Licence policy enforcement
Turn an open source license policy from a wiki page into a versioned JSON document your build can execute: policy structure, matching rules, default outcomes, deprecated identifiers, policy hashing and review workflow.
Task: Express an existing open source licence policy as a versioned JSON document, validate it, and make its decisions reproducible.
Embedded developer tooling
Validate and normalize SPDX license expressions from Node.js: the normalizeExpression API, canonical form, expression shapes, deprecated identifiers, LicenseRef handling, diagnostic codes, and how to clean up a metadata field in bulk.
Task: Call a local SPDX expression validator from your own Node.js code and act on its diagnostics.
CI and release integration
Add a deterministic open source license policy check to any CI system that runs Node.js: producing component records, the CLI contract, exit codes, failing the build closed, keeping the JSON result as release evidence, and avoiding false failures.
Task: Fail a build when a dependency's licence is denied by your policy, and keep the JSON evidence for the release.
CI and release integration
A complete GitHub Actions workflow that runs an open source license policy check on every pull request: installing from the lockfile, validating the policy, evaluating components, uploading the JSON result, and reporting the outcome in the job summary.
Task: Add a licence policy check to a GitHub repository that blocks a pull request on a denied licence.
SPDX technical validation
Worked examples of SPDX license expressions: AND, OR, WITH, the + operator, parentheses and operator precedence, LicenseRef and AdditionRef custom identities, deprecated identifiers, and the canonical normalized form of each.
Task: Look up how a specific SPDX expression parses, normalizes and fails, with a runnable example for each case.