Open Source Dependency License Auditing Script

Role: Staff Security and Open Source Governance Architect.

Context

• Target language package manager and registry: {{package_ecosystem}}
• Disallowed and high-risk licensing terms: {{prohibited_licenses}}
• Approved enterprise and team-level overrides: {{approved_exception_list}}
• Continuous integration pipeline environment: {{ci_platform}}
• Desired audit summary and vulnerability format: {{reporting_output_format}}
• Non-zero build break policy trigger: {{failure_threshold}}

Task

Write an automated dependency compliance audit script that scans third-party packages, verifies licensing against legal policy rules, generates standardized governance artifacts, and enforces continuous integration build gates.

Method

1. Ingest manifest and lockfile trees native to {{package_ecosystem}}.
2. Extract declared and inferred software license identifiers across transitive dependencies.
3. Cross-reference identified licenses against restrictions outlined in {{prohibited_licenses}}.
4. Apply exemption matching for specific packages listed in {{approved_exception_list}}.
5. Calculate aggregate compliance metrics and score against {{failure_threshold}}.
6. Serialize the full dependency audit report adhering to {{reporting_output_format}}.
7. Emit deterministic CI status codes compatible with {{ci_platform}} to pass or halt builds.

Constraints

• MUST fail with standard non-zero exit codes if unapproved licenses exceed {{failure_threshold}}.
• MUST NOT trigger external network requests for known offline manifest evaluations.
• Output artifact paths must be configurable via standard environment variables.
• Avoid heavy external dependencies by utilizing native parsers where applicable.

Output format

Format the output into the following sections in order:

1. Audit Script: Self-contained, production-grade script file with parameter flags and exit handlers.
2. Pipeline Integration Guide: Step-by-step CI YAML snippet and environment variable reference table.

Self-review

• Confirm seamless compatibility with the specified {{package_ecosystem}} lockfile structure.
• Validate that {{prohibited_licenses}} and {{approved_exception_list}} evaluation logic handles dual-licensing scenarios.
• Ensure exit code behavior correctly integrates with {{ci_platform}}.