Bundle licenses at release time by williammartin · Pull Request #12625 · cli/cli

williammartin · 2026-02-06T12:18:39Z

Description

We currently handle our license compliance by producing reports, and including licenses and NOTICES in our source code. We have a script that does this per GOOS but we started experiencing issues when GOARCH differences could result in failures on CI not noticed locally. We made an attempt to provide a matrix of these options but it gets pretty annoying. We'd also need to keep it updated as release targets change.

Separately, we also have this issue where every dependabot PR requires make licenses which is super annoying. This PR moves all of that to build time as a goreleaser hook, which already has GOOS and GOARCH, and then the results are bundled in the binary via embed and made available via gh licenses.

I don't think we have any obligation to solve for other people building/distributing an artifact, so the default embed has some help text.

Reviewer Notes

You can run ./script/release --local --platform <platform> to build under ./dist and use gh licenses to check the output.

You can also get a staging release from here: https://github.com/cli/cli/actions/runs/21755383986

It maybe adds about 1MB to the size of the binary, seems fast enough to run gh licenses

Copilot

Pull request overview

This PR modernizes the license compliance workflow by moving license generation from development time to build time. License information is now generated as a goreleaser pre-build hook for each platform and embedded into the binary via go:embed, making it accessible through a new gh licenses command. This eliminates the need to commit platform-specific license files to the repository and removes the requirement to run make licenses after every dependency update.

Changes:

Removed all committed third-party license files and reports from the repository
Modified script/licenses to support both single-platform generation and verification modes
Added goreleaser pre-build hooks to generate licenses for each build target
Introduced new gh licenses command to display embedded license information

Reviewed changes

Copilot reviewed 207 out of 207 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
third-party/*/LICENSE	Removed all committed third-party license files
script/licenses-check	Removed standalone license check script
script/licenses	Refactored to support both build-time generation and CI verification
pkg/cmd/root/root.go	Added licenses command to root command
pkg/cmd/licenses/licenses.go	New command to display embedded license information
internal/licenses/licenses.go	Core logic for embedding and formatting license content
internal/licenses/licenses_test.go	Unit tests for license content generation
internal/licenses/embed/*	Placeholder files for embedded license data
docs/license-compliance.md	Updated documentation for new workflow
Makefile	Updated license targets to use new script interface
.goreleaser.yml	Added pre-build hooks to generate licenses
.github/workflows/lint.yml	Updated CI to verify license generation
.github/secret_scanning.yml	Removed exclusions for deleted license files
.github/licenses.tmpl	Simplified template for embedded report

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

BagToad · 2026-02-06T17:31:20Z

.github/workflows/lint.yml

      # which causes go-licenses to raise "Package ... does not have module info" errors.
      # For more information, https://github.com/google/go-licenses/issues/244#issuecomment-1885098633
      #
      # go-licenses has been pinned for automation use.


I don't think this comment is valid anymore

Suggested change

# go-licenses has been pinned for automation use.

BagToad · 2026-02-18T16:20:03Z

.github/secret_scanning.yml

-paths-ignore:
-  - 'third-party/**'
-  - 'third-party-licenses.*.md'
+paths-ignore: []


Could just delete this file, probably.

BagToad · 2026-02-18T16:25:32Z

It maybe adds about 1MB to the size of the binary

Not sure it's practical, but maybe we could look at compressing the embedded licenses and decompressing them at runtime?

