ci: add license-check workflow

[Seth-Schmidt]

Summary

Adds a PR gate that fails when a package introduces a production dependency
under a disallowed license. Addresses compliance finding 3-1 (License Check).

Scope is what we distribute: contract bytecode and scripts/ source. Packages with known-but-pending or
peer-install-only exceptions are suppressed via exact name@version exclusions
in the Makefile.

Changes

• Makefile — make check-licenses

  • Iterates all contract packages plus scripts/fhevm-cli and
    scripts/governance-proposal-builder.
  • Allow-list: MIT, BSD variants, Apache-2.0, ISC, etc.
  • EXCLUDE_PACKAGES: LGPL Safe (cleared), LZBL LayerZero v2 packages (legal
    pending), BUSL peers not compiled into our Solidity (v1, Chainlink CCIP,
    lz-v2-utilities).

• .github/workflows/license-check.yml

  • license-check/check-licenses (bpr)

• package.json / lockfiles — move deployed Solidity deps from
  devDependencies → dependencies in governance, token, solanaOFT,
  staking, safe, and scripts/fhevm-cli so --production scans the real
  compile-time tree. Lockfiles regenerated to match.

[Seth-Schmidt]

@claude review

[claude]

Claude finished @Seth-Schmidt's request. — View run

[claude]

[AUTOMATED]

Code Review — ci: add license-check workflow

The workflow is well-structured and follows established repository conventions (SHA-pinned actions, least-privilege permissions, concurrency groups, persist-credentials: false, (bpr) naming). The shell logic for discovering affected packages in a monorepo is sound.

However, the license-checking step has a critical issue that defeats the purpose of the workflow.

Summary

Category	Result
Guideline Compliance	✅ Fully compliant with repo conventions
Error Handling	✅ Adequate (set -euo pipefail, proper aggregate gate)
Security	✅ Least-privilege, pinned actions, no credential exposure
Bug / Correctness	⚠️ 1 issue found (see inline comment)

[claude]

The review has been posted successfully. Here's a summary of the review:

Review Summary for PR #217: ci: add license-check workflow

What was reviewed

A new GitHub Actions workflow (153 lines) that gates PRs on copyleft license detection across npm packages in a monorepo.

Findings

✅ Guideline Compliance — Fully compliant with all repository conventions (SHA-pinned actions, least-privilege permissions, concurrency groups, persist-credentials: false, (bpr) naming pattern).

✅ Security — Proper least-privilege permissions, no credential exposure, SHA-pinned actions.

✅ Error Handling — Adequate use of set -euo pipefail, proper aggregate gate job with if: always().

⚠️ 1 Bug Found (Critical) — The --failOn "GPL;AGPL;LGPL" flag on license-checker uses exact string matching, not substring matching. Real-world SPDX identifiers like GPL-2.0-only, GPL-3.0-only, AGPL-3.0-only, LGPL-2.1-only etc. will not be caught, silently defeating the purpose of the workflow. Three fix options were provided in the inline comment.