github--github-mcp-server/script/licenses

#!/bin/bash
#
# Generate license files for all platform/arch combinations.
# This script handles architecture-specific dependency differences by:
# 1. Generating separate license reports per GOOS/GOARCH combination
# 2. Grouping identical reports together (comma-separated arch names)
# 3. Creating an index at the top of each platform file
# 4. Copying all license files to third-party/
#
# Note: third-party/ is a union of all license files across all architectures.
# This means that license files for dependencies present in only some architectures
# may still appear in third-party/. This is intentional and ensures compliance.
#
# Note: we ignore warnings because we want the command to succeed, however the output should be checked
#       for any new warnings, and potentially we may need to add license information.
#
#       Normally these warnings are packages containing non go code, which may or may not require explicit attribution,
#       depending on the license.
set -e

# Pinned version for CI reproducibility, latest for local development
# See: https://github.com/cli/cli/pull/11161
if [ "$CI" = "true" ]; then
    go install github.com/google/go-licenses@5348b744d0983d85713295ea08a20cca1654a45e # v2.0.1
else
    go install github.com/google/go-licenses@latest
fi

# actions/setup-go does not setup the installed toolchain to be preferred over the system install,
# which causes go-licenses to raise "Package ... does not have module info" errors in CI.
# For more information, https://github.com/google/go-licenses/issues/244#issuecomment-1885098633
if [ "$CI" = "true" ]; then
    export GOROOT=$(go env GOROOT)
    export PATH=${GOROOT}/bin:$PATH
fi

# actions/setup-go does not setup the installed toolchain to be preferred over the system install,
# which causes go-licenses to raise "Package ... does not have module info" errors in CI.
# For more information, https://github.com/google/go-licenses/issues/244#issuecomment-1885098633
if [ "$CI" = "true" ]; then
    export GOROOT=$(go env GOROOT)
    export PATH=${GOROOT}/bin:$PATH
fi

rm -rf third-party
mkdir -p third-party
export TEMPDIR="$(mktemp -d)"

trap "rm -fr ${TEMPDIR}" EXIT

# Cross-platform hash function (works on both Linux and macOS)
compute_hash() {
    if command -v md5sum >/dev/null 2>&1; then
        md5sum | cut -d' ' -f1
    elif command -v md5 >/dev/null 2>&1; then
        md5 -q
    else
        # Fallback to cksum if neither is available
        cksum | cut -d' ' -f1
    fi
}

# Function to get architectures for a given OS
get_archs() {
    case "$1" in
        linux)   echo "386 amd64 arm64" ;;
        darwin)  echo "amd64 arm64" ;;
        windows) echo "386 amd64 arm64" ;;
    esac
}

# Generate reports for each platform/arch combination
for goos in darwin linux windows; do
    echo "Processing ${goos}..."
    
    archs=$(get_archs "$goos")
    
    for goarch in $archs; do
        echo "  Generating for ${goos}/${goarch}..."
        
        # Generate the license report for this arch
        report_file="${TEMPDIR}/${goos}_${goarch}_report.md"
        GOOS="${goos}" GOARCH="${goarch}" GOFLAGS=-mod=mod go-licenses report ./... --template .github/licenses.tmpl > "${report_file}" 2>/dev/null || echo "  (warnings ignored for ${goos}/${goarch})"
        
        # Save licenses to temp directory
        GOOS="${goos}" GOARCH="${goarch}" GOFLAGS=-mod=mod go-licenses save ./... --save_path="${TEMPDIR}/${goos}_${goarch}" --force 2>/dev/null || echo "  (warnings ignored for ${goos}/${goarch})"
        
        # Copy to third-party (accumulate all - union of all architectures for compliance)
        if [ -d "${TEMPDIR}/${goos}_${goarch}" ]; then
            cp -fR "${TEMPDIR}/${goos}_${goarch}"/* third-party/ 2>/dev/null || true
        fi
        
        # Extract just the package list (skip header), sort it, and hash it
        # Use LC_ALL=C for consistent sorting across different systems
        packages_file="${TEMPDIR}/${goos}_${goarch}_packages.txt"
        if [ -s "${report_file}" ] && grep -qE '^ - \[' "${report_file}" 2>/dev/null; then
            grep -E '^ - \[' "${report_file}" | LC_ALL=C sort > "${packages_file}"
            hash=$(cat "${packages_file}" | compute_hash)
        else
            echo "(FAILED TO GENERATE LICENSE REPORT FOR ${goos}/${goarch})" > "${packages_file}"
            hash="FAILED_${goos}_${goarch}"
        fi
        
        # Store hash for grouping
        echo "${hash}" > "${TEMPDIR}/${goos}_${goarch}_hash.txt"
    done
    
    # Group architectures with identical reports (deterministic order)
    # Create groups file: hash -> comma-separated archs
    groups_file="${TEMPDIR}/${goos}_groups.txt"
    rm -f "${groups_file}"
    
    # Process architectures in order to build groups
    for goarch in $archs; do
        hash=$(cat "${TEMPDIR}/${goos}_${goarch}_hash.txt")
        # Check if we've seen this hash before
        if grep -q "^${hash}:" "${groups_file}" 2>/dev/null; then
            # Append to existing group
            existing=$(grep "^${hash}:" "${groups_file}" | cut -d: -f2)
            sed -i.bak "s/^${hash}:.*/${hash}:${existing}, ${goarch}/" "${groups_file}"
            rm -f "${groups_file}.bak"
        else
            # New group
            echo "${hash}:${goarch}" >> "${groups_file}"
        fi
    done
    
    # Generate the combined report for this platform
    output_file="third-party-licenses.${goos}.md"
    
    cat > "${output_file}" << 'EOF'
# GitHub MCP Server dependencies

The following open source dependencies are used to build the [github/github-mcp-server][] GitHub Model Context Protocol Server.

## Table of Contents

EOF

    # Build table of contents (sorted for determinism)
    # Use LC_ALL=C for consistent sorting across different systems
    LC_ALL=C sort "${groups_file}" | while IFS=: read -r hash group_archs; do
        # Create anchor-friendly name
        anchor=$(echo "${group_archs}" | tr ', ' '-' | tr -s '-')
        echo "- [${group_archs}](#${anchor})" >> "${output_file}"
    done
    
    echo "" >> "${output_file}"
    echo "---" >> "${output_file}"
    echo "" >> "${output_file}"
    
    # Add each unique report section (sorted for determinism)
    # Use LC_ALL=C for consistent sorting across different systems
    LC_ALL=C sort "${groups_file}" | while IFS=: read -r hash group_archs; do
        # Get the packages from the first arch in this group
        first_arch=$(echo "${group_archs}" | cut -d',' -f1 | tr -d ' ')
        packages=$(cat "${TEMPDIR}/${goos}_${first_arch}_packages.txt")
        
        cat >> "${output_file}" << EOF
## ${group_archs}

The following packages are included for the ${group_archs} architectures.

${packages}

EOF
    done
    
    # Add footer
    echo "[github/github-mcp-server]: https://github.com/github/github-mcp-server" >> "${output_file}"
    
    echo "Generated ${output_file}"
done

echo "Done! License files generated."