From fd87a70cf20a412b0fb6c3f54fc441042ba74f11 Mon Sep 17 00:00:00 2001
From: Bryan Frimin <bryan@getprobo.com>
Date: Tue, 23 Dec 2025 22:35:46 +0100
Subject: [PATCH] Add license checker

Signed-off-by: Bryan Frimin <bryan@getprobo.com>
---
 .github/workflows/make.yaml | 10 ++++++++++
 .trivyignore.yaml           |  8 ++++++++
 GNUmakefile                 |  5 +++++
 trivy.yaml                  | 32 ++++++++++++++++++++++++++++++++
 4 files changed, 55 insertions(+)
 create mode 100644 .trivyignore.yaml
 create mode 100644 trivy.yaml

diff --git a/.github/workflows/make.yaml b/.github/workflows/make.yaml
index 1952c72ae..3b2eebc49 100644
--- a/.github/workflows/make.yaml
+++ b/.github/workflows/make.yaml
@@ -104,6 +104,16 @@ jobs:
             coverage.html
           retention-days: 30
       - run: "make lint"
+      - name: "Scan licenses"
+        uses: "aquasecurity/trivy-action@0.28.0"
+        with:
+          scan-type: "fs"
+          scanners: "license"
+          severity: "UNKNOWN,HIGH,CRITICAL"
+          exit-code: 1
+          ignorefile: ".trivyignore.yaml"
+          trivy-config: "trivy.yaml"
+          license-full: true
 
   test-e2e:
     name: "test-e2e"
diff --git a/.trivyignore.yaml b/.trivyignore.yaml
new file mode 100644
index 000000000..eac8e1d52
--- /dev/null
+++ b/.trivyignore.yaml
@@ -0,0 +1,8 @@
+# Trivy ignore file
+# https://trivy.dev/docs/latest/configuration/filtering/
+
+licenses:
+  # n8n packages - manually reviewed, custom license acceptable for our use case
+  - id: "SEE LICENSE IN LICENSE.md"
+    paths:
+      - "package-lock.json"
diff --git a/GNUmakefile b/GNUmakefile
index 20618c439..5e522c3d0 100644
--- a/GNUmakefile
+++ b/GNUmakefile
@@ -3,6 +3,7 @@ CP ?=	cp
 DOCKER ?=	docker
 GO ?=	go
 GRYPE ?=	grype
+TRIVY ?=	trivy
 MKCERT ?=	mkcert
 MKDIR ?=	mkdir -p
 NPM ?=	npm
@@ -135,6 +136,10 @@ scan-docker: docker-build
 .PHONY: scan
 scan: scan-sbom scan-sbom-docker scan-docker
 
+.PHONY: scan-license
+scan-license: ## Check dependencies licenses compliance
+	$(TRIVY) fs --license-full --scanners license --ignorefile .trivyignore.yaml --severity UNKNOWN,HIGH,CRITICAL --exit-code 1 .
+
 .PHONY: docker-build
 docker-build:
 	$(DOCKER_BUILD) --tag $(DOCKER_IMAGE_NAME):$(DOCKER_TAG_NAME) --file Dockerfile .
diff --git a/trivy.yaml b/trivy.yaml
new file mode 100644
index 000000000..8c53d7f98
--- /dev/null
+++ b/trivy.yaml
@@ -0,0 +1,32 @@
+scan:
+  scanners:
+    - license
+
+license:
+  forbidden:
+    - AGPL-1.0
+    - AGPL-3.0
+    - GPL-1.0
+    - GPL-2.0
+    - GPL-3.0
+    - LGPL-2.0
+    - LGPL-2.1
+    - LGPL-3.0
+
+  notice:
+    - MIT
+    - Apache-2.0
+    - BSD-2-Clause
+    - BSD-3-Clause
+    - ISC
+    - CC0-1.0
+    - Unlicense
+    - 0BSD
+    - BlueOak-1.0.0
+
+  reciprocal:
+    - MPL-2.0
+
+  include-dev-deps: false
+
+  confidence-level: 0.9