ci: add license deny list to dependency review

[wizzomafizzo]

Summary

• Add deny-licenses to dependency-review-action
• Denied: AGPL-3.0, SSPL-1.0, EUPL-1.1, EUPL-1.2, CPAL-1.0, Watcom-1.0

PRs introducing dependencies under these licenses will be blocked.

Summary by CodeRabbit

• Chores
  • Updated the dependency review workflow to enforce restrictions on specific open-source licenses, strengthening project license compliance standards.

[coderabbitai]

📝 Walkthrough

Walkthrough

This PR adds a deny-licenses configuration to the GitHub Actions dependency-review workflow, specifying a list of licenses (AGPL 3.0 variants, SSPL 1.0, EUPL 1.1/1.2, CPAL 1.0, and Watcom 1.0) to be denied during dependency reviews.

Changes

Cohort / File(s)	Summary
Workflow License Configuration .github/workflows/dependency-review.yml	Added with configuration to actions/dependency-review-action step specifying a deny-licenses list to restrict specific open-source licenses in dependencies.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Possibly related PRs

• ci: add dependency review workflow #63: Modifies the dependency-review workflow; this PR adds deny-license configuration to the same action that was introduced in that PR.

Poem

🐰 A rabbit guards the code so tight,
With licenses denied just right,
No AGPL shall pass our gate,
We choose our dependencies with care and fate! 🌲✨

🚥 Pre-merge checks | ✅ 3

✅ Passed checks (3 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely summarizes the main change: adding a license deny list to the dependency review workflow.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

_{✏️ Tip: You can configure your own custom pre-merge checks in the settings.}

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch add-license-policy

---

_{Comment @coderabbitai help to get the list of available commands and usage tips.}

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.

📢 Thoughts on this report? Let us know!

[coderabbitai]

🧹 Nitpick comments (1)

.github/workflows/dependency-review.yml (1)

20-21: deny-licenses is deprecated in the upstream action

At Line 21, this works today, but actions/dependency-review-action documents deny-licenses as deprecated and potentially removable in the next major version. Consider migrating policy to a non-deprecated approach (typically an explicit allow-licenses policy, optionally via config-file) before future upgrades.

🤖 Prompt for AI Agents

Verify each finding against the current code and only fix it if needed.

In @.github/workflows/dependency-review.yml around lines 20 - 21, The workflow
uses the deprecated deny-licenses input (deny-licenses) for
actions/dependency-review-action; replace it by switching to an explicit
allowlist or a config-file policy. Update the job step that currently sets
deny-licenses to instead provide either an allow-licenses list (allow-licenses)
with the approved SPDX identifiers or point the action to a dependency-review
config file (config-file) that defines license policy, ensuring the input name
and payload match the upstream action's current docs and remove the deprecated
deny-licenses entry.

🤖 Prompt for all review comments with AI agents

Verify each finding against the current code and only fix it if needed.

Nitpick comments:
In @.github/workflows/dependency-review.yml:
- Around line 20-21: The workflow uses the deprecated deny-licenses input
(deny-licenses) for actions/dependency-review-action; replace it by switching to
an explicit allowlist or a config-file policy. Update the job step that
currently sets deny-licenses to instead provide either an allow-licenses list
(allow-licenses) with the approved SPDX identifiers or point the action to a
dependency-review config file (config-file) that defines license policy,
ensuring the input name and payload match the upstream action's current docs and
remove the deprecated deny-licenses entry.

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 55a4c293-adb3-4a45-94e2-7be194fdb9e9

📥 Commits

Reviewing files that changed from the base of the PR and between 372d7ee and fdd83cc.

📒 Files selected for processing (1)

• .github/workflows/dependency-review.yml