACHE in the NuGet package; verify their exact bytes in a pack test. Published 0.8.1 links to those files in README but does not include them.

Dependency and limitations

This PR is stacked on #10, which privately resolves Microsoft.NETCore.Platforms 3.1.0 for library and test graphs. The override does not propagate downstream, and RID graphs differ; review #10 before merge. Third-party native binary notices and distribution obligations are not yet fully verified.

Verification

The CI merge of head 5d151f8e5a2f3f66f8255403973a4368b3e916b7 with base bfd31cb0586d1296307056b998b4ed87ac34ef08 passed 5/5 checks. The base PR passed its full CI separately. No local tests or builds were run.

🤖 Generated with Claude Code

PHPCraftdream and others added 2 commits October 28, 2026 15:55
@PHPCraftdream @claude
ci: add Cargo license policy
28a7d98 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@PHPCraftdream @claude
ci: check Cargo npm and NuGet licenses
cbb31bd 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@PHPCraftdream
PHPCraftdream changed the base branch from main to fix/mit-platform-resolution October 28, 2026 16:58
PHPCraftdream and others added 2 commits October 28, 2026 17:59
@PHPCraftdream @claude
ci: verify NETStandard license metadata
a4db0b9 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@PHPCraftdream @claude
ci: verify legacy NETStandard license versions
08ecfae 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@PHPCraftdream PHPCraftdream mentioned this pull request Oct 28, 2026
Merged
PHPCraftdream and others added 9 commits October 28, 2026 20:39
@PHPCraftdream @claude
fix: include license files in NuGet package
5d151f8 
Co-Authored-By: Claude Sonnet 5.5 <noreply@anthropic.com>
@PHPCraftdream @claude
ci: embed source-backed notices in C# native assets
c031962 
Verify the exact published 0.8.1 native source in a shared six-target
workflow with Cargo/std/Zig notices, actual resource and map gates and
managed host tests. Preserve raw release names and expose companion
notices outside each RID native directory for NuGet packing.

Keep managed target frameworks, package versions and existing MIT
platform-resolution work unchanged. No release or publication is invoked.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@PHPCraftdream @claude
ci: run full checks for stacked license pull requests
ca6b4ad 
Do not restrict pull-request CI to the main target when license changes
are stacked on the platform-resolution branch. Bind RID notice manifests
to the exact source commit for subsequent native-bearing NuGet checks.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@PHPCraftdream @claude
ci: verify notices in the actual native-bearing NuGet
8f32e2e 
Share one exact-source NuGet pack path between PR checks and production.
Apply only the reviewed own-license items and MIT platform metadata
overlay, rejecting unrelated project or framework changes.

Require exact native inventory, correct CPUs, source-bound manifests and
embedded/plain/staged notice equality in the final package. Add negative
guard coverage and keep audit evidence outside published artifacts.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@PHPCraftdream @claude
ci(licenses): bind C# native compiler grants to exact source
5807cf0 
Include the verified Rust 1.99.1 compiler-builtins, LLVM compiler-rt
and libm collection in native Cargo/std notices. Preserve fourteen
complete original materials, four full legal/credits documents and
exact source, Git blob and SHA256 identities. Keep the compiler-builtins
MIT AND Apache-2.0 WITH LLVM-exception expression unchanged.

Stage the collector, profile, originals and regression tests before the
original-source checkout in the shared native producer. Preserve all
previous Cargo,
std, Zig/runtime, resource and source fields, parser APIs and versions.

This is a conservative compiler-source collection, not a linked-code
inventory, MSVC/SDK terms approval or historical package repair.
No local build/test, tag/release or publication is performed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@PHPCraftdream @claude
ci(licenses): verify genuine Windows GNU C sharp candidates
cda0a67 
Add source-specific x64 and ARM64 GNU/LLVM C ABI candidates for original
C# 0.8.1 source and its reviewed registry-core lock. Preserve all current
production/RID/NuGet workflows, managed frameworks and dependency/API
versions; only the existing reviewed notice metadata hook is grafted.

Bind exact SDK inputs, retained COFF objects, original runtime grants,
Rust 1.99.1 compiler originals and singleton DLL resources. Execute
unchanged .NET8/native spec tests on genuine matching x64/ARM64 runners
with exact DLL identity, native host/test target and no Rust/SDK paths.

This establishes a candidate, not final NuGet assembly, publication,
MSVC grant acceptance or historical asset repair. No local build/test.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@PHPCraftdream @claude
ci(licenses): prepare GNU C sharp raw and RID payloads
999548e 
Reuse the verified original-source GNU producer in shared native
preparation, replacing only the two Windows MSVC distribution rows.
Preserve the other four targets, public filenames, exact source pins,
NuGet six-RID layout, managed frameworks and publication gates.

Require genuine x64 and ARM64 .NET consumers before staging raw DLLs
and RID payloads. Preserve complete embedded and adjacent compiler,
runtime and source grant materials with actual source/input hashes.
Add negative CI regressions for mandatory delivery and consumer gates.

NuGet assembly and byte verification use the existing owning workflow.
No local builds/tests, API or version changes, publication, tag, release,
merge, deployment, Microsoft agreement acceptance or historical repair.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@PHPCraftdream @claude
docs(licenses): generate C sharp GNU runtime proposal
4443444 
Generate and check the additive EN/RU/ZH runtime-support paragraph only
in CI, at this repository's actual README output paths. Record exact
source-unit and generated-file hashes for independent readback before
committing source and generated docs together.

Keep native producers, consumers, source pins, framework/API versions,
NuGet preparation and publication gates unchanged. No local generator,
package publication, merge, deployment or historical asset overwrite.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@PHPCraftdream @claude
docs: describe verified Windows GNU C# native delivery
ab82426 
Commit the reviewed EN/RU/ZH runtime source unit and its byte-exact
CI-generated Markdown at the repository's existing localized paths.
Document actual GNU/LLVM targets, unchanged compatibility asset names,
Windows system/UCRT dependencies and complete embedded/adjacent original
compiler and runtime grant texts. Keep historical published binaries
explicitly outside this candidate's repair scope.

The proposal was generated and checked in successful exact-head CI,
then verified against its source-unit and per-file hashes. Existing
generated content is unchanged. Remove only the temporary proposal
fixture and generation job; preserve the shared producers, all genuine
C# consumers, six distribution roles and publication guards.

No local documentation generator, build or tests, version bump,
release/registry publication, tag, merge or deployment is performed.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@PHPCraftdream
PHPCraftdream changed the base branch from fix/mit-platform-resolution to main November 2, 2026 12:35
@PHPCraftdream
PHPCraftdream marked this pull request as ready for review November 2, 2026 12:36
@PHPCraftdream
PHPCraftdream merged commit 7424287 into main Nov 2, 2026
29 checks passed
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

No reviews

Assignees

No one assigned

Labels

None yet

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

1 participant

@PHPCraftdream