claude-plugins/.github/workflows/validate-licenses.yml

name: Validate Plugin Licenses

on:
  pull_request:
    paths:
      - 'plugins/**'
  push:
    branches: [main]
    paths:
      - 'plugins/**'

permissions:
  contents: read

jobs:
  validate-licenses:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4

      - name: Check every plugin has an Apache 2.0 LICENSE file
        run: |
          set -euo pipefail
          # Plugins that intentionally ship a non-Apache LICENSE. claude-security
          # is deliberately proprietary (see #4427 — replacement rejected); it is
          # exempt from the Apache 2.0 content check but must still ship a LICENSE.
          exempt=("plugins/claude-security")
          missing=()
          wrong_content=()
          for plugin_dir in plugins/*/; do
            plugin="${plugin_dir%/}"
            if [[ ! -f "$plugin/LICENSE" ]]; then
              missing+=("$plugin")
            elif [[ " ${exempt[*]} " == *" $plugin "* ]]; then
              :  # intentionally non-Apache — LICENSE presence already verified
            elif ! grep -q "Apache License" "$plugin/LICENSE" || \
                 ! grep -q "Version 2.0" "$plugin/LICENSE"; then
              wrong_content+=("$plugin")
            fi
          done
          if [[ "${#missing[@]}" -gt 0 ]]; then
            echo "::error::The following plugins are missing a LICENSE file:"
            for p in "${missing[@]}"; do
              echo "  - $p"
            done
            exit 1
          fi
          if [[ "${#wrong_content[@]}" -gt 0 ]]; then
            echo "::error::The following plugins have a LICENSE file that does not contain Apache 2.0 text:"
            for p in "${wrong_content[@]}"; do
              echo "  - $p"
            done
            exit 1
          fi
          echo "All $(ls -d plugins/*/ | wc -l) plugins have a LICENSE file (Apache 2.0 except documented exemptions)."