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

This MR contains the following updates: | Package | Update | Change | |---|---|---| | [cli/cli](https://github.com/cli/cli) | minor | `v2.86.0` → `v2.87.3` | MR created with the help of [el-capitano/tools/renovate-bot](https://gitlab.com/el-capitano/tools/renovate-bot). **Proposed changes to behavior should be submitted there as MRs.** --- ### Release Notes <details> <summary>cli/cli (cli/cli)</summary> ### [`v2.87.3`](https://github.com/cli/cli/releases/tag/v2.87.3): GitHub CLI 2.87.3 [Compare Source](cli/cli@v2.87.2...v2.87.3) #### What's Changed - Fix project mutation query variable usage by [@williammartin](https://github.com/williammartin) in [#12757](cli/cli#12757) **Full Changelog**: <cli/cli@v2.87.2...v2.87.3> ### [`v2.87.2`](https://github.com/cli/cli/releases/tag/v2.87.2): GitHub CLI 2.87.2 [Compare Source](cli/cli@v2.87.1...v2.87.2) #### ℹ️ Note This release was cut primarily to resolve a publishing issue. We recommend reviewing [the v2.87.1 release notes](https://github.com/cli/cli/releases/tag/v2.87.1) for the complete set of latest features and fixes. #### What's Changed - chore(deps): bump golang.org/x/crypto from 0.47.0 to 0.48.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#12659](cli/cli#12659) **Full Changelog**: <cli/cli@v2.87.1...v2.87.2> ### [`v2.87.1`](https://github.com/cli/cli/releases/tag/v2.87.1): GitHub CLI 2.87.1 [Compare Source](cli/cli@v2.87.0...v2.87.1) #### ⚠️ Incomplete Release The v2.87.1 release experienced a failure in our workflow and is not fully published to the designated package managers/repositories. This is resolved in [v2.87.2](https://github.com/cli/cli/releases/tag/v2.87.2), so we recommend using that release instead. #### What's Changed - Remove license bundling debris by [@williammartin](https://github.com/williammartin) in [#12716](cli/cli#12716) - fix(agent-task/capi): use a fixed CAPI API version by [@babakks](https://github.com/babakks) in [#12731](cli/cli#12731) **Full Changelog**: <cli/cli@v2.87.0...v2.87.1> ### [`v2.87.0`](https://github.com/cli/cli/releases/tag/v2.87.0): GitHub CLI 2.87.0 [Compare Source](cli/cli@v2.86.0...v2.87.0) #### `gh workflow run` immediately returns workflow run URL One of our most requested features - with the latest changes in GitHub API, `gh workflow run` will immediately print the created workflow run URL. #### Improved `gh auth login` experience in VM/WSL environments We have observed rare cases of time drift between the wall and monotonic clocks, mostly in WSL or VM environments, causing failures during polling for the OAuth token. This new release implements measures to account for such situations. If you continue to experience `gh auth login` issues in WSL, please comment in [#9370](cli/cli#9370) ####

