license-trace 0.1.3__tar.gz

license_trace-0.1.3/.cargo/config.toml

@@ -0,0 +1,5 @@
+[alias]
+a = "run --bin lt -- a"
+t = "run --bin lt -- t"
+w = "run --bin lt -- w"
+ex = "run --bin lt -- e"

license_trace-0.1.3/.github/workflows/cd.yml

@@ -0,0 +1,270 @@
+name: CD (Release & Publish)
+
+on:
+  push:
+    branches: [main, master]
+    paths-ignore:
+      - "**.md"
+      - "docs/**"
+  workflow_dispatch:
+
+permissions:
+  contents: write
+  packages: write
+  id-token: write
+
+jobs:
+  check-version:
+    name: Check Version & Determine Release
+    runs-on: ubuntu-latest
+    outputs:
+      should_publish: ${{ steps.check.outputs.should_publish }}
+      version: ${{ steps.check.outputs.version }}
+    steps:
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Extract version from Cargo.toml
+        id: check
+        run: |
+          VERSION=$(grep -m 1 '^version =' Cargo.toml | tr -s ' ' | cut -d '"' -f 2)
+          echo "Cargo.toml version: $VERSION"
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+
+          # Check if git tag already exists
+          if git rev-parse "v$VERSION" >/dev/null 2>&1; then
+            echo "Tag v$VERSION already exists. Skipping release."
+            echo "should_publish=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "Tag v$VERSION does not exist yet. Will proceed with release."
+            echo "should_publish=true" >> "$GITHUB_OUTPUT"
+          fi
+
+  # ==========================================
+  # 1. Publish to crates.io
+  # ==========================================
+  publish-crates:
+    name: Publish to crates.io
+    needs: check-version
+    if: needs.check-version.outputs.should_publish == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+      - name: Publish to crates.io
+        run: cargo publish --token ${{ secrets.CARGO_REGISTRY_TOKEN }}
+        env:
+          CARGO_REGISTRY_TOKEN: ${{ secrets.CARGO_REGISTRY_TOKEN }}
+        continue-on-error: true
+
+  # ==========================================
+  # 2. Build multi-platform binaries
+  # ==========================================
+  build-binaries:
+    name: Build Binary (${{ matrix.target }})
+    needs: check-version
+    if: needs.check-version.outputs.should_publish == 'true'
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+            binary_name: license-trace
+            output_name: license-trace-x86_64-unknown-linux-gnu
+            use_cross: false
+          - os: ubuntu-latest
+            target: aarch64-unknown-linux-gnu
+            binary_name: license-trace
+            output_name: license-trace-aarch64-unknown-linux-gnu
+            use_cross: true
+          - os: macos-latest
+            target: x86_64-apple-darwin
+            binary_name: license-trace
+            output_name: license-trace-x86_64-apple-darwin
+            use_cross: false
+          - os: macos-latest
+            target: aarch64-apple-darwin
+            binary_name: license-trace
+            output_name: license-trace-aarch64-apple-darwin
+            use_cross: false
+          - os: windows-latest
+            target: x86_64-pc-windows-msvc
+            binary_name: license-trace.exe
+            output_name: license-trace-x86_64-pc-windows-msvc.exe
+            use_cross: false
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          targets: ${{ matrix.target }}
+
+      - name: Install cross (if required)
+        if: matrix.use_cross
+        run: cargo install cross --git https://github.com/cross-rs/cross
+
+      - name: Build Binary
+        run: |
+          if [ "${{ matrix.use_cross }}" = "true" ]; then
+            cross build --release --target ${{ matrix.target }}
+          else
+            cargo build --release --target ${{ matrix.target }}
+          fi
+        shell: bash
+
+      - name: Copy & Rename Artifact
+        run: |
+          mkdir -p dist
+          cp target/${{ matrix.target }}/release/${{ matrix.binary_name }} dist/${{ matrix.output_name }}
+        shell: bash
+
+      - name: Upload Binary Artifact
+        uses: actions/upload-artifact@v4
+        with:
+          name: binary-${{ matrix.target }}
+          path: dist/${{ matrix.output_name }}
+          retention-days: 2
+
+  # ==========================================
