Audit Dependency Licenses Before Shipping

Installing a package means accepting its license conditions, including for code pulled in transitively and bundled into the thing you ship. An AI summary can organize evidence. It cannot give legal approval.

This guide belongs to reel R105. Comment LICENSE for the matching module and runnable starter.

Define the boundary before building

Input: dependency lockfile, package manifests, bundled artifacts, distribution model, modifications, existing notices, policy rules, and legal owner.

Output: a direct and transitive license inventory, policy exceptions, notice obligations, source obligations, unknowns, and CI approval report.

The starter keeps exact checks in code and gives Claude only the reviewable drafting work. Dry-run is the default. Live mode can call Anthropic's Messages API, but it still returns a draft and performs no external action.

Paste this boundary into Claude Code before asking for implementation:

Workflow: Audit Dependency Licenses Before Shipping
Input: dependency lockfile, package manifests, bundled artifacts, distribution model, modifications, existing notices, policy rules, and legal owner
Output: a direct and transitive license inventory, policy exceptions, notice obligations, source obligations, unknowns, and CI approval report

Map the trigger, strict input fields, deterministic code checks, Claude drafting step, approval gate, failure queue, and saved evidence. Use null for missing facts. Do not change code or call an external service yet.

The modules that matter

Inventory the resolved artifact

Read the lockfile and final bundle, not only direct dependencies in package.json. Capture package, exact version, source, SPDX label, license file, and whether its code ships to users.

Map policy and obligations

Separate permissive, copyleft, network copyleft, proprietary, dual, unknown, and missing-license cases. Record notice and source obligations as questions for the legal owner, not model conclusions.

Gate changes in CI

Compare each dependency diff with the approved policy. Fail on unknown or disallowed additions, keep the evidence artifact, and require a named reviewer for exceptions.

Rules worth keeping beside the code

Read license text from the exact resolved dependency version.
Keep legal interpretation behind qualified review.
Generate notices only from verified package evidence.
Block new unknown or disallowed licenses until an owner approves them.

The dangerous version is treating an SPDX label as legal advice, missing bundled transitive code, deleting required notices, or auto-approving copyleft obligations. The pack deliberately stops at a draft so a person can inspect those boundaries before enabling anything real.

Test the ugly paths

Inventory matches the lockfile.
Bundled transitive package is included.
Required notice fixture appears.
Unknown license blocks CI.
Approved exception has owner and expiry.

The final verification is concrete: Compare the inventory with the lockfile and final artifact, inspect every unknown license manually, and make CI fail on a fictional disallowed dependency.

Use this prompt to turn the evidence into acceptance tests:

Design tests for Audit Dependency Licenses Before Shipping using only the attached fictional fixtures.
Cover the normal path, missing input, malformed input, a repeated event, a permission failure, a dependency failure, and the named safety boundary.
For each test return: input, expected state, prohibited side effect, and evidence to save.
Do not execute external actions.

Run the pack locally

The ZIP is a complete Node 22 starter with no third-party npm dependency. It includes an importable n8n webhook, Docker Compose, GitHub Actions validation and manual-run workflows, deterministic samples, and tests.

npm test
npm run validate
npm run sample
cp .env.example .env
docker compose up --build

Only set WORKFLOW_MODE=live, ANTHROPIC_API_KEY, and ANTHROPIC_MODEL after the dry-run output and tests make sense for your system. Keep real secrets in the environment, never in the n8n export.

Download the runnable pack

Start with the fictional dry-run. It validates the input and returns a reviewable draft without changing code, production data, customer accounts, or an external service.

Before enabling a real action

Replace every fictional fixture, assign the approval owner, define the duplicate key, set a timeout and retry rule, and save the original evidence. Then test one failure on purpose. If the workflow cannot stop visibly and replay safely, it is not ready to act.