Add OSS license and vulnerability report workflow

[arussell-nvidia]

Summary

• add a report-only OSS license and vulnerability workflow
• inventory Python, npm, CMake, vcpkg, Docker, and GitHub Actions dependency references
• publish Trivy JSON/SARIF, REUSE output, inventory data, and a Markdown summary as a CI artifact
• distinguish repository references from concrete package versions resolved by the vulnerability scanner
• preserve summary and artifact publication when a reporting step returns a nonzero status

CI evidence

OSS report workflow run 29670261099 completed successfully and published the isaacteleop-oss-license-vulnerability-report artifact.

The current report records:

• 203 dependency references and 0 parse errors
• 5 concrete packages resolved by Trivy across 1 manifest target
• no vulnerability findings among those 5 resolved packages
• REUSE metadata on 877/934 files for license information and 878/934 files for copyright information
• REUSE compliance remains failing, with details retained in the artifact

Policy scope

This workflow is report-only by default. A successful job means evidence was generated; it does not certify that every inventoried reference was vulnerability-scanned or that the repository satisfies a final license policy. Strict thresholds remain a follow-up policy decision.

Local validation

• collector Python compilation
• collector run against a sparse checkout
• Bash syntax check and report generation without optional tools
• strict-mode exit behavior
• Git whitespace checks

[coderabbitai]

Important

Review skipped

Draft detected.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 09b600c7-597f-455e-971c-fbb1a9db4b54

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

• 🔍 Trigger review

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch codex/cxr-3577-oss-report-prototype

---

_{Comment @coderabbitai help to get the list of available commands.}