# How Fabrica-Util's License Compliance Policy Shapes Game Server Dependency Management > Learn how Fabrica-Util's license compliance policy enforces dependency management for game servers by automatically blocking non-compliant Go modules in CI. - Repository: [Pantheon/fabrica-util](https://github.com/go-pantheon/fabrica-util) - Tags: how-to-guide - Published: 2026-03-02 --- **Fabrica-Util enforces a strict license-whitelisting policy through automated scripts that block non-compliant dependencies in CI, requiring game server projects to vet every Go module against an approved list including MIT, Apache-2.0, and BSD variants.** Fabrica-Util, the open-source Go utility library maintained at `go-pantheon/fabrica-util`, integrates a rigorous **license compliance policy** directly into its build pipeline. For game server projects that import this library, the policy functions as an automated gatekeeper, determining which third-party modules can be safely integrated without triggering legal or build failures. ## The Hard-Coded License Whitelist At the core of the compliance system lies a hard-coded whitelist defined in the `./.hack/licenses-check` script. According to the source documentation in [`.hack/LICENSE-CHECK.md`](https://github.com/go-pantheon/fabrica-util/blob/main/.hack/LICENSE-CHECK.md), the checker currently permits the following **OSI-approved licenses**: - MIT - Apache-2.0 - BSD-2-Clause - BSD-3-Clause - ISC - MPL-2.0 Any dependency—direct or transitive—that carries a license outside this list (such as GPL-3.0) causes the build to fail immediately. This constraint forces game server developers to evaluate license compatibility before adding new imports, effectively shifting legal review left into the dependency selection phase. ## Automated Enforcement Pipeline The policy operates as a **dual-layer defense** combining local development hooks and continuous integration. **Local Pre-Commit Hooks:** Developers install a pre-commit hook via `pre-commit install` that executes `./.hack/licenses-check` before any commit is recorded. This provides immediate feedback if a new import introduces a non-compliant license. **GitHub Actions Integration:** The workflow defined in [`.github/workflows/test.yml`](https://github.com/go-pantheon/fabrica-util/blob/main/.github/workflows/test.yml) invokes the license checker on every push and pull request. When the script detects a violation, it exits with a non-zero status, blocking the PR from merging into the main branch. ```bash # Install the hook for local validation pre-commit install # Manual invocation for proactive checking ./.hack/licenses-check ``` If a disallowed license is found, the output clearly identifies the offending module: ```text ❌ Disallowed license found: github.com/example/bad-lib v1.2.3 GPL-3.0 Run ./.hack/licenses-generate to see the full report. ``` ## Managing Violations and Exception Handling When the checker flags a dependency, the policy outlines three deterministic remediation paths documented in [`.hack/LICENSE-CHECK.md`](https://github.com/go-pantheon/fabrica-util/blob/main/.hack/LICENSE-CHECK.md): **replace the library** with a compliant alternative, **request a formal exception**, or **update the whitelist** after a risk review. For edge cases where packages cannot be scanned—such as low-level libraries containing assembly code—the project maintains an exclusion list in [`.hack/license-exceptions.txt`](https://github.com/go-pantheon/fabrica-util/blob/main/.hack/license-exceptions.txt). This file pre-populates the project's own module (`github.com/go-pantheon/fabrica-util`) and other special-case packages that evade standard detection. ```text # Example entry in .hack/license-exceptions.txt github.com/some/asm-package ``` Adding entries to this file requires proper justification, ensuring exceptions remain rare and documented. ## Audit Reporting for Game Server Releases Compliance verification extends beyond build blocking to **immutable documentation**. The `./.hack/licenses-generate` script produces two key artifacts: - [`DEPENDENCIES.md`](https://github.com/go-pantheon/fabrica-util/blob/main/DEPENDENCIES.md): A markdown report listing every module and its detected license - `license-dependencies.csv`: A machine-readable spreadsheet for legal tooling These reports can be bundled with release notes to satisfy audit requirements common in game server distribution platforms. Running the generator is straightforward: ```bash ./.hack/licenses-generate head -n 20 DEPENDENCIES.md ``` ## Workflow Impact on Game Server Development The **fabrica-util license compliance policy** fundamentally alters how engineering teams manage their `go.mod` files through four operational constraints: 1. **Proactive Vetting:** Developers must run `./.hack/licenses-check` locally before committing new imports, preventing surprise CI failures. 2. **Continuous Transitive Checking:** Every change to `go.mod` automatically validates the entire dependency tree, ensuring that updates to existing libraries do not silently pull in non-compliant sub-dependencies. 3. **Deterministic Remediation:** Violations trigger a standardized workflow—replace, except, or whitelist—eliminating ambiguity about how to resolve legal conflicts. 4. **Immutable Audit Trails:** Generated reports provide a version-controlled record of all dependencies at build time, essential for post-release legal reviews or platform compliance submissions. ## Summary - Fabrica-Util maintains a strict whitelist of six permissive licenses (MIT, Apache-2.0, BSD variants, ISC, MPL-2.0) in `./.hack/licenses-check`. - Automated enforcement occurs via pre-commit hooks and GitHub Actions in [`.github/workflows/test.yml`](https://github.com/go-pantheon/fabrica-util/blob/main/.github/workflows/test.yml), blocking non-compliant code from entering the main branch. - Violations exit with non-zero status and can be remediated through replacement, formal exception requests, or whitelist updates. - The `./.hack/licenses-generate` command produces [`DEPENDENCIES.md`](https://github.com/go-pantheon/fabrica-util/blob/main/DEPENDENCIES.md) and CSV files for legal audit trails. - Game server projects must vet all Go modules proactively, as the policy treats license compliance as an integrated build gate rather than a post-hoc legal review. ## Frequently Asked Questions ### What specific licenses does fabrica-util permit? The whitelist explicitly allows MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, and MPL-2.0 licenses as defined in the `./.hack/licenses-check` script. Any dependency carrying a different license—including GPL variants—will trigger a build failure unless added to [`.hack/license-exceptions.txt`](https://github.com/go-pantheon/fabrica-util/blob/main/.hack/license-exceptions.txt) with proper justification. ### How do I run the license check before committing code? Install the pre-commit hook once using `pre-commit install`, which automatically executes `./.hack/licenses-check` before recording commits. Alternatively, run the script manually in your terminal to validate changes before pushing to GitHub. ### What happens if a transitive dependency violates the policy? The checker scans the entire dependency tree including transitive modules. If a library you import pulls in a non-whitelisted sub-dependency, the CI job fails and blocks your PR. You must either upgrade the parent dependency to a version with compliant sub-dependencies, replace the library entirely, or petition to add the specific transitive dependency to [`.hack/license-exceptions.txt`](https://github.com/go-pantheon/fabrica-util/blob/main/.hack/license-exceptions.txt). ### Can I bypass the license check for specific packages? Yes, by adding the package path to [`.hack/license-exceptions.txt`](https://github.com/go-pantheon/fabrica-util/blob/main/.hack/license-exceptions.txt). However, this is reserved for special cases such as packages containing assembly code that cannot be scanned. The project module itself is pre-listed. Any addition requires documented justification to maintain the integrity of the compliance envelope.