chore(notices): automate NOTICE.md generation + CI drift gate

[danielmeppiel]

Closes #1044.

Summary

Make NOTICE.md self-maintaining. After PR #1043 landed the file by hand, every future dep change would otherwise require a contributor to remember to update it. This PR makes the file generated and gates every PR on a drift check, with an additional license-policy gate as supply-chain hygiene.

What changes

File	Why
scripts/generate-notice.py	Renders NOTICE.md from pyproject.toml deps + curated per-component metadata, reading verbatim license text from the installed .dist-info/licenses/ dir of the uv-managed env. --check mode for CI.
scripts/notice-metadata.yaml	Per-component overrides authored once per dep: SPDX choice, upstream URL, copyright snippet, optional NOTICE/AUTHORS attribution block. The few things PyPI metadata can't reliably give us.
.github/workflows/notice-drift.yml	New required check. pull_request + merge_group triggers (matches ci.yml pattern). uv sync --frozen for reproducibility. actions/dependency-review-action@v4 on PR-time only as a license-policy gate.
.github/workflows/merge-gate.yml	Adds NOTICE Drift Check to EXPECTED_CHECKS in both event branches so the unified gate waits for it.
Makefile	make notice for local regeneration before pushing.
pyproject.toml	(no new deps — ruamel.yaml is already a runtime dep, reused for the metadata YAML)

Why no SBOM in this PR

GitHub's dependency graph already exposes an SPDX SBOM for this repo on demand (GET /repos/{owner}/{repo}/dependency-graph/sbom), and Dependabot owns vulnerability + version updates over the same graph. Adding a second generator here would duplicate that surface without adding value. If a CycloneDX-format SBOM becomes required for compliance reporting, add a separate workflow keyed off release events.

Lenses applied

GitHub Actions specialization — minimum permissions (contents: read), uv sync --frozen (no silent lockfile mutation in CI), @major action pinning matching repo style, dual pull_request + merge_group trigger so the merge queue temp-branch gets the check (post-mortem on PR #899 in merge-gate.yml is the template), wired into merge-gate.yml EXPECTED_CHECKS so it's a real required check rather than an advisory one.

Supply chain & licensing — the generator reads license text from the actual installed .dist-info, so an upstream re-license caught by Dependabot triggers our drift check on the same PR (no separate manual review). dependency-review-action denies the strong-copyleft families (GPL / AGPL / SSPL) that would virally relicense the apm-cli binary; explicitly allows permissive + MPL-2.0 (file-level copyleft, no viral effect on combined work). Frozen syncs prevent CI from silently pulling a new LICENSE.

Proof of working

1. Byte-parity with the manually-authored NOTICE.md

The generator was developed against a captured copy (NOTICE.md.golden) of the file PR #1043 landed. Iterated until diff -u NOTICE.md NOTICE.md.golden produced empty output, then deleted the golden. This commit's NOTICE.md is unchanged from the file that landed in PR #1043.

$ git diff --stat 41af4d7c..HEAD -- NOTICE.md
(empty -- not modified)

2. --check mode behavior

$ uv run python scripts/generate-notice.py --check
$ echo $?
0

$ echo 'garbage_line' >> NOTICE.md
$ uv run python scripts/generate-notice.py --check
NOTICE.md is out of date with pyproject.toml + notice-metadata.yaml.
Run `make notice` (or `python scripts/generate-notice.py`) and commit.

--- NOTICE.md (on disk)
+++ NOTICE.md (regenerated)
@@ -1215,4 +1215,3 @@

 ---

-garbage_line
$ echo $?
1

$ git checkout NOTICE.md
$ uv run python scripts/generate-notice.py --check
$ echo $?
0

3. actionlint clean

$ actionlint .github/workflows/notice-drift.yml .github/workflows/merge-gate.yml
(no output -- both pass)

4. Drift simulation -- adding a dep

If a contributor adds a new dep without regenerating NOTICE, the gate fails the PR with the exact diff in the Actions log, plus a fix command in the error message (make notice and commit). The make notice target makes the local fix one command.

Out of scope (deferred)

• Transitive-dep NOTICE expansion (current direct-only scope is industry-standard; expand only if CELA mandates).
• Publishing CycloneDX/SPDX SBOM as a release artifact on build-release.yml — separate, release-event-keyed workflow if/when needed.
• Vulnerability scanning over the SBOM — already covered by Dependabot.

---

Co-authored-by: Copilot 223556219+Copilot@users.noreply.github.com

[Copilot]

Pull request overview

This PR introduces an automated pipeline for keeping NOTICE.md (third-party attributions) in sync with the repo’s direct runtime dependencies, and adds CI gating (plus SBOM emission) so drift is caught on every PR and merge-queue entry.

Changes:

• Add a NOTICE generator script driven by pyproject.toml deps + curated scripts/notice-metadata.yaml, with --check mode and CycloneDX SBOM emission.
• Add a new required CI workflow (NOTICE Drift Check) and wire it into merge-gate.yml aggregation.
• Add local developer shortcuts via make notice / make notice-check.

Show a summary per file

File	Description
scripts/notice-metadata.yaml	Adds curated metadata/overrides per dependency to render deterministic NOTICE sections.
scripts/generate-notice.py	Implements NOTICE rendering, license text extraction from dist-info, and SBOM emission.
Makefile	Adds DX targets to run the generator locally.
.github/workflows/notice-drift.yml	Adds PR + merge-queue gate to enforce NOTICE drift checks and license policy checks, plus SBOM artifact.
.github/workflows/merge-gate.yml	Adds NOTICE Drift Check to the set of checks aggregated by the PR-time gate.

Copilot's findings

Comments suppressed due to low confidence (1)

scripts/generate-notice.py:63

• tempfile is imported but not used (the code renders to memory). Please drop the unused import (and any related code/comments) to keep the script tidy.

import difflib
import importlib.metadata as ilmd
import re

• Files reviewed: 5/5 changed files
• Comments generated: 4

[Copilot]

In the PackageNotFoundError path, version = dep.raw_specifier.lstrip(...) can produce values like "1.2.0; python_version<'3.11'" (tomli under Python 3.12 in CI), which includes spaces/markers and is not a real version. This can yield an invalid/misleading PURL and potentially break SBOM consumers. Consider omitting the version (pass None), or properly parse the requirement (split on ; and extract a concrete specifier) when the dist isn't installed.

[Copilot]

The dependency-review-action config appears to specify both a deny-list and an allow-list of licenses (allow-licenses is present later in this same with: block). The action errors if both are set, so the workflow will fail at runtime; keep only one of these inputs.

[Copilot]

_is_license_file() splits paths using only '/' (rel_path.rsplit("/", 1)), but importlib.metadata file paths can contain backslashes on Windows. That will cause license discovery to fail on Windows even when the license file exists. Normalize separators (e.g., replace \\ with / before splitting) or use PurePosixPath/PurePath for robust filename extraction.

Suggested change

	fname = rel_path.rsplit("/", 1)[-1]
	"""Return True when ``rel_path`` points to a plausible license file.
	``importlib.metadata`` file paths may contain either forward slashes or
	backslashes depending on platform and representation. Normalize to ``/``
	before extracting the filename so license discovery works consistently on
	Windows and POSIX.
	"""
	normalized_path = rel_path.replace("\\", "/")
	fname = normalized_path.rsplit("/", 1)[-1]

[Copilot]

The docstring says --check regenerates to a tempfile, but the implementation compares an in-memory rendered string against NOTICE.md on disk. Please update the docstring to match reality (or actually use a tempfile) so future maintainers don't chase a non-existent behavior.

This issue also appears on line 61 of the same file.