Automate the frontend third-party licence inventory

THIRD_PARTY_LICENSES.txt

@@ -33,7 +33,7 @@ OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
 SOFTWARE.
 
 lucide-react 1.46.0
---------------------
+-------------------
 License: ISC
 Source: https://github.com/lucide-icons/lucide
 
@@ -84,7 +84,7 @@ SOFTWARE.
 react 19.3.0, react-dom 19.3.0, scheduler 0.28.0
 ------------------------------------------------
 License: MIT
-Source: https://github.com/facebook/react
+Source: https://github.com/react/react
 
 MIT License
 

docs/proposed-license-automation.md

@@ -0,0 +1,78 @@
+# Proposed CI wiring for `scripts/generate-frontend-licenses.mjs`
+
+This repo's `.github/` workflows are intentionally untouched by the change that
+added `scripts/generate-frontend-licenses.mjs`. This document is the proposal
+for wiring it in, for a maintainer to review and apply.
+
+## What already works without any CI change
+
+`ci.yml`'s `frontend` job already runs `corepack pnpm run license:check`
+(`check-license-metadata.mjs` + `check-dependency-inventory.mjs --frontend`),
+and `license:all` runs in the release workflow. Both keep failing a Dependabot
+PR exactly as before until `THIRD_PARTY_LICENSES.txt` is regenerated — the
+generator does not change what CI enforces, only how a human (or a bot)
+satisfies it: `corepack pnpm run license:generate:frontend` now does in one
+command what used to be a hand-edit.
+
+## Gap 1 (pre-existing, not introduced by this change): the `bundle` path filter
+
+`ci.yml` line 66 decides whether the bundle/license jobs run by grepping
+`changed_files` against an explicit allowlist. That allowlist already omits
+`scripts/generate-rust-licenses.mjs` — a change to the Rust generator alone
+does not mark `bundle=true` — and the same gap now applies to
+`scripts/generate-frontend-licenses.mjs`. In practice this is low-risk (the
+generators are touched rarely and almost always alongside `package.json` /
+`pnpm-lock.yaml`, which are already in the allowlist), but it is a real gap.
+Proposed fix, folded into the existing regex on line 66:
+
+```diff
+- scripts/(capture-package-log(\.test)?\.py|check-mcpb-bundle(\.test)?\.py|package-mcpb\.mjs|check-license-metadata\.mjs|check-dependency-inventory\.mjs|check-windows-bundle-resources\.ps1|check-macos-bundle-resources(\.mutation)?\.mjs)$
++ scripts/(capture-package-log(\.test)?\.py|check-mcpb-bundle(\.test)?\.py|package-mcpb\.mjs|check-license-metadata\.mjs|check-dependency-inventory\.mjs|generate-rust-licenses\.mjs|generate-frontend-licenses(\.test)?\.mjs|check-windows-bundle-resources\.ps1|check-macos-bundle-resources(\.mutation)?\.mjs)$
+```
+
+## Gap 2 (the actual manual-regeneration tax): nothing regenerates the file for you
+
+Today a Dependabot PR that bumps a frontend dependency still needs a human to
+run the generator and push a commit before `license:check` goes green. The
+generator makes that a one-line, no-judgment-calls command, so it is a good
+candidate for a bot step. Proposed addition to `ci.yml`'s `frontend` job (or a
+separate `dependabot`-triggered job — either works; shown here as a step
+appended to the existing job, gated so it only ever runs for Dependabot's own
+branches and never mutates a human-authored PR silently):
+
+```yaml
+      - run: corepack pnpm install --frozen-lockfile
+      - run: corepack pnpm run license:generate:frontend
+      - name: Fail if the frontend license inventory needed regeneration
+        if: github.actor != 'dependabot[bot]'
+        run: git diff --exit-code -- THIRD_PARTY_LICENSES.txt
+      - name: Commit regenerated frontend license inventory
+        if: github.actor == 'dependabot[bot]' && !cancelled()
+        run: |
+          if ! git diff --quiet -- THIRD_PARTY_LICENSES.txt; then
+            git config user.name "github-actions[bot]"
+            git config user.email "github-actions[bot]@users.noreply.github.com"
+            git add THIRD_PARTY_LICENSES.txt
+            git commit -m "chore(licenses): regenerate frontend inventory"
+            git push "https://x-access-token:${{ secrets.GITHUB_TOKEN }}@github.com/${{ github.repository }}.git" "HEAD:${{ github.head_ref }}"
+          fi
+      - run: corepack pnpm run license:check
+```
+
+Notes for whoever applies this:
+
+- Dependabot PRs from forks (n/a here, since this repo's Dependabot runs
+  against the base repo directly) would need `pull_request_target` plus the
+  usual secret-exposure caution; verify this repo's Dependabot config before
+  copying the push step as-is.
+- The default `GITHUB_TOKEN` needs `contents: write` on that job, and pushing
+  to a PR branch from an Actions run must not be blocked by branch protection
+  on Dependabot's branch naming pattern (`dependabot/npm_and_yarn/*`).
+- For a non-Dependabot PR, the added `git diff --exit-code` step turns a stale
+  inventory into a clear, fast CI failure ("run `pnpm run
+  license:generate:frontend` and commit the result") instead of the opaque
+  `check-dependency-inventory.mjs` drift error a contributor currently has to
+  interpret and fix by hand.
+- The same shape (regenerate, diff-or-commit, then re-check) applies to
+  `license:generate:rust` / `THIRD_PARTY_LICENSES_RUST.txt`, which already
+  exists but has never been wired into CI this way either.

