check-licenses

Instructions

Announce at start: "I'm using the check-licenses skill."

Step 1 - Determine mode

Read LICENSE and check for a ## Third-Party Notices heading.

• Absent - full-scan mode: collect all direct dependencies from every go.mod in the workspace.
• Present - incremental mode: run git diff HEAD~1 -- $(find . -name go.mod -not -path '*/.worktrees/*' -not -path '*/vendor/*') to find added AND removed direct dependencies. If HEAD~1 does not exist (initial commit), fall back to full-scan mode.

In incremental mode:

• Lines prefixed with + that are direct deps → added (need to be verified and added to LICENSE).
• Lines prefixed with - that are direct deps → removed (their entries must be deleted from the ## Third-Party Notices section in LICENSE).

Also run:

git diff HEAD~1 -- Makefile

Scan the diff for changes to go install lines (anywhere in the file):

• Lines prefixed + matching go install: added build tools → add to docs/development-tools.md under ## Build tools.
• Lines prefixed - matching go install: removed build tools → remove from docs/development-tools.md only if the base module does NOT also appear in any go.mod.

Build tools are never added to LICENSE's ## Third-Party Notices section: that section is for libraries linked into the shipped locksmith binary, while build tools (linters, code generators) run only on the maintainer's machine. Tools fetched outside Makefile (npm packages, external MCP servers, agent skill packs) are out of scope for this skill - add them manually to the relevant section of docs/development-tools.md.

If neither go.mod nor Makefile has relevant changes, report "No dependency changes found" and stop.

Step 2 - Collect direct dependencies

Discover all go.mod files in the workspace by recursively searching all subdirectories:

find . -name go.mod -not -path '*/.worktrees/*' -not -path '*/vendor/*'

Parse each file found.

A line is a direct dependency if:

• It is inside a require (...) block or a single-line require
• It does NOT end with // indirect
• The module path does NOT start with github.com/lorem-dev/locksmith (those are internal replace targets, not third-party)

Deduplicate across files: if the same module path appears in multiple go.mod files, keep the entry once at the highest version seen. Use semantic version ordering (not lexicographic) to determine the highest version.

Step 2b - Collect Makefile build tools

Read Makefile. Find all lines matching the pattern:

go install <module-path>/cmd/<name>@<version-or-variable>

For each matching line:

1. Strip the /cmd/<name> suffix (everything from the last /cmd/ onward) to get the base module path.
2. If the version token is a Make variable reference like $(BUF_VERSION), resolve it by searching for BUF_VERSION := vX.Y.Z or BUF_VERSION ?= vX.Y.Z declarations in the same file.
3. If the base module path already appears in the go.mod deps collected in Step 2, skip it - it is already covered. If both have a version, keep the higher one using semantic version ordering.

Label surviving tools as (build tool) in the verification table in Step 3. Build tools skip the block-list check in Step 4 - they are never distributed with the software so copyleft restrictions do not apply to users. They are also written to docs/development-tools.md in Step 5, not to LICENSE.

Step 3 - Look up licenses and build the verification table

For each dependency, determine:

1. License SPDX identifier - Use the WebFetch tool to fetch https://pkg.go.dev/<module> and read the "Licenses" field from the page. If web access is unavailable, note the license as "unknown" and proceed to the user-confirmation step - the user can verify manually via the links shown. The field may contain a compound SPDX expression such as MIT AND Apache-2.0 or BSD-3-Clause OR MIT - record the full expression as-is.
2. License URL - direct link to the LICENSE file in the upstream repository at the tagged version. For github.com/<org>/<repo> modules this is https://github.com/<org>/<repo>/blob/<version>/LICENSE. For pseudo-versions (format: v0.0.0-YYYYMMDDHHMMSS-<commit-sha>), use the 12-character commit SHA suffix as the ref: https://github.com/<org>/<repo>/blob/<12-char-sha>/LICENSE. For golang.org/x/* modules the GitHub mirror is https://github.com/golang/<name> (e.g. golang.org/x/term -> github.com/golang/term). For google.golang.org/grpc use https://github.com/grpc/grpc-go. For google.golang.org/protobuf use https://github.com/protocolbuffers/protobuf-go.
3. NOTICE URL - check whether a NOTICE file exists at the same tagged version. Include only if it exists.

Display a Markdown table:

| Library                         | Version | License    | License URL                                                              |
|---------------------------------|---------|------------|--------------------------------------------------------------------------|
| github.com/charmbracelet/huh    | v1.0.0  | MIT        | https://github.com/charmbracelet/huh/blob/v1.0.0/LICENSE                 |
| ...                             | ...     | ...        | ...                                                                      |

Then ask:

"Please check each license via the links above. Reply yes to continue or no to abort."

Wait for an explicit yes or no. Do not proceed until the user responds. If the user replies no, stop immediately and make no changes.

