From 930d3e7be307b15502b5b64f0082cbfbe18cebe2 Mon Sep 17 00:00:00 2001
From: BrewTestBot <1589480+BrewTestBot@users.noreply.github.com>
Date: Wed, 29 Jul 2026 13:43:34 +0000
Subject: [PATCH 1/2] denied-licenses.txt: update to match main configuration

---
 .github/denied-licenses.txt | 6 ++++++
 1 file changed, 6 insertions(+)
 create mode 100644 .github/denied-licenses.txt

diff --git a/.github/denied-licenses.txt b/.github/denied-licenses.txt
new file mode 100644
index 000000000..ae8c38d31
--- /dev/null
+++ b/.github/denied-licenses.txt
@@ -0,0 +1,6 @@
+# This file is synced from the `.github` repository, do not modify it directly.
+# SPDX licences denied for every dependency ecosystem.
+AGPL-1.0-only
+AGPL-1.0-or-later
+AGPL-3.0-only
+AGPL-3.0-or-later

From ed4efe5166908f46d5f4c2dcb56ee23062403a0e Mon Sep 17 00:00:00 2001
From: BrewTestBot <1589480+BrewTestBot@users.noreply.github.com>
Date: Wed, 29 Jul 2026 13:43:34 +0000
Subject: [PATCH 2/2] licenses.yml: update to match main configuration

---
 .github/workflows/licenses.yml | 96 ++++++++++++++++++++++++++++++++++
 1 file changed, 96 insertions(+)
 create mode 100644 .github/workflows/licenses.yml

diff --git a/.github/workflows/licenses.yml b/.github/workflows/licenses.yml
new file mode 100644
index 000000000..96469d8a7
--- /dev/null
+++ b/.github/workflows/licenses.yml
@@ -0,0 +1,96 @@
+# This file is synced from the `.github` repository, do not modify it directly.
+name: Licenses
+
+on:
+  push:
+    branches:
+      - main
+      - master
+  pull_request:
+  merge_group:
+
+permissions:
+  actions: write
+  contents: read
+
+defaults:
+  run:
+    shell: bash -euo pipefail {0}
+
+jobs:
+  licenses:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Homebrew
+        uses: Homebrew/actions/setup-homebrew@df4b09108a1de9d6f995fe68f302b3f68bd6d2ef # 2026.07.20.1
+
+      - name: Install git-pkgs
+        run: brew install git-pkgs
+
+      - name: Cache git-pkgs licence metadata
+        uses: actions/cache@55cc8345863c7cc4c66a329aec7e433d2d1c52a9 # v6.1.0
+        with:
+          path: ${{ runner.temp }}/git-pkgs
+          key: git-pkgs-metadata-v1-${{ hashFiles('**/Gemfile.lock', '**/Cargo.toml', '**/Cargo.lock', '**/package.json', '**/package-lock.json', '**/requirements.txt') }}
+          restore-keys: git-pkgs-metadata-v1-
+
+      - name: Read denied licences
+        run: |
+          if [[ ! -f .github/denied-licenses.txt ]]; then
+            echo "::error::.github/denied-licenses.txt is required."
+            exit 1
+          fi
+          denied="$(sed -E \
+            '/^[[:space:]]*(#|$)/d; s/^[[:space:]]*//; s/[[:space:]]*$//' \
+            .github/denied-licenses.txt | paste -sd, -)"
+          if [[ -z "${denied}" ]]; then
+            echo "::error::.github/denied-licenses.txt must contain at least one licence."
+            exit 1
+          fi
+          echo "Denied licences: ${denied}"
+          echo "DENIED_LICENSES=${denied}" >> "${GITHUB_ENV}"
+
+      - name: Check licences
+        env:
+          GIT_PKGS_DB: ${{ runner.temp }}/git-pkgs/metadata.db
+          # Identify ecosyste.ms requests for its polite pool:
+          # https://github.com/git-pkgs/git-pkgs#configuration
+          GIT_PKGS_ECOSYSTEMS_FROM: leads@brew.sh
+        run: |
+          output="${RUNNER_TEMP}/licenses.json"
+          stderr="${RUNNER_TEMP}/licenses.stderr"
+          status=0
+          git \
+            -c pkgs.ecosystems=cargo \
+            -c pkgs.ecosystems=docker \
+            -c pkgs.ecosystems=rubygems \
+            -c pkgs.ecosystems=github-actions \
+            -c pkgs.ecosystems=npm \
+            -c pkgs.ecosystems=pypi \
+            pkgs licenses --format=json --deny="${DENIED_LICENSES}" \
+            > "${output}" 2> "${stderr}" || status="$?"
+          if ! jq -e 'type == "array"' "${output}" &>/dev/null; then
+            echo "git pkgs licenses failed:"
+            cat "${stderr}"
+            cat "${output}"
+            if ((status == 0)); then
+              exit 1
+            fi
+            exit "${status}"
+          fi
+
+          violations="$(jq -r \
+            '.[] | select(.flagged) | . as $dep |
+            "\($dep.name) (\($dep.ecosystem)) \($dep.version // "?"): \($dep.licenses | join(", ")) - \($dep.flag_reason)"' \
+            "${output}")"
+          if [ -n "${violations}" ]; then
+            echo "Dependencies with denied licences:"
+            echo "${violations}"
+            exit 1
+          fi
+          echo "No denied licences found in $(jq length "${output}") dependencies."