License Drift: The Compliance Incident That Never Files a Ticket

// Runs after `npm ls --all --json` produces the resolved dependency tree.
// Fails the pipeline on any denylisted or unreviewed license.

import { readFileSync } from "fs";

type Policy = {
  allow: string[];
  review: string[];
  deny: string[];
};

type DependencyRecord = {
  name: string;
  version: string;
  license: string;
};

function classify(dep: DependencyRecord, policy: Policy): string {
  if (policy.deny.includes(dep.license)) return "DENY";
  if (policy.review.includes(dep.license)) return "REVIEW";
  if (policy.allow.includes(dep.license)) return "ALLOW";
  return "UNKNOWN"; // unrecognized license — treat as a gate failure, not a pass
}

function runGate() {
  const policy: Policy = JSON.parse(readFileSync("license-policy.json", "utf-8"));
  const deps: DependencyRecord[] = JSON.parse(readFileSync("resolved-deps.json", "utf-8"));

  const denied = deps.filter(d => classify(d, policy) === "DENY");
  const unknown = deps.filter(d => classify(d, policy) === "UNKNOWN");
  const review = deps.filter(d => classify(d, policy) === "REVIEW");

  if (review.length) {
    console.log(`${review.length} dependencies require manual review — routing to #license-review.`);
  }

  if (denied.length || unknown.length) {
    console.error("License gate failed:");
    [...denied, ...unknown].forEach(d =>
      console.error(`  ${d.name}@${d.version} — ${d.license}`)
    );
    process.exit(1);
  }

  console.log("License gate passed.");
}

runGate();