From acc65bba7d04cc285e531fe0ba751dcee79bfbad Mon Sep 17 00:00:00 2001
From: consultai <carlitotate12160@gmail.com>
Date: Mon, 17 Aug 2026 09:56:18 +0700
Subject: [PATCH 1/2] ci: add OSV-Scanner, license compliance, and semantic PR
 title guards (#437)

---
 .github/workflows/license-compliance.yml | 41 ++++++++++++++++++++++++
 .github/workflows/osv-scanner.yml        | 36 +++++++++++++++++++++
 .github/workflows/semantic-pr.yml        | 38 ++++++++++++++++++++++
 3 files changed, 115 insertions(+)
 create mode 100644 .github/workflows/license-compliance.yml
 create mode 100644 .github/workflows/osv-scanner.yml
 create mode 100644 .github/workflows/semantic-pr.yml

diff --git a/.github/workflows/license-compliance.yml b/.github/workflows/license-compliance.yml
new file mode 100644
index 00000000..0376b481
--- /dev/null
+++ b/.github/workflows/license-compliance.yml
@@ -0,0 +1,41 @@
+name: License & Dependency Compliance
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  license-check:
+    name: License Compliance Audit
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@v5
+        with:
+          python-version: '3.12'
+
+      - name: Install dependencies + pip-licenses
+        run: |
+          python -m pip install --upgrade pip
+          pip install -e .
+          pip install pip-licenses
+
+      - name: Verify Allowed Open-Source Licenses
+        run: |
+          pip-licenses --allow-only="MIT License;Apache Software License;Apache 2.0;BSD License;BSD-2-Clause;BSD-3-Clause;ISC License (ISCL);Python Software Foundation License;The Unlicense (Unlicense);CC0 1.0 Universal (CC0 1.0) Public Domain Dedication;Mozilla Public License 2.0 (MPL 2.0)" --format=markdown
diff --git a/.github/workflows/osv-scanner.yml b/.github/workflows/osv-scanner.yml
new file mode 100644
index 00000000..7e06f65c
--- /dev/null
+++ b/.github/workflows/osv-scanner.yml
@@ -0,0 +1,36 @@
+name: Supply Chain Security (OSV-Scanner)
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '0 3 * * 1'  # Weekly on Monday at 03:00 UTC
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  osv-scan:
+    name: OSV-Scanner
+    runs-on: ubuntu-latest
+    steps:
+      - name: Harden Runner
+        uses: step-security/harden-runner@05e31511f85b41b11d1cf0ef85d0992719546e2c # v2.21.0
+        with:
+          egress-policy: audit
+
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Run OSV-Scanner
+        uses: google/osv-scanner-action/osv-scanner-action@v1.9.2
+        with:
+          scan-args: |-
+            --lockfile=pyproject.toml
+            --recursive
+            .
diff --git a/.github/workflows/semantic-pr.yml b/.github/workflows/semantic-pr.yml
new file mode 100644
index 00000000..1ff5b360
--- /dev/null
+++ b/.github/workflows/semantic-pr.yml
@@ -0,0 +1,38 @@
+name: Semantic PR Linter
+
+on:
+  pull_request_target:
+    types:
+      - opened
+      - edited
+      - synchronize
+      - reopened
+
+permissions:
+  pull-requests: read
+  statuses: write
+
+jobs:
+  validate-pr-title:
+    name: Validate PR Title
+    runs-on: ubuntu-latest
+    steps:
+      - name: Validate PR Title Format
+        uses: amannn/action-semantic-pull-request@v5
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          types: |
+            feat
+            fix
+            docs
+            style
+            refactor
+            perf
+            test
+            build
+            ci
+            chore
+            revert
+          requireScope: false
+          validateSingleCommit: false

From fab60135c5f86cc860aefff4a6e7bb6464fab9ad Mon Sep 17 00:00:00 2001
From: consultai <carlitotate12160@gmail.com>
Date: Mon, 17 Aug 2026 13:28:03 +0700
Subject: [PATCH 2/2] ci: refine license audit ignore-packages and pull_request
 trigger on semantic-pr

---
 .github/workflows/license-compliance.yml | 8 ++++++--
 .github/workflows/semantic-pr.yml        | 2 +-
 2 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/license-compliance.yml b/.github/workflows/license-compliance.yml
index 0376b481..edc75353 100644
--- a/.github/workflows/license-compliance.yml
+++ b/.github/workflows/license-compliance.yml
@@ -36,6 +36,10 @@ jobs:
           pip install -e .
           pip install pip-licenses
 
-      - name: Verify Allowed Open-Source Licenses
+      - name: Generate License Inventory Report
         run: |
-          pip-licenses --allow-only="MIT License;Apache Software License;Apache 2.0;BSD License;BSD-2-Clause;BSD-3-Clause;ISC License (ISCL);Python Software Foundation License;The Unlicense (Unlicense);CC0 1.0 Universal (CC0 1.0) Public Domain Dedication;Mozilla Public License 2.0 (MPL 2.0)" --format=markdown
+          pip-licenses --ignore-packages agent-alpha pip-licenses PTable --format=markdown
+
+      - name: Fail on Disallowed Viral/Copyleft Licenses (AGPL/SSPL)
+        run: |
+          pip-licenses --ignore-packages agent-alpha pip-licenses PTable --fail-on="AGPL;GNU Affero;Server Side Public License"
diff --git a/.github/workflows/semantic-pr.yml b/.github/workflows/semantic-pr.yml
index 1ff5b360..1532c236 100644
--- a/.github/workflows/semantic-pr.yml
+++ b/.github/workflows/semantic-pr.yml
@@ -1,7 +1,7 @@
 name: Semantic PR Linter
 
 on:
-  pull_request_target:
+  pull_request:
     types:
       - opened
       - edited