Request Copilot Code Review from `gh` + performance improvements `gh pr edit` now supports [Copilot Code Review](https://docs.github.com/en/copilot/using-github-copilot/code-review/using-copilot-code-review) as a reviewer. You can request a review from Copilot using the `--add-reviewer @copilot` flag or interactively by selecting reviewers in the prompts. This release also introduces a new search experience for selecting reviewers and assignees in `gh pr edit`. Instead of loading all collaborators and teams upfront, results are now fetched based on inputs to a new search option. Initial options are suggestions based on those involved with the pull request already. ``` ? Reviewers [Use arrows to move, space to select, <right> to all, <left> to none, type to filter] [ ] Search (7472 more) [x] BagToad (Kynan Ware) > [x] Copilot (AI) ``` This experience will follow in `gh pr create` and `gh issue` for assignees in a later release. #### What's Changed ##### ✨ Features - Bundle licenses at release time by [@williammartin](https://github.com/williammartin) in [#12625](cli/cli#12625) - Add `--query` flag to `project item-list` by [@williammartin](https://github.com/williammartin) in [#12696](cli/cli#12696) - feat(workflow run): retrieve workflow dispatch run details by [@babakks](https://github.com/babakks) in [#12695](cli/cli#12695) - Pin REST API version to 2022-11-28 by [@williammartin](https://github.com/williammartin) in [#12680](cli/cli#12680) - Respect `--exit-status` with `--log` and `--log-failed` in `run view` by [@williammartin](https://github.com/williammartin) in [#12679](cli/cli#12679) - Fork with default branch only during pr create by [@williammartin](https://github.com/williammartin) in [#12673](cli/cli#12673) - `gh pr edit`: Add support for Copilot as reviewer with search capability, performance and accessibility improvements by [@BagToad](https://github.com/BagToad) in [#12567](cli/cli#12567) - `gh pr edit`: new interactive prompt for assignee selection, performance and accessibility improvements by [@BagToad](https://github.com/BagToad) in [#12526](cli/cli#12526) ##### 📚 Docs & Chores - Clean up project item-list query addition changes by [@williammartin](https://github.com/williammartin) in [#12714](cli/cli#12714) - `gh release upload`: Clarify `--clobber` flag deletes assets before re-uploading by [@BagToad](https://github.com/BagToad) in [#12711](cli/cli#12711) - Add usage examples to `gh gist edit` command by [@BagToad](https://github.com/BagToad) in [#12710](cli/cli#12710) - Remove feedback issue template by [@BagToad](https://github.com/BagToad) in [#12708](cli/cli#12708) - Migrate issue triage workflows to shared workflows by [@BagToad](https://github.com/BagToad) in [#12677](cli/cli#12677) - Migrate MR triage workflows to shared workflows by [@BagToad](https://github.com/BagToad) in [#12707](cli/cli#12707) - Add missing TODO comments for featuredetection if-statements by [@BagToad](https://github.com/BagToad) in [#12701](cli/cli#12701) - Add manual dispatch to bump-go workflow by [@BagToad](https://github.com/BagToad) in [#12631](cli/cli#12631) - typo: dont to don't by [@cuiweixie](https://github.com/cuiweixie) in [#12554](cli/cli#12554) - Fix fmt.Errorf format argument in ParseFullReference by [@mikelolasagasti](https://github.com/mikelolasagasti) in [#12516](cli/cli#12516) - Lint source.md by [@Sethispr](https://github.com/Sethispr) in [#12521](cli/cli#12521) #####

Dependencies - chore(deps): bump golang.org/x/text from 0.32.0 to 0.33.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#12468](cli/cli#12468) - chore(deps): bump golang.org/x/term from 0.38.0 to 0.39.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#12616](cli/cli#12616) - Bump go to 1.25.7 by [@BagToad](https://github.com/BagToad) in [#12630](cli/cli#12630) - chore(deps): bump golang.org/x/crypto from 0.46.0 to 0.47.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#12629](cli/cli#12629) - chore: bump `cli/oauth` to `v1.2.2` by [@babakks](https://github.com/babakks) in [#12573](cli/cli#12573) - update Go to 1.25.6 by [@BagToad](https://github.com/BagToad) in [#12580](cli/cli#12580) - chore(deps): bump actions/attest-build-provenance from 3.1.0 to 3.2.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#12558](cli/cli#12558) - chore(deps): bump github.com/sigstore/rekor from 1.4.3 to 1.5.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#12524](cli/cli#12524) - chore(deps): bump github.com/theupdateframework/go-tuf/v2 from 2.3.1 to 2.4.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#12555](cli/cli#12555) - chore(deps): bump github.com/gdamore/tcell/v2 from 2.13.4 to 2.13.7 by [@dependabot](https://github.com/dependabot)\[bot] in [#12469](cli/cli#12469) - chore(deps): bump github.com/sigstore/sigstore from 1.10.0 to 1.10.4 by [@dependabot](https://github.com/dependabot)\[bot] in [#12525](cli/cli#12525) - chore(deps): bump github.com/theupdateframework/go-tuf/v2 from 2.3.0 to 2.3.1 by [@dependabot](https://github.com/dependabot)\[bot] in [#12515](cli/cli#12515) - chore(deps): bump actions/download-artifact from 6 to 7 by [@dependabot](https://github.com/dependabot)\[bot] in [#12314](cli/cli#12314) - chore(deps): bump actions/upload-artifact from 5 to 6 by [@dependabot](https://github.com/dependabot)\[bot] in [#12315](cli/cli#12315) - chore(deps): bump goreleaser/goreleaser-action from 6.0.0 to 6.4.0 by [@dependabot](https://github.com/dependabot)\[bot] in [#12354](cli/cli#12354) #### New Contributors - [@Sethispr](https://github.com/Sethispr) made their first contribution in [#12521](cli/cli#12521) - [@cuiweixie](https://github.com/cuiweixie) made their first contribution in [#12554](cli/cli#12554) **Full Changelog**: <cli/cli@v2.86.0...v2.87.0> </details> --- ### Configuration 📅 **Schedule**: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined). 🚦 **Automerge**: Disabled by config. Please merge this manually once you are satisfied. ♻ **Rebasing**: Whenever MR becomes conflicted, or you tick the rebase/retry checkbox. 🔕 **Ignore**: Close this MR and you won't be reminded about this update again. --- - [ ] If you want to rebase/retry this MR, check this box --- This MR has been generated by [Renovate Bot](https://github.com/renovatebot/renovate).

