Tags: codelake-dev/licscan

fix: LSP Windows URI test, companion manifest diagnostics, inlay hint…

… disk fallback

feat: add built-in LSP server for editor integration

`licscan lsp` starts a JSON-RPC 2.0 Language Server on stdin/stdout.
Watches manifest files, scans on open/save, publishes diagnostics with
severity mapped from policy verdicts, and serves inlay hints showing
license badges inline. Zero external deps — pure Go implementation.
Works with VS Code, JetBrains, Neovim, and any LSP-compatible editor.

feat: add `licscan update` self-updater from R2 CDN

Checks GitHub API for latest release, downloads the binary for the
current OS/arch from the R2 CDN, and replaces the current executable
in-place. Supports --check for dry-run. Detects dev builds and
symlinks (Homebrew) gracefully.

docs: update CHANGELOG for v0.14.0

docs: update CHANGELOG for v0.13.0

feat: add SARIF 2.1.0 output format for GitHub Code Scanning

New `--format sarif` produces a SARIF 2.1.0 log that integrates with
GitHub Advanced Security via actions/upload-sarif. Only warn and deny
findings appear as results — permissive deps are omitted to keep the
Security tab focused on actionable items. Rules are deduped by
license+severity, each result links to the source manifest file.

Includes 8 tests, example output, and updated docs.

v0.11.1 — fix: per-field default-policy inherit

A .licscan.yml that only sets manufacturer/product (typical for CRA
evidence) now inherits the built-in deny/warn lists per-field instead
of being treated as 'allow everything'. Closes #8.

v0.11.0 — Markdown formatter

Phase 10 — closes the MVP output gap. licscan is now feature-complete:

  7 detectors  (Go / npm / composer / cargo / gem / pip / maven)
  6 formats    (table, json, html, cyclonedx, spdx, markdown)
  Policy engine + .licscan.yml (deny / warn / allow_exceptions)
  EU CRA Compliance Mode (PDF + JSON, manufacturer + product metadata)
  CI mode with stderr-itemised policy-violations + non-zero exit

--format markdown is PR-comment-ready: summary table, dep table with
risk emojis, auto-collapse via <details> at >30 deps, policy-aware
Verdict column, footer attribution. Safe to paste into GitHub /
Slack / READMEs.

Plus: Makefile version-string bugfix (vv0.10.0 → v0.10.0).

v0.10.0 — EU CRA Compliance Mode

Phase 8 — the headline USP differentiator. No existing OSS license
scanner emits EU CRA Article 13 evidence out-of-the-box.

New:
  --cra flag writes cra-sbom.cdx.json (CycloneDX 1.5 with CRA
  extensions) + cra-evidence.pdf (regulator-friendly summary with
  codelake-branded cover) into --output (default ./licscan-cra-evidence/).
  Manufacturer + product metadata configurable via .licscan.yml.

  Native Go PDF generation (no headless-browser dependency) via
  go-pdf/fpdf. UTF-8 strings translated to cp1252 so em-dashes and
  section signs render correctly.

Plus: 7 package managers (Go/npm/composer/cargo/gem/pip/maven),
5 output formats (table/json/html/cyclonedx/spdx), policy engine
with .licscan.yml deny/warn/allow_exceptions + CI mode.

build(release): switch to mcpscanner-cli release pattern (raw binarie…

…s + R2 + tap)

Replaces goreleaser with a hand-rolled 4-job workflow that matches the
mcpscanner-cli sibling repo's pattern — same build matrix, same artefact
naming, same R2 layout, same homebrew tap mechanics. Both tools now
release identically so the codelake-dev family is consistent.

Removed:
  - .goreleaser.yml — replaced by inline matrix build in release.yml
  - Makefile release-dry-run target (no goreleaser to invoke)

Added:
  - install.sh at repo root — POSIX-shell installer that auto-detects
    OS+arch and downloads from R2 (default base URL https://install.licscan.dev,
    overridable via LICSCAN_BASE_URL env). Mirrors mcpscanner-cli's shape
    (BINARY_NAME / VERSION / INSTALL_DIR env knobs).

Rewritten .github/workflows/release.yml — 4 jobs on tag-push:

  1. build (matrix 5x: linux-amd64, linux-arm64, darwin-amd64,
     darwin-arm64, windows-amd64). Raw Go binaries, no tar.gz.
     ldflags inject Version/Commit/BuildDate into internal/version.

  2. release — generates checksums.txt, creates GitHub Release via
     softprops/action-gh-release with install instructions
     (curl one-liner + brew + per-arch curl + Windows note).

  3. upload-r2 — uploads to Cloudflare R2 layout:
       <bucket>/licscan/<tag>/licscan-<os>-<arch>[.exe]
       <bucket>/licscan/<tag>/checksums.txt
       <bucket>/licscan/latest/...      (mirror of latest tag)
       <bucket>/licscan/version.json    (manifest with pinned + latest URLs)
       <bucket>/licscan/install.sh      (sed-substituted with R2_PUBLIC_URL)
     Uses aws-cli with --endpoint-url pointing at R2; R2 speaks S3.

  4. update-homebrew — checks out codelake-dev/homebrew-tap, writes a
     handwritten Formula/licscan.rb (single class, on_macos + on_linux
     branches, per-arch url+sha256, test asserts --version output),
     commits + pushes via HOMEBREW_TAP_TOKEN secret.

Secrets required (all confirmed present):
  R2_ACCOUNT_ID, R2_ACCESS_KEY_ID, R2_SECRET_ACCESS_KEY, R2_BUCKET,
  R2_PUBLIC_URL, HOMEBREW_TAP_TOKEN

README: installation section rewritten to lead with the curl one-liner
+ Homebrew, removed the scoop block (no scoop bucket configured yet),
updated manual-download URLs to the raw-binary release-asset names.