包许可证合规治理（GPL-AGPL-Apache-MIT）最佳实践

核心要点统一解析 SPDX 标识；建立允许与禁止清单并支持例外到期。构建门禁：禁止项直接阻断；允许项通过；未知项进入人工审批。实现示例const allowLicenses = new Set<string>(['MIT','Apache-2.0','BSD-3-Clause','ISC'])

const denyLicenses = new Set<string>(['GPL-3.0','AGPL-3.0','LGPL-3.0'])

function normalize(spdx: string): string {

return spdx.trim()

}

type LicenseEntry = { name: string; version: string; license: string }

function evaluateLicense(e: LicenseEntry, exceptions: Map<string, number>, now: number): 'allow' | 'deny' | 'review' {

const id = normalize(e.license)

const key = `${e.name}@${e.version}`

const until = exceptions.get(key) || 0

if (denyLicenses.has(id) && until < now) return 'deny'

if (allowLicenses.has(id)) return 'allow'

return until >= now ? 'allow' : 'review'

}

审计与CI门禁审计报告包含名称、版本、许可证、判定、审批人与到期时间。未审批或被禁止的依赖阻断构建；产线仅接受允许与在例外期内的依赖。