Step 4 - Block-list check

After the user confirms, check each SPDX identifier for go.mod deps only against this list. Build tools collected in Step 2b are exempt - they are never distributed with the software, so copyleft restrictions do not apply.

If any go.mod dep matches the block-list, stop with an error naming the offending library and suggesting it be removed from go.mod. Do not modify any file.

GPL-2.0  GPL-2.0-only  GPL-2.0-or-later
GPL-3.0  GPL-3.0-only  GPL-3.0-or-later
AGPL-3.0  AGPL-3.0-only  AGPL-3.0-or-later
LGPL-2.1  LGPL-2.1-only  LGPL-2.1-or-later
LGPL-3.0  LGPL-3.0-only  LGPL-3.0-or-later
CC-BY-NC-4.0  (any -NC- variant)
SSPL-1.0
BSL-1.1
Commons Clause  (as a modifier on any license)

Licenses that are always acceptable: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, MPL-2.0, Unlicense, CC0-1.0, BlueOak-1.0.0.

Compound SPDX expressions (e.g. MIT AND Apache-2.0) are acceptable if every component is in the acceptable list above. Evaluate each component individually.

If a license identifier does not appear in either the block-list above or the acceptable list, treat it as unknown or ambiguous and stop to ask the user to verify it manually.

Step 5 - Update LICENSE (go.mod deps) and docs/development-tools.md (build tools)

Route each entry by kind:

• go.mod direct deps → LICENSE's ## Third-Party Notices section.
• Makefile build tools (collected in Step 2b) → docs/development-tools.md under ## Build tools. They are never written to LICENSE.

LICENSE (go.mod deps only)

If the ## Third-Party Notices section does not yet exist, append the following block at the very end of LICENSE (including the leading --- separator line). If the section already exists (incremental mode), edit the entries in place - do not add another separator.

The section header:

---

## Third-Party Notices

This project uses the following third-party libraries. Each library
retains its original copyright and is distributed under its respective
license.

Development-time tools (linters, code generators, AI agent helpers)
are **not** listed here because they are not linked into or shipped
with the `locksmith` binary. They are tracked separately in
[`docs/development-tools.md`](docs/development-tools.md).

For each go.mod dep, add an entry sorted alphabetically by module path:

### <module-path>
- Version: <version>
- License: <SPDX identifier>
- Source: https://<module-path>
- License text: <URL to LICENSE file at tagged version>

If a NOTICE file was found in Step 3, add a line:

- NOTICE: <URL to NOTICE file at tagged version>

In incremental mode:

• Insert new entries in alphabetical order. Do not duplicate entries that are already present.
• For each removed dependency identified in Step 1, find the corresponding ### <module-path> entry in the ## Third-Party Notices section and delete it along with all its bullet lines, up to (but not including) the next ### heading or end of file.

docs/development-tools.md (Makefile build tools only)

If docs/development-tools.md is missing entirely, stop and ask the user to restore it - this skill does not create the file from scratch (its ## AI agent tooling section is curated manually).

Otherwise, insert or remove entries under the ## Build tools heading, sorted alphabetically by module path:

### <module-path>
- Version: <version>
- License: <SPDX identifier>
- Role: <one-line description of which Make target uses it>
- Source: https://<module-path>
- License text: <URL to LICENSE file at tagged version>

For each removed build tool identified in Step 1, delete its ### <module-path> entry and all its bullet lines, up to (but not including) the next ### heading or the next ## section.

Step 6 - Update CONTRIBUTING.md

Check whether CONTRIBUTING.md already contains a ## License Compliance heading. If it does, skip this step.

If it is absent, insert the following section before ## GPG Signing. If ## GPG Signing is not present in CONTRIBUTING.md, append the section at the end of the file instead.

## License Compliance

All direct third-party dependencies must carry a license compatible with
Apache 2.0 before being merged.

**When adding a new library:**
1. Run the `check-licenses` skill after editing `go.mod`.
2. Review the license table the skill displays and confirm each entry.
3. The skill updates `LICENSE` automatically.

**Licenses that are NOT acceptable** (prohibit commercial use or impose
copyleft incompatible with Apache 2.0):
- GPL-2.0 / GPL-3.0 / AGPL-3.0
- LGPL-2.1 (Go links statically, so LGPL's dynamic-linking exception does
  not apply)
- SSPL-1.0 / BSL-1.1
- Any Creative Commons -NC- variant
- Any license containing a "Commons Clause" addendum

If the library you need carries one of these licenses, look for a
permissive alternative or raise the issue with the maintainers before
adding it.

Step 7 - Commit

Stage and commit whichever of LICENSE, docs/development-tools.md, and CONTRIBUTING.md were actually modified in Steps 5-6. Skip files that were not touched.

git add LICENSE docs/development-tools.md CONTRIBUTING.md
git commit -S -m "chore: update third-party notices and license compliance docs"

If only one file changed, narrow the git add and the message accordingly, for example:

git add docs/development-tools.md
git commit -S -m "chore: update development tools list"