CI's 'License Compliance' job only reports third-party licenses — it never enforces any allow/deny policy, and never fails the build

[abayomicornelius]

Where: .github/workflows/security-audit.yml, license-compliance
job.

What's wrong:

- name: Check license compliance
  run: |
    ...
    npx license-checker --json --out licenses.json 2>/dev/null || true
    if [ -s licenses.json ]; then
      ... print a markdown table of every dependency's license to the job summary ...
    else
      echo "No license data available." >> $GITHUB_STEP_SUMMARY
    fi

There is no allowlist/denylist, no check against a set of
acceptable/unacceptable license identifiers, and no non-zero exit anywhere
in this step (license-checker itself is invoked with || true, silently
swallowing its own exit code). A dependency under a copyleft or otherwise
incompatible license (GPL, AGPL, etc.) would show up in the summary table
exactly the same as an MIT/Apache dependency — the job always succeeds
regardless of what it finds. A job named "License Compliance" reads as
enforcing a policy; as written it's purely an informational report.

Separately, package.json itself has no "license" field, so
license-checker's own output would list the root heliobond-backend
package's license as UNKNOWN in that same report, even though the repo
has an Apache-2.0 LICENSE file and CONTRIBUTING.md states contributions
are licensed under Apache-2.0.

Suggested fix: add "license": "Apache-2.0" to package.json, and give
license-checker an --onlyAllow (or --excludePackages/failOn) list so
the job actually fails when a disallowed license shows up, instead of only
ever producing a report.