Merge pull request #71 from symonbaikov/fix/dark-mode-remaining-light-areas

chore: tighten dependency license scan

Author: symonbaikov

.github/workflows/ci.yml

@@ -368,9 +368,12 @@ jobs:
     needs: [lint, typecheck]
     env:
       ALLOWED_LICENSES: >-
-        MIT;MIT*;Apache-2.0;ISC;BSD;BSD*;BSD-2-Clause;BSD-3-Clause;0BSD;Unlicense;UNLICENSED;
-        Python-2.0;BlueOak-1.0.0;LGPL;LGPL-2.1;LGPL-3.0;LGPL-3.0-or-later;CC0-1.0;CC-BY-4.0;
-        (MIT AND Zlib);(MIT AND BSD-3-Clause);(BSD-3-Clause OR GPL-2.0);(AFL-2.1 OR BSD-3-Clause)
+        MIT;MIT*;MIT-0;Apache-2.0;ISC;BSD;BSD*;BSD-2-Clause;BSD-3-Clause;0BSD;Unlicense;
+        Python-2.0;BlueOak-1.0.0;LGPL;LGPL-2.1;LGPL-3.0;LGPL-3.0-or-later;MPL-2.0;CC0-1.0;CC-BY-4.0;WTFPL;
+        (MIT OR Apache-2.0);(MIT OR CC0-1.0);(MIT OR EUPL-1.1+);(WTFPL OR MIT);(WTFPL OR ISC);
+        (BSD-2-Clause OR MIT OR Apache-2.0);(MIT AND Zlib);(MIT AND BSD-3-Clause);(MIT OR GPL-3.0-or-later);
+        (BSD-3-Clause OR GPL-2.0);(AFL-2.1 OR BSD-3-Clause);(Apache-2.0 AND LGPL-3.0-or-later);
+        (Apache-2.0 AND LGPL-3.0-or-later AND MIT)
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -385,25 +388,45 @@ jobs:
           cache-dependency-path: |
             package-lock.json
             backend/package-lock.json
+            electron/package-lock.json
             frontend/package-lock.json
+            website/package-lock.json
+
+      - name: Install root deps (no scripts)
+        run: npm ci --ignore-scripts
 
       - name: Install backend deps (no scripts)
         run: npm ci --prefix backend --ignore-scripts
 
+      - name: Install electron deps (no scripts)
+        run: npm ci --prefix electron --ignore-scripts
+
       - name: Install frontend deps (no scripts)
         run: npm ci --prefix frontend --ignore-scripts
 
+      - name: Install website deps (no scripts)
+        run: npm ci --prefix website --ignore-scripts
+
       - name: Backend audit (high/critical)
         run: npx audit-ci@9.4.0 --config backend/audit-ci.json --package-manager npm --path backend
 
       - name: Frontend audit (high/critical)
         run: npm audit --audit-level=high --prefix frontend
 
+      - name: Root license compliance
+        run: npx license-checker@25.0.1 --excludePrivatePackages --onlyAllow "$ALLOWED_LICENSES" --start .
+
       - name: Backend license compliance
-        run: npx license-checker@25.0.1 --production --onlyAllow "$ALLOWED_LICENSES" --start backend
+        run: npx license-checker@25.0.1 --excludePrivatePackages --onlyAllow "$ALLOWED_LICENSES" --start backend
+
+      - name: Electron license compliance
+        run: npx license-checker@25.0.1 --excludePackages lumio-desktop@1.0.0 --onlyAllow "$ALLOWED_LICENSES" --start electron
 
       - name: Frontend license compliance
-        run: npx license-checker@25.0.1 --production --onlyAllow "$ALLOWED_LICENSES" --start frontend
+        run: npx license-checker@25.0.1 --excludePrivatePackages --onlyAllow "$ALLOWED_LICENSES" --start frontend
+
+      - name: Website license compliance
+        run: npx license-checker@25.0.1 --excludePrivatePackages --onlyAllow "$ALLOWED_LICENSES" --start website
 
   secrets-scan:
     runs-on: ubuntu-latest

docs/security/ALLOWLISTS.md

@@ -12,9 +12,8 @@ Configured in `backend/audit-ci.json` and used by `dependency-scan` job:
 
 ## License exceptions
 
-`dependency-scan` runs license checks with a permissive allowlist that currently permits LGPL artifacts required by the build:
+`dependency-scan` runs license checks for dependencies in all npm package roots, including dev dependencies. The allowlist only permits open-source licenses and intentionally excludes `UNLICENSED` dependency packages.
 
-- `pdf2json` (LGPL) transitively pulled by `pdf2table` in the backend.
-- `@img/sharp-libvips-*` (LGPL) required by Next.js image pipeline.
+- `@img/sharp-libvips-*` (LGPL) required by `sharp`/Next.js image processing.
 
-If licensing requirements change, adjust the `ALLOWED_LICENSES` string in `.github/workflows/ci.yml` and tighten/removing these exceptions.
+If licensing requirements change, adjust the `ALLOWED_LICENSES` string in `.github/workflows/ci.yml` and tighten/remove these exceptions.

knip.json

@@ -254,27 +254,6 @@
           "sidebars.*"
         ]
       }
-    },
-    "react-email-starter": {
-      "entry": [
-        "emails/**/*.{ts,tsx}",
-        "components/**/*.{ts,tsx}",
-        "package.json"
-      ],
-      "project": [
-        "**/*.{ts,tsx,js,jsx}"
-      ],
-      "ignoreBinaries": [
-        "email"
-      ],
-      "ignoreDependencies": [
-        "react",
-        "react-dom",
-        "react-email",
-        "@react-email/preview-server",
-        "@types/react",
-        "@types/react-dom"
-      ]
     }
   },
   "tags": [