ci: add a dependency-free license gate and AI security review

The license gate reads package-lock.json directly instead of installing license-checker, so the check itself adds nothing to the supply chain. The tree is dev-only today (nothing from node_modules reaches Pages), so this finds nothing now by design - it is here so it has teeth the moment a real dependency lands. Verified locally: 0 GPL/AGPL, LGPL passes intentionally.

The AI security review job gates on CLAUDE_API_KEY being present and emits a notice instead of failing when it is unset, so forks and fresh clones from this template stay green. Action pinned by commit SHA, bumped via the existing Dependabot actions group.

Author: heznpc

.github/workflows/ci.yml

@@ -14,7 +14,7 @@ jobs:
   ci:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
         with:
           fetch-depth: 0
 
@@ -51,10 +51,17 @@ jobs:
       - name: Audit high-severity vulnerabilities
         run: npm audit --audit-level=high
 
+      # Reads package-lock.json directly — no extra dependency to install, so
+      # the license gate itself adds nothing to the supply chain. Currently the
+      # tree is dev-only (nothing from node_modules ships to Pages), but the
+      # gate is here so it has teeth the moment you add real dependencies.
+      - name: Check licenses
+        run: npm run license:check
+
       # `eslint --cache` writes to .eslintcache at cwd; persist it across
       # runs so warm CI lints incrementally instead of rescanning the tree.
       - name: Restore ESLint cache
-        uses: actions/cache@v5
+        uses: actions/cache@v6
         with:
           path: .eslintcache
           key: eslint-${{ runner.os }}-${{ hashFiles('eslint.config.js', 'package-lock.json') }}-${{ hashFiles('src/**/*.js', 'functions/**/*.js', 'tests/**/*.js') }}

.github/workflows/claude-security-review.yml

@@ -0,0 +1,43 @@
+name: AI Security Review
+
+on:
+  pull_request:
+
+permissions:
+  pull-requests: write
+  contents: read
+
+jobs:
+  ai-review:
+    runs-on: ubuntu-latest
+    steps:
+      # Gate the job on the secret being set so forks / fresh clones don't
+      # red-fail. The `secrets` context can't be used directly in `if:`, so we
+      # route through a step output. When CLAUDE_API_KEY is unset, the job
+      # emits a notice and skips the actual analysis steps.
+      - name: Check CLAUDE_API_KEY presence
+        id: gate
+        env:
+          API_KEY: ${{ secrets.CLAUDE_API_KEY }}
+        run: |
+          set -euo pipefail
+          if [ -z "${API_KEY:-}" ]; then
+            echo "::notice::CLAUDE_API_KEY secret is not set — skipping AI security review. Set the secret in repo settings to enable."
+            echo "skip=true" >> "$GITHUB_OUTPUT"
+          else
+            echo "skip=false" >> "$GITHUB_OUTPUT"
+          fi
+
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
+        if: steps.gate.outputs.skip == 'false'
+        with:
+          ref: ${{ github.event.pull_request.head.sha || github.sha }}
+          fetch-depth: 2
+
+      # Pinned to a specific commit SHA. Bumped via Dependabot (group: actions).
+      - name: AI security review
+        if: steps.gate.outputs.skip == 'false'
+        uses: anthropics/claude-code-security-review@0c6a49f1fa56a1d472575da86a94dbc1edb78eda
+        with:
+          comment-pr: true
+          claude-api-key: ${{ secrets.CLAUDE_API_KEY }}

package.json

@@ -7,6 +7,7 @@
   "scripts": {
     "dev": "wrangler pages dev src --port 3000",
     "build": "node scripts/check-build-output.cjs",
+    "license:check": "node scripts/check-licenses.mjs",
     "lint": "eslint --cache src/ functions/ tests/",
     "pretest": "node scripts/guard-tests-exist.cjs",
     "test": "node --test",

scripts/check-licenses.mjs

@@ -0,0 +1,33 @@
+import { readFileSync } from "node:fs";
+
+const lockfile = JSON.parse(readFileSync(new URL("../package-lock.json", import.meta.url), "utf8"));
+const packages = lockfile.packages ?? {};
+const bannedLicense = /(^|[^A-Z])(?:AGPL|GPL)-(?:2\.0|3\.0)(?:-only|-or-later)?([^A-Z]|$)/;
+const counts = new Map();
+const blocked = [];
+
+for (const [path, meta] of Object.entries(packages)) {
+  if (!path || !meta || typeof meta !== "object") {
+    continue;
+  }
+  const license = meta.license;
+  if (typeof license !== "string" || license.trim() === "") {
+    continue;
+  }
+  counts.set(license, (counts.get(license) ?? 0) + 1);
+  if (bannedLicense.test(license)) {
+    blocked.push({ path, license });
+  }
+}
+
+for (const [license, count] of [...counts.entries()].sort((a, b) => b[1] - a[1] || a[0].localeCompare(b[0]))) {
+  console.log(`${license}: ${count}`);
+}
+
+if (blocked.length > 0) {
+  console.error("Blocked licenses found:");
+  for (const item of blocked) {
+    console.error(`- ${item.path}: ${item.license}`);
+  }
+  process.exit(1);
+}