williammartin temporarily deployed to cli-automation February 6, 2026 12:18 — with GitHub Actions Inactive

williammartin force-pushed the wm-bundle-licenses-in-binaries branch 3 times, most recently from e76ba52 to 6c83778 Compare February 6, 2026 14:45

williammartin had a problem deploying to staging February 6, 2026 14:53 — with GitHub Actions Failure

williammartin force-pushed the wm-bundle-licenses-in-binaries branch from 6c83778 to 03ba23c Compare February 6, 2026 15:02

williammartin temporarily deployed to staging February 6, 2026 15:02 — with GitHub Actions Inactive

williammartin had a problem deploying to staging February 6, 2026 15:02 — with GitHub Actions Failure

williammartin force-pushed the wm-bundle-licenses-in-binaries branch from 03ba23c to 9c844a7 Compare February 6, 2026 15:07

williammartin deployed to staging February 6, 2026 15:10 — with GitHub Actions Active

williammartin temporarily deployed to staging February 6, 2026 15:10 — with GitHub Actions Inactive

williammartin had a problem deploying to staging February 6, 2026 15:10 — with GitHub Actions Error

williammartin marked this pull request as ready for review February 6, 2026 15:16

williammartin requested a review from a team as a code owner February 6, 2026 15:16

williammartin requested review from babakks and Copilot February 6, 2026 15:16

williammartin temporarily deployed to cli-automation February 6, 2026 15:16 — with GitHub Actions Inactive

cliAutomation assigned williammartin Feb 6, 2026

Copilot AI reviewed Feb 6, 2026

View reviewed changes

Bundle licenses at release time

b510389

williammartin force-pushed the wm-bundle-licenses-in-binaries branch from 9c844a7 to b510389 Compare February 18, 2026 15:47

BagToad approved these changes Feb 18, 2026

View reviewed changes

williammartin added 2 commits February 18, 2026 17:35

Remove secret scanning file

64db5c7

Remove pinned go-licenses comment

8ee85e3

williammartin merged commit 7ea88b1 into trunk Feb 18, 2026
11 checks passed

williammartin deleted the wm-bundle-licenses-in-binaries branch February 18, 2026 16:59

williammartin added a commit that referenced this pull request Feb 18, 2026

Bundle licenses at release time (#12625)

cdeba90

Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>

williammartin mentioned this pull request Feb 18, 2026

Remove license bundling debris #12716

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Bundle licenses at release time#12625

Bundle licenses at release time#12625
williammartin merged 3 commits intotrunkfrom
wm-bundle-licenses-in-binaries

williammartin commented Feb 6, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

BagToad Feb 6, 2026

Uh oh!

BagToad Feb 18, 2026

Uh oh!

BagToad commented Feb 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

williammartin commented Feb 6, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Reviewer Notes

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

BagToad Feb 6, 2026

Choose a reason for hiding this comment

Uh oh!

BagToad Feb 18, 2026

Choose a reason for hiding this comment

Uh oh!

BagToad commented Feb 18, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

williammartin commented Feb 6, 2026 •

edited

Loading