ci: 3rd-party licenses

[alexpriv8]

Summary

Adds the license:/pkg: section to .trivy.yaml (matching the shared ops-common//trivy-license action template), CODEOWNERS coverage for LICENSES.md, and the generated LICENSES.md report of 3rd-party dependency licenses. Once merged, the existing trivy composite action call in CI will automatically generate/validate this report — no further workflow changes needed.

Jira

ENG-9724

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[deepsource-io]

DeepSource Code Review

We reviewed changes in d1afeda...273c2c0 on this pull request. Below is the summary for the review, and you can see the individual issues we found as inline review comments.

See full review on DeepSource ↗

PR Report Card

Overall Grade

Security   Reliability   Complexity   Hygiene

Code Review Summary

Analyzer	Status	Updated (UTC)	Details
Go		Sep 14, 2026 1:39a.m.	Review ↗

---

Important

AI Review is run only on demand for your team. We're only showing results of static analysis review right now. To trigger AI Review, comment @deepsourcebot review on this thread.

[Copilot]

🟡 Changes recommended

Fix the duplicate pkg mapping and add the missing LICENSES.md report.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Configures Trivy license reporting and adds CODEOWNERS coverage for the generated license report.

Changes:

• Adds license settings to .trivy.yaml.
• Adds LICENSES.* ownership coverage.
• The pkg mapping is duplicated, and LICENSES.md is missing.

File summaries

File	Summary
CODEOWNERS	Adds ownership for license reports; LICENSES.md is not included.
.trivy.yaml	Adds license settings but duplicates the top-level pkg mapping.

Review details

• Files reviewed: 2/2 changed files
• Comments generated: 2
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[Copilot]

🟡 Changes recommended

Unresolved configuration defects and the missing generated report block approval.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (3)

.trivy.yaml:57

• This introduces a second pkg mapping with the same key as the existing block above. YAML mappings must not contain duplicate keys, and Trivy/YAML validation can reject or ambiguously overwrite this configuration; remove this duplicate block and keep a single pkg section before license.

pkg:
  include-dev-deps: true # supported: npm, yarn, gradle

.trivy.yaml:65

• The existing scan.scanners list explicitly contains only vuln, secret, and misconfig, so adding license options here does not enable Trivy's license scanner. Any invocation that relies on .trivy.yaml without a CLI override, including the pre-commit command, will still skip license scanning. Add license to that list or ensure every caller passes --scanners license.

license:
  confidenceLevel: 0.9 # '--license-confidence-level'
  full: true # '--license-full'
  # forbidden: []
  # permissive: []
  ignored: [] # '--ignored-licenses'

CODEOWNERS:23

• This CODEOWNERS rule only assigns owners; the diff does not add the generated LICENSES.md report described in the PR summary. As a result, the repository still has no baseline report for the CI action to generate/validate. Please include the generated report, or correct the PR description if it is intentionally produced only at runtime.

LICENSES.* @indykite/devx @indykite/ops

• Files reviewed: 3/3 changed files
• Comments generated: 1
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

Resolve the duplicate YAML key and add or correct the missing license report.

Review details

Suppressed comments (2)

.trivy.yaml:57

• This adds a second top-level pkg mapping with the same key as lines 53–54. YAML mappings should not contain duplicate keys, and the repository's yamllint hook extends the default rules (which rejects duplicate keys), so this configuration will fail linting; keep only one pkg block.

pkg:
  include-dev-deps: true # supported: npm, yarn, gradle

CODEOWNERS:23

• The PR description says the generated LICENSES.md report is being added, but this change contains no LICENSES.md file—only the ownership pattern. Please check in the generated report (or correct the intended CI contract), otherwise this CODEOWNERS rule has no report to govern and the claimed baseline is missing.

LICENSES.* @indykite/devx @indykite/ops

• Files reviewed: 2/2 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

Correct the Trivy confidence key and add the promised LICENSES.md report.

Review details

Suppressed comments (2)

Previously missed (1) — in code that hasn't changed since the last review.

.trivy.yaml:58

• confidenceLevel is not the Trivy config key used for --license-confidence-level; the option is hyphenated as confidence-level. As written, this setting is ignored, so the license scan runs with Trivy's default confidence threshold rather than the requested 0.9. Rename the key to confidence-level.

CODEOWNERS:23

• This PR declares ownership for a generated LICENSES.* report, but the repository tree does not add LICENSES.md (the report promised in the PR description). If the existing license action validates the checked-in report as described, the first run has no report to validate; please commit the generated LICENSES.md or update the action contract.

LICENSES.* @indykite/devx @indykite/ops

• Files reviewed: 2/2 changed files
• Comments generated: 0 new
• Review effort level: Lite