cli · andyfeller · Jun 23, 2025 · May 30, 2025 · May 30, 2025 · May 30, 2025
@@ -0,0 +1,13 @@
+# GitHub CLI dependencies
+
+The following open source dependencies are used to build the [cli/cli][] GitHub CLI.
+
+## Go Packages
+
+Some packages may only be included on certain architectures or operating systems.
+
+{{ range . }}
+- [{{.Name}}](https://pkg.go.dev/{{.Name}}) ([{{.LicenseName}}]({{.LicenseURL}}))
+{{- end }}
+
+[cli/cli]: https://github.com/cli/cli
@@ -5,11 +5,15 @@ on:
       - "**.go"
       - go.mod
       - go.sum
+      - ".github/licenses.tmpl"
+      - "script/licenses*"
   pull_request:
     paths:
       - "**.go"
       - go.mod
       - go.sum
+      - ".github/licenses.tmpl"
+      - "script/licenses*"
 
 permissions:
   contents: read
@@ -46,3 +50,12 @@ jobs:
         uses: golangci/golangci-lint-action@4afd733a84b1f43292c63897423277bb7f4313a9 # v8.0.0
         with:
           version: v2.1.6
+
+      # actions/setup-go does not setup the installed toolchain to be preferred over the system install,
+      # which causes go-licenses to raise "Package ... does not have module info" errors.
+      # for more information, https://github.com/google/go-licenses/issues/244#issuecomment-1885098633
+      - name: Check licenses
+        run: |
+          export GOROOT=$(go env GOROOT)
+          export PATH=${GOROOT}/bin:$PATH
+          make licenses-check
@@ -106,3 +106,11 @@ ifndef VERSION
 endif
 	./script/release --local "$(VERSION)" --platform macos
 	./script/pkgmacos $(VERSION)
+
+.PHONY: licenses
+licenses:
+	./script/licenses
+
+.PHONY: licenses-check
+licenses-check:
+	./script/licenses-check
@@ -0,0 +1,46 @@
+# License Compliance
+
+GitHub CLI complies with the software licenses of its dependencies. This document explains how license compliance is maintained.
+
+## Overview
+
+When a dependency is added or updated, the license information needs to be updated. We use the [`google/go-licenses`](https://github.com/google/go-licenses) tool to:
+
+1. Generate markdown documentation listing all Go dependencies and their licenses
+2. Copy license files for dependencies that require redistribution
+
+## License Files
+
+The following files contain license information:
+
+- `third-party-licenses.darwin.md` - License information for macOS dependencies
+- `third-party-licenses.linux.md` - License information for Linux dependencies
+- `third-party-licenses.windows.md` - License information for Windows dependencies
+- `third-party/` - Directory containing source code and license files that require redistribution
+
+## Updating License Information
+
+When dependencies change, you need to update the license information:
+
+1. Update license information for all platforms:
+
+   ```shell
+   make licenses
+   ```
+
+2. Commit the changes:
+
+   ```shell
+   git add third-party-licenses.*.md third-party/
+   git commit -m "Update third-party license information"
+   ```
+
+## Checking License Compliance
+
+The CI workflow checks if license information is up to date. To check locally:
+
+```sh
+make licenses-check
+```
+
+If the check fails, follow the instructions to update the license information.
@@ -0,0 +1,25 @@
+#!/bin/bash
+
+go install github.com/google/go-licenses@latest
+
+# Setup temporary directory to collect updated third-party source code
+export TEMPDIR="$(mktemp -d)"
+trap "rm -fr ${TEMPDIR}" EXIT
+
+# Clear third-party source code to avoid stale content
+rm -rf third-party
+mkdir -p third-party
+
+for goos in linux darwin windows ; do
+    # Note: we ignore warnings because we want the command to succeed, however the output should be checked
+    #       for any new warnings, and potentially we may need to add license information.
+    #
+    #       Normally these warnings are packages containing non go code, which may or may not require explicit attribution,
+    #       depending on the license.
+    echo "Generating licenses for ${goos}..."
+    GOOS="${goos}" go-licenses save ./... --save_path="${TEMPDIR}/${goos}" --force || echo "Ignore warnings"
+    GOOS="${goos}" go-licenses report ./... --template .github/licenses.tmpl --ignore github.com/cli/cli > third-party-licenses.${goos}.md || echo "Ignore warnings"
+    cp -fR "${TEMPDIR}/${goos}"/* third-party/
+done
+
+echo "Licenses generated for all platforms."
@@ -0,0 +1,23 @@
+#!/bin/bash
+
+go install github.com/google/go-licenses@latest
+
+# Setup temporary directory for generated license reports
+export TEMPDIR="$(mktemp -d)"
+trap "rm -fr ${TEMPDIR}" EXIT
+
+for goos in linux darwin windows ; do
+    # Note: we ignore warnings because we want the command to succeed, however the output should be checked
+    #       for any new warnings, and potentially we may need to add license information.
+    #
+    #       Normally these warnings are packages containing non go code, which may or may not require explicit attribution,
+    #       depending on the license.
+    echo "Checking licenses for ${goos}..."
+    GOOS="${goos}" go-licenses report ./... --template .github/licenses.tmpl --ignore github.com/cli/cli > "${TEMPDIR}/third-party-licenses.${goos}.md" || echo "Ignore warnings"
+    if ! diff -s "${TEMPDIR}/third-party-licenses.${goos}.md" "third-party-licenses.${goos}.md"; then
+        echo "::error title=License check failed::Please update the license files by running \`make licenses\` and committing the output."
+        exit 1
+    fi
+done
+
+echo "License check passed for all platforms."