+  # 3. Publish to PyPI (maturin)
+  # ==========================================
+  publish-pypi:
+    name: Publish to PyPI
+    needs: check-version
+    if: needs.check-version.outputs.should_publish == 'true'
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: ubuntu-latest
+            target: x86_64-unknown-linux-gnu
+            manylinux: auto
+          - os: ubuntu-latest
+            target: aarch64-unknown-linux-gnu
+            manylinux: auto
+          - os: macos-latest
+            target: x86_64-apple-darwin
+          - os: macos-latest
+            target: aarch64-apple-darwin
+          - os: windows-latest
+            target: x86_64-pc-windows-msvc
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Set up QEMU
+        if: matrix.target == 'aarch64-unknown-linux-gnu'
+        uses: docker/setup-qemu-action@v3
+
+      - name: Build wheels
+        uses: PyO3/maturin-action@v1
+        with:
+          target: ${{ matrix.target }}
+          manylinux: ${{ matrix.manylinux || 'off' }}
+          args: --release --out dist
+          docker-options: -e CFLAGS="-D__ARM_ARCH=8"
+        continue-on-error: true
+
+      - name: Upload PyPI wheels
+        uses: actions/upload-artifact@v4
+        with:
+          name: pypi-wheels-${{ matrix.target }}
+          path: dist/*.whl
+        continue-on-error: true
+
+  publish-pypi-release:
+    name: Upload all wheels to PyPI
+    needs: [check-version, publish-pypi]
+    if: always() && !cancelled() && needs.check-version.outputs.should_publish == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - uses: actions/setup-python@v5
+        with:
+          python-version: "3.11"
+
+      - name: Download wheels
+        uses: actions/download-artifact@v4
+        with:
+          pattern: pypi-wheels-*
+          merge-multiple: true
+          path: dist
+        continue-on-error: true
+
+      - name: Build sdist
+        uses: PyO3/maturin-action@v1
+        with:
+          command: sdist
+          args: --out dist
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1
+        with:
+          password: ${{ secrets.PYPI_API_TOKEN }}
+          packages-dir: dist
+        continue-on-error: true
+
+  # ==========================================
+  # 4. Create GitHub Release & Upload Archives
+  # ==========================================
+  publish-github-release:
+    name: Create GitHub Release
+    needs: [check-version, build-binaries]
+    if: needs.check-version.outputs.should_publish == 'true'
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Download all binaries
+        uses: actions/download-artifact@v4
+        with:
+          pattern: binary-*
+          merge-multiple: true
+          path: dist-binaries
+
+      - name: Package release archives & compute checksums
+        run: |
+          mkdir -p release-assets
+          VERSION="${{ needs.check-version.outputs.version }}"
+
+          # Packaging Unix binaries as tar.gz
+          for target in x86_64-unknown-linux-gnu aarch64-unknown-linux-gnu x86_64-apple-darwin aarch64-apple-darwin; do
+            bin="dist-binaries/license-trace-$target"
+            if [ -f "$bin" ]; then
+              chmod +x "$bin"
+              cp "$bin" license-trace
+              tar -czf "release-assets/license-trace-v${VERSION}-${target}.tar.gz" license-trace
+              rm license-trace
+            fi
+          done
+
+          # Packaging Windows binary as zip
+          if [ -f "dist-binaries/license-trace-x86_64-pc-windows-msvc.exe" ]; then
+            cp "dist-binaries/license-trace-x86_64-pc-windows-msvc.exe" license-trace.exe
+            zip "release-assets/license-trace-v${VERSION}-x86_64-pc-windows-msvc.zip" license-trace.exe
+            rm license-trace.exe
+          fi
+
+          # Generate SHA-256 checksums
+          cd release-assets
+          sha256sum * > SHA256SUMS.txt
+          cd ..
+
+      - name: Create Git Tag & GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: "v${{ needs.check-version.outputs.version }}"
+          name: "Release v${{ needs.check-version.outputs.version }}"
+          generate_release_notes: true
+          files: |
+            release-assets/*
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

