Add OSS license and vulnerability report workflow

.github/workflows/oss-license-vulnerability-report.yml

@@ -0,0 +1,91 @@
+# SPDX-FileCopyrightText: Copyright (c) 2026 NVIDIA CORPORATION & AFFILIATES. All rights reserved.
+# SPDX-License-Identifier: Apache-2.0
+
+name: OSS license and vulnerability report
+
+on:
+  push:
+    branches: [ main ]
+  pull_request:
+    types: [opened, synchronize, reopened]
+  workflow_dispatch:
+
+concurrency:
+  group: ${{ github.workflow }}-${{ github.ref }}
+  cancel-in-progress: ${{ github.event_name == 'pull_request' }}
+
+permissions:
+  contents: read
+
+env:
+  CORE_APT_DEPS: build-essential cmake glslang-tools libdbus-1-dev libvulkan-dev libwayland-dev libx11-dev libxcursor-dev libxext-dev libxi-dev libxinerama-dev libxkbcommon-dev libxrandr-dev pkg-config wayland-protocols
+  VCPKG_COMMIT: d015e31e90838a4c9dfa3eed45979bc70d9357fc  # 2026.05.25
+
+jobs:
+  oss-license-vulnerability-report:
+    runs-on: ubuntu-latest
+    timeout-minutes: 90
+
+    steps:
+    - name: Checkout code
+      uses: actions/checkout@v6
+      with:
+        persist-credentials: false
+
+    - name: Setup Python
+      uses: actions/setup-python@v6
+      with:
+        python-version: "3.12"
+
+    - name: Install uv
+      uses: ./.github/actions/setup-uv
+
+    - name: Install maximum-profile build dependencies
+      run: |
+        sudo apt-get update
+        sudo apt-get install -y $CORE_APT_DEPS \
+          autoconf automake libtool pkg-config libudev-dev
+
+    - name: Install CUDA toolkit for maximum-profile configuration
+      uses: ./.github/actions/setup-cuda
+
+    - name: Setup pinned vcpkg
+      run: |
+        git clone https://github.com/microsoft/vcpkg "${RUNNER_TEMP}/vcpkg"
+        git -C "${RUNNER_TEMP}/vcpkg" checkout --detach "${VCPKG_COMMIT}"
+        "${RUNNER_TEMP}/vcpkg/bootstrap-vcpkg.sh" -disableMetrics
+        echo "VCPKG_ROOT=${RUNNER_TEMP}/vcpkg" >> "${GITHUB_ENV}"
+
+    - name: Install REUSE
+      run: |
+        python -m pip install --upgrade pip
+        python -m pip install reuse
+
+    - name: Install Trivy
+      uses: aquasecurity/setup-trivy@v0.2.6
+      with:
+        version: v0.72.0
+
+    - name: Generate OSS report
+      run: |
+        ./scripts/run_oss_license_vulnerability_report.sh .
+
+    - name: Publish OSS report summary
+      if: always()
+      run: |
+        if [[ -f oss-report/summary.md ]]; then
+          cat oss-report/summary.md >> "${GITHUB_STEP_SUMMARY}"
+        elif [[ -f oss-report/dependency-coverage.md ]]; then
+          cat oss-report/dependency-coverage.md >> "${GITHUB_STEP_SUMMARY}"
+        else
+          echo "OSS report generation did not produce summary.md." >> "${GITHUB_STEP_SUMMARY}"
+        fi
+
+    - name: Upload OSS report artifact
+      if: always()
+      uses: actions/upload-artifact@v6
+      with:
+        name: isaacteleop-oss-license-vulnerability-report
+        path: oss-report
+        if-no-files-found: error
+        retention-days: 14

docs/source/index.rst

@@ -83,6 +83,7 @@ Table of Contents
    references/rig
    references/oob_teleop_control
    references/egocentric_hand_reconstruction
+   references/oss_license_vulnerability_report
    references/license
 