docs/tally/compatibility/compatibility-matrix.json

@@ -1,7 +1,7 @@
 {
   "schema_version": 1,
   "bridge_commit_sha": "be1c20cc3fd66fa1ece196505c69f26e555e4b8e",
-  "compatibility_surface_sha256": "a977c0285c14820e3c9c81aaeb50fc40563db6426eb88717f94c25750946e707",
+  "compatibility_surface_sha256": "e294f9541a46e062b2c885d1c1b8b6e20a63ed7a6a5a2d52f45948fd81fffbff",
   "claims": [
     {
       "claim_id": "erp9-6-6-3-windows-education-xml-one-company",

docs/tally/compatibility/compatibility-surface.json

@@ -75,7 +75,7 @@
     },
     {
       "path": "package.json",
-      "sha256": "c73c1dd799523dcd375ab47f960f39e936ec92df0b7a70eee4d906113588461f"
+      "sha256": "af1b7f10a440eb7765d2adbed38939f7fd672f8ad3b61361d1330071f5f9c6e9"
     },
     {
       "path": "pnpm-lock.yaml",
@@ -850,5 +850,5 @@
       "sha256": "a8ac2714fecf51947f2822c8c46d7ce2e8602c732780ff60566a7771f0836f9a"
     }
   ],
-  "manifest_sha256": "a977c0285c14820e3c9c81aaeb50fc40563db6426eb88717f94c25750946e707"
+  "manifest_sha256": "e294f9541a46e062b2c885d1c1b8b6e20a63ed7a6a5a2d52f45948fd81fffbff"
 }

package.json

@@ -44,7 +44,9 @@
     "license:check": "node scripts/check-license-metadata.mjs && node scripts/check-dependency-inventory.mjs --frontend",
     "license:rust": "node scripts/check-dependency-inventory.mjs --rust",
     "license:all": "node scripts/check-license-metadata.mjs && node scripts/check-dependency-inventory.mjs",
-    "license:generate:rust": "node scripts/generate-rust-licenses.mjs"
+    "license:generate:rust": "node scripts/generate-rust-licenses.mjs",
+    "license:generate:frontend": "node scripts/generate-frontend-licenses.mjs",
+    "license:generate": "node scripts/generate-rust-licenses.mjs && node scripts/generate-frontend-licenses.mjs"
   },
   "dependencies": {
     "@tauri-apps/api": "^2.11.0",