license_trace-0.1.3/.github/workflows/ci.yml

@@ -0,0 +1,42 @@
+name: CI
+
+on:
+  push:
+    branches: [main, master]
+    paths-ignore:
+      - "**.md"
+      - "docs/**"
+  pull_request:
+    branches: [main, master]
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+jobs:
+  test:
+    name: Test (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install Rust toolchain
+        uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+
+      - name: Rust Cache
+        uses: Swatinem/rust-cache@v2
+
+      - name: Check Formatting
+        run: cargo fmt --all --check
+
+      - name: Clippy Linter
+        run: cargo clippy --all-targets -- -D warnings
+
+      - name: Run Tests
+        run: cargo test --all-targets --all-features

license_trace-0.1.3/.gitignore

@@ -0,0 +1,6 @@
+/target
+/charts
+/dist
+/dist-binaries
+/release-assets
+*.whl

license_trace-0.1.3/CHANGELOG.md

@@ -0,0 +1,35 @@
+# Changelog
+
+All notable changes to this project will be documented in this file.
+
+The format is based on [Keep a Changelog](https://keepachangelog.com/en/1.1.0/),
+and this project adheres to [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
+
+## [0.1.3] - 2026-08-23
+
+### Added
+- Short binary alias `lt` alongside `license-trace` for rapid command-line execution.
+- 1-letter subcommand aliases: `a` (audit), `t` (trace), `w` (why), `e` (export).
+- Short CLI flags: `-P` (`--prod-only`), `-i` (`--fail-on-incompatible`), `-u` (`--fail-on-unknown`), `-d` (`--max-depth`).
+- Local developer cargo aliases (`cargo a`, `cargo t`, `cargo w`, `cargo ex`) in `.cargo/config.toml`.
+- CycloneDX SBOM and SARIF reporter integration (`--format cyclonedx`, `--format sarif`).
+
+## [0.1.1] - 2026-08-20
+
+### Added
+- Online PyPI JSON API integration for real-time license metadata resolution on remote/uninstalled Python projects.
+- Full support for `uv.lock` dependency lockfile parsing and multi-line array `pyproject.toml` parsing.
+- Automated Continuous Delivery (CD) workflow for crates.io, PyPI, and GitHub Releases.
+
+## [0.1.0] - 2026-08-19
+
+### Added
+- Multi-ecosystem dependency license tracking and compliance analysis (Cargo, npm, PyPI, Go modules).
+- Unified CLI interface supporting local directories, remote registry packages, and Git URLs (`trace`).
+- Strict SPDX AST evaluation engine (`OR` chooses best permissible branch; `AND` combines strict requirements).
+- Outbound license compatibility policy engine (evaluating against MIT, Apache-2.0, dual-licenses).
+- Aggregated lower-bound legal obligations calculator (commercial use, source disclosure level, copyright notice attribution).
+- Deep dependency path tracing (`why <package>`) via shortest-path BFS and all-simple-paths graph traversal.
+- Multi-format reporting: Audit terminal view, Comfy-Table view, Tree structure, JSON, and Markdown.
+- Third-party notices and licenses generator (`export --output THIRD_PARTY_LICENSES.md`).
+- Multi-OS GitHub Actions CI/CD workflows and full test coverage suite.

license_trace-0.1.3/CODE_OF_CONDUCT.md

@@ -0,0 +1,55 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+We as members, contributors, and leaders pledge to make participation in our
+community a harassment-free experience for everyone, regardless of age, body
+size, visible or invisible disability, ethnicity, sex characteristics, gender
+identity and expression, level of experience, education, socio-economic status,
+nationality, personal appearance, race, caste, color, religion, or sexual
+identity and orientation.
+
+We pledge to act and interact in ways that contribute to an open, welcoming,
+diverse, inclusive, and healthy community.
+
+## Our Standards
+
+Examples of behavior that contributes to a positive environment for our
+community include:
+
+* Demonstrating empathy and kindness toward other people
+* Being respectful of differing opinions, viewpoints, and experiences
+* Giving and gracefully accepting constructive feedback
+* Accepting responsibility and apologizing to those affected by our mistakes,
+  and learning from the experience
+* Focusing on what is best not just for us as individuals, but for the
+  overall community
+
+Examples of unacceptable behavior include:
+
+* The use of sexualized language or imagery, and sexual attention or advances of
+  any kind
+* Trolling, insulting or derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or email
+  address, without their explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Enforcement Responsibilities
+
+Community leaders are responsible for clarifying and enforcing our standards of
+acceptable behavior and will take appropriate and fair corrective action in
+response to any behavior that they deem inappropriate, threatening, offensive,
+or harmful.
+
+## Scope
+
+This Code of Conduct applies within all community spaces, and also applies when
+an individual is officially representing the community in public spaces.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported to the project team at `rikutoyamada01@gmail.com`. All
+complaints will be reviewed and investigated promptly and fairly.

license_trace-0.1.3/CONTRIBUTING.md

@@ -0,0 +1,43 @@
+# Contributing to license-trace
+
+Thank you for your interest in contributing to `license-trace`! We welcome contributions from the community.
+
+## Development Setup
+
+### Prerequisites
+- [Rust](https://www.rust-lang.org/tools/install) 1.75 or higher (with `cargo`, `rustfmt`, and `clippy`)
+- Git
+
+### Getting Started
+
+```bash
+git clone https://github.com/rikutoyamada01/license-trace.git
+cd license-trace
+cargo test
+```
+
+## Pull Request Guidelines
+
+1. **Create a branch:** Create a feature or bugfix branch off `master` (e.g. `feat/new-ecosystem-resolver` or `fix/spdx-eval-edge-case`).
+2. **Code Standards:**
+   - Format code using standard rustfmt:
+     ```bash
+     cargo fmt --all -- --check
+     ```
+   - Ensure zero Clippy warnings:
+     ```bash
+     cargo clippy --all-targets --all-features -- -D warnings
+     ```
+3. **Tests:**
+   - Add unit tests for all new resolvers, parser edge-cases, or policy rules.
+   - Run the full test suite:
+     ```bash
+     cargo test --all-targets --all-features
+     ```
+4. **Third-Party Notices:**
+   - If adding dependencies to `Cargo.toml`, ensure they are Permissive and run `license-trace export --output THIRD_PARTY_LICENSES.md` to refresh the notice bundle.
+
+## Commit Message Convention
+
+We follow conventional commit guidelines (e.g., `feat: ...`, `fix: ...`, `docs: ...`, `refactor: ...`, `test: ...`).
+Include GitHub issue reference keywords (e.g. `Closes #123`) when resolving open issues.