|
1 | | -# compliance-toolkit |
2 | | -testing open toolkit |
| 1 | +# 🛡️ Org Compliance Toolkit |
| 2 | + |
| 3 | +An automated license compliance and open-source readiness tool. Built with [uv](https://github.com/astral-sh/uv) and [ScanCode Toolkit](https://github.com/nexB/scancode-toolkit). |
| 4 | + |
| 5 | +## 🚀 Purpose |
| 6 | + |
| 7 | +This toolkit helps developers determine if their repository is ready for an Open Source release. It: |
| 8 | + |
| 9 | +1. **Scans** all dependencies for licenses. |
| 10 | +2. **Flags** licenses that hinder commercial or proprietary releases. |
| 11 | +3. **Recommends** the best Open Source license (MIT, Apache, GPL, or AGPL). |
| 12 | +4. **Generates** a valid `LICENSE` file automatically from official SPDX templates. |
| 13 | + |
| 14 | +--- |
| 15 | + |
| 16 | +## 🛠️ Usage in GitHub Actions |
| 17 | + |
| 18 | +To use this in your project's repository, add a workflow file (e.g., `.github/workflows/compliance.yml`): |
| 19 | + |
| 20 | +```yaml |
| 21 | +name: OS Readiness Check |
| 22 | +on: [pull_request, workflow_dispatch] |
| 23 | + |
| 24 | +jobs: |
| 25 | + check: |
| 26 | + runs-on: ubuntu-latest |
| 27 | + steps: |
| 28 | + - uses: actions/checkout@v4 |
| 29 | + - name: Run License Recommender |
| 30 | + uses: your-org-name/compliance-toolkit/.github/actions/license-check@main |
| 31 | + with: |
| 32 | + apply_fix: 'false' # Set to 'true' to auto-generate a LICENSE file |
| 33 | +``` |
| 34 | +
|
| 35 | +## 💻 Local Development |
| 36 | +
|
| 37 | +If you want to contribute to this toolkit, follow these steps: |
| 38 | +
|
| 39 | +### 1. Prerequisites |
| 40 | +
|
| 41 | +Install `uv` (the ultra-fast Python package manager): |
| 42 | + |
| 43 | +```bash |
| 44 | +curl -LsSf [https://astral-sh.net/uv/install.sh](https://astral-sh.net/uv/install.sh) | sh |
| 45 | +``` |
| 46 | + |
| 47 | +### 2. Running the tool |
| 48 | + |
| 49 | +You can run the tool directly against any directory. uv will handle the dependencies and isolation automatically. |
| 50 | + |
| 51 | +```bash |
| 52 | +uv run compliance_tool.py [path/to/repo] |
| 53 | +``` |
| 54 | + |
| 55 | +### 3. Formatting & Quality |
| 56 | + |
| 57 | +We use Ruff for linting and Pytest for logic verification. Ensure these pass before pushing code: |
| 58 | + |
| 59 | +```bash |
| 60 | +# Check code style and fix common issues |
| 61 | +uvx ruff check . --fix |
| 62 | +
|
| 63 | +# Run logic tests to ensure recommendations are accurate |
| 64 | +uv run pytest |
| 65 | +``` |
| 66 | + |
| 67 | +## ⚖️ License Logic |
| 68 | +The tool evaluates your project's "Inbound" dependencies (what you use) to determine the safest "Outbound" license (what you release under). |
| 69 | + |
| 70 | +| Dependency License | Recommended Release | Commercial Allowed? | Rationale | |
| 71 | +| :--- | :--- | :--- | :--- | |
| 72 | +| **MIT / Apache / BSD** | **Apache-2.0** or **MIT** | ✅ Yes | Permissive licenses allow for both open and proprietary re-distribution. | |
| 73 | +| **LGPL** | **Apache-2.0** | ⚠️ Restricted | Allowed commercially if the library is dynamically linked and not modified. | |
| 74 | +| **GPL (v2 or v3)** | **GPL-3.0-only** | ❌ No | Strong copyleft "viral" effect requires your project to be Open Source. | |
| 75 | +| **AGPL** | **AGPL-3.0-only** | ❌ No | Extends copyleft to network services (SaaS). Your source must be public. | |
0 commit comments