How Fabrica-Util's License Compliance Policy Shapes Game Server Dependency Management

Fabrica-Util enforces a strict license-whitelisting policy through automated scripts that block non-compliant dependencies in CI, requiring game server projects to vet every Go module against an approved list including MIT, Apache-2.0, and BSD variants.

Fabrica-Util, the open-source Go utility library maintained at go-pantheon/fabrica-util, integrates a rigorous license compliance policy directly into its build pipeline. For game server projects that import this library, the policy functions as an automated gatekeeper, determining which third-party modules can be safely integrated without triggering legal or build failures.

The Hard-Coded License Whitelist

At the core of the compliance system lies a hard-coded whitelist defined in the ./.hack/licenses-check script. According to the source documentation in .hack/LICENSE-CHECK.md, the checker currently permits the following OSI-approved licenses:

• MIT
• Apache-2.0
• BSD-2-Clause
• BSD-3-Clause
• ISC
• MPL-2.0

Any dependency—direct or transitive—that carries a license outside this list (such as GPL-3.0) causes the build to fail immediately. This constraint forces game server developers to evaluate license compatibility before adding new imports, effectively shifting legal review left into the dependency selection phase.

Automated Enforcement Pipeline

The policy operates as a dual-layer defense combining local development hooks and continuous integration.

Local Pre-Commit Hooks: Developers install a pre-commit hook via pre-commit install that executes ./.hack/licenses-check before any commit is recorded. This provides immediate feedback if a new import introduces a non-compliant license.

GitHub Actions Integration: The workflow defined in .github/workflows/test.yml invokes the license checker on every push and pull request. When the script detects a violation, it exits with a non-zero status, blocking the PR from merging into the main branch.

# Install the hook for local validation

pre-commit install

# Manual invocation for proactive checking

./.hack/licenses-check

If a disallowed license is found, the output clearly identifies the offending module:

❌ Disallowed license found:
  github.com/example/bad-lib v1.2.3  GPL-3.0
Run ./.hack/licenses-generate to see the full report.

Managing Violations and Exception Handling

When the checker flags a dependency, the policy outlines three deterministic remediation paths documented in .hack/LICENSE-CHECK.md: replace the library with a compliant alternative, request a formal exception, or update the whitelist after a risk review.

For edge cases where packages cannot be scanned—such as low-level libraries containing assembly code—the project maintains an exclusion list in .hack/license-exceptions.txt. This file pre-populates the project's own module (github.com/go-pantheon/fabrica-util) and other special-case packages that evade standard detection.

# Example entry in .hack/license-exceptions.txt

github.com/some/asm-package

Adding entries to this file requires proper justification, ensuring exceptions remain rare and documented.

Audit Reporting for Game Server Releases

Compliance verification extends beyond build blocking to immutable documentation. The ./.hack/licenses-generate script produces two key artifacts:

• DEPENDENCIES.md: A markdown report listing every module and its detected license
• license-dependencies.csv: A machine-readable spreadsheet for legal tooling

These reports can be bundled with release notes to satisfy audit requirements common in game server distribution platforms. Running the generator is straightforward:

./.hack/licenses-generate
head -n 20 DEPENDENCIES.md

Workflow Impact on Game Server Development

The fabrica-util license compliance policy fundamentally alters how engineering teams manage their go.mod files through four operational constraints:

1. Proactive Vetting: Developers must run ./.hack/licenses-check locally before committing new imports, preventing surprise CI failures.
2. Continuous Transitive Checking: Every change to go.mod automatically validates the entire dependency tree, ensuring that updates to existing libraries do not silently pull in non-compliant sub-dependencies.
3. Deterministic Remediation: Violations trigger a standardized workflow—replace, except, or whitelist—eliminating ambiguity about how to resolve legal conflicts.
4. Immutable Audit Trails: Generated reports provide a version-controlled record of all dependencies at build time, essential for post-release legal reviews or platform compliance submissions.

Summary

• Fabrica-Util maintains a strict whitelist of six permissive licenses (MIT, Apache-2.0, BSD variants, ISC, MPL-2.0) in ./.hack/licenses-check.
• Automated enforcement occurs via pre-commit hooks and GitHub Actions in .github/workflows/test.yml, blocking non-compliant code from entering the main branch.
• Violations exit with non-zero status and can be remediated through replacement, formal exception requests, or whitelist updates.
• The ./.hack/licenses-generate command produces DEPENDENCIES.md and CSV files for legal audit trails.
• Game server projects must vet all Go modules proactively, as the policy treats license compliance as an integrated build gate rather than a post-hoc legal review.

Frequently Asked Questions

What specific licenses does fabrica-util permit?

The whitelist explicitly allows MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, and MPL-2.0 licenses as defined in the ./.hack/licenses-check script. Any dependency carrying a different license—including GPL variants—will trigger a build failure unless added to .hack/license-exceptions.txt with proper justification.

How do I run the license check before committing code?

Install the pre-commit hook once using pre-commit install, which automatically executes ./.hack/licenses-check before recording commits. Alternatively, run the script manually in your terminal to validate changes before pushing to GitHub.

What happens if a transitive dependency violates the policy?

The checker scans the entire dependency tree including transitive modules. If a library you import pulls in a non-whitelisted sub-dependency, the CI job fails and blocks your PR. You must either upgrade the parent dependency to a version with compliant sub-dependencies, replace the library entirely, or petition to add the specific transitive dependency to .hack/license-exceptions.txt.

Can I bypass the license check for specific packages?

Yes, by adding the package path to .hack/license-exceptions.txt. However, this is reserved for special cases such as packages containing assembly code that cannot be scanned. The project module itself is pre-listed. Any addition requires documented justification to maintain the integrity of the compliance envelope.

{
  "mcpServers": {
    "instagit": {
      "command": "npx",
      "args": ["-y", "instagit@latest"]
    }
  }
}