 Indices and tables

docs/source/references/oss_license_vulnerability_report.rst

@@ -0,0 +1,88 @@
+.. _oss-license-vulnerability-report:
+
+OSS License and Vulnerability Report
+====================================
+
+The ``OSS license and vulnerability report`` workflow publishes resolved
+dependency coverage, a canonical CycloneDX SBOM, vulnerability findings, and
+license metadata. Dependency coverage fails closed even while vulnerability and
+license policy findings remain advisory.
+
+Generated files
+---------------
+
+The workflow uploads the ``isaacteleop-oss-license-vulnerability-report``
+artifact. It contains:
+
+- ``dependency-inventory.json`` and ``dependency-inventory.md`` from the
+  repository manifest collector.
+- ``dependency-coverage.json`` and ``dependency-coverage.md``, which classify
+  every declaration as resolved, explicitly excluded, or unresolved.
+- ``bom.cdx.json``, the canonical CycloneDX 1.6 SBOM scanned by Trivy.
+- ``trivy-vulnerability-report.json`` and, when available,
+  ``trivy-vulnerability-report.sarif``.
+- ``reuse-lint.txt`` and, when available, ``reuse.spdx``.
+- ``summary.md``, which is also appended to the GitHub workflow summary.
+
+Collector coverage
+------------------
+
+``scripts/collect_oss_dependencies.py`` scans common dependency declarations:
+
+- Python ``requirements*.txt`` and ``pyproject.toml`` files.
+- npm ``package.json`` files.
+- CMake ``FetchContent_Declare``, ``ExternalProject_Add``, and
+  ``CPMAddPackage`` declarations.
+- ``vcpkg.json`` manifests.
+- Docker ``FROM`` image references.
+- GitHub Actions ``uses: owner/action@ref`` references.
+
+The resolver configures a maximum open-source CMake profile with plugins,
+examples, tests, visualization, and the OAK camera plugin enabled. CMake trace
+output captures expanded ``FetchContent`` declarations, including declarations
+from populated projects. The generated vcpkg status database supplies exact
+installed versions. The resolver also produces an npm lockfile from each npm
+manifest and a universal ``uv`` lock from the combined Python declarations.
+
+``dependency-coverage.json`` joins those package-manager and configured-build
+results back to the declaration inventory. A declaration without concrete
+resolver evidence must have a narrow, named exclusion with a reason. Parse
+errors, unsupported package-manager manifests, unexpanded expressions, and
+unmatched declarations fail the job. Adding a new manifest or build option
+therefore cannot silently reduce report coverage.
+
+Trivy first catalogs the resolved workspace into CycloneDX. The coverage audit
+adds configured CMake and generated vcpkg components to that document, then
+Trivy scans ``bom.cdx.json`` as an SBOM target. ``summary.md`` reports declared,
+resolved, excluded, unresolved, SBOM, and scanner counts separately.
+
+License hygiene
+---------------
+
+REUSE runs before report artifacts are generated, so generated JSON, SARIF, and
+Markdown files do not inflate the missing-license baseline. ``summary.md`` reports
+the lint and SPDX export statuses separately, whether REUSE lint passed, and, when
+available, the number of files with license and copyright metadata. Full details
+remain in ``reuse-lint.txt`` and ``reuse.spdx``.
+
+Policy mode
+-----------
+
+Dependency coverage is always blocking. After the vulnerability and license
+policy is approved, set ``OSS_REPORT_STRICT=true`` in CI to also fail when Trivy
+or REUSE returns a nonzero status. Severity and license thresholds still require
+stakeholder approval; until then, a successful report job means complete
+dependency accounting and generated evidence, not final compliance approval.
+
+Local use
+---------
+
+Run the report locally from the repository root:
+
+.. code-block:: bash
+
+   ./scripts/run_oss_license_vulnerability_report.sh .
+
+Local execution requires ``uv``, npm, CMake, Trivy, a bootstrapped vcpkg checkout
+in ``VCPKG_ROOT``, and the same system dependencies used by the maximum CMake
+profile. REUSE remains advisory unless strict policy mode is enabled.