Repository navigation
Public release: resolve license evidence for three bundled dependencies #11
Description
Public-release blocker
Obtain authoritative license evidence for three exact bundled dependency versions before public distribution of the Action. This tracks a rights/evidence gap, not a confirmed security vulnerability.
The esbuild input inventory at source commit 0a6cac52468f8a4cf1f65dc6245a7a2280556340 includes:
| Package | Published metadata | Missing evidence |
|---|---|---|
binary@0.3.0 |
Declares MIT | No full license text in its npm package; listed upstream repository returns 404 |
chainsaw@0.1.0 |
Declares MIT/X11 | No full license text in its npm package; listed upstream repository returns 404 |
buffers@0.1.1 |
No license declaration in the published package/registry metadata | No license file or full terms; listed upstream repository returns 404 |
Registry metadata and package contents were inspected on October 23, 2026. A third-party distributor's license classification is not being substituted for authoritative permission evidence, and MIT permission is not being invented for buffers.
Acceptance
- Obtain authoritative terms and attribution for
binary@0.3.0, or approve a separate dependency-remediation change. - Obtain authoritative terms and attribution for
chainsaw@0.1.0, or approve a separate dependency-remediation change. - Establish the applicable license/permission and attribution for
buffers@0.1.1, or approve a separate dependency-remediation change. - Bind any supplied evidence to the exact shipped package/version and record provenance.
- Regenerate the bundled dependency inventory and notices, and verify packaged distribution.
- Record the release owner's disposition before public distribution.
Boundary
The companion packaging work includes all available notices and explicitly marks these entries missing-license-text. Passing build, packaging, CI, or model checks does not resolve this issue or authorize publication.
Do not close this blocker merely because the notice-generation PR merges. This issue does not authorize dependency replacement, releases, tag moves, Marketplace publication, repository visibility changes, or broader model runs.
Activity
jongio commentedon Oct 23, 2026
Implementation and evidence: #12 at c4e672f adds the inventory and available full notices while preserving these three unresolved entries. This issue remains open after merge; CI success is not license clearance.
jongio commentedon Oct 23, 2026
The review correction in 14db1ff limits inventory to emitted code: 168 contributing packages, with the same three unresolved versions still present. Their published JS/README/metadata were also checked for embedded terms; only the previously recorded MIT/MIT-X11 declarations were found. The protobuf runtime's separate BSD terms are available in its source headers and are now included alongside Apache; that does not resolve these three gaps.
jongio commentedon Oct 23, 2026
The notice-generation PR merged as c529047. This blocker remains open: all three unresolved versions still contribute executable code. Current-main notices do not, by themselves, establish clearance for historical bundled distributions.
jongio commentedon Oct 23, 2026
What is needed to close
@actions/artifact@6.3.1 -> unzip-stream@0.3.4 -> binary@0.3.0 -> buffers@0.1.1 / chainsaw@0.1.0. The currently published latestartifactandunzip-streamversions still contain this path, so an ordinary version bump is not an established fix. Existing upstream tracking: [@actions/artifact] Transitive dependencybuffershas no declared license actions/toolkit#2392; no maintainer resolution was recorded there when checked.No dependency override, release, tag move, or publication was performed by this assessment.
jongio commentedon Oct 30, 2026
Audit against
github/evals-action@14724b731a90910707b40246d0f95b8e9aac30c9(main):main: Emitted-code notice generation (#12,c529047) and contribution terms (#14,14724b7).dist/index.jsstill includes executable code frombinary@0.3.0,buffers@0.1.1, andchainsaw@0.1.0(via@actions/artifact@6.3.1 -> unzip-stream@0.3.4), which lack full license texts in their published npm packages. Requires dependency replacement or license clearance before public release.ronniegeraghty commentedon Nov 2, 2026
Closing per release-owner decision: we are not treating this license-evidence concern as a blocker for making github/evals-action public.