The licence notices are made when the app is packaged, not kept in the repository

.github/workflows/ci.yml

@@ -28,7 +28,6 @@ jobs:
       - run: pnpm typecheck
       - run: pnpm lint
       - run: pnpm format:check
-      - run: pnpm notices:check
 
   test:
     name: Unit tests (${{ matrix.name }})

.github/workflows/release.yml

@@ -13,6 +13,7 @@ on:
       - "apps/desktop/scripts/**"
       - "apps/desktop/e2e-packaged/**"
       - "scripts/fetch-tectonic.mjs"
+      - "scripts/notices.mjs"
       - ".github/workflows/release.yml"
   # Run by hand from a branch to try the same without a pull request.
   workflow_dispatch:

.gitignore

@@ -4,6 +4,8 @@ dist/
 out/
 build/
 coverage/
+# made when the app is packaged (scripts/notices.mjs)
+/THIRD_PARTY_NOTICES.md
 *.tsbuildinfo
 
 # OS / editor

README.md

@@ -278,6 +278,7 @@ described in [`SECURITY.md`](SECURITY.md). Changes are listed in [`CHANGELOG.md`
 
 ## Licence
 
-[MIT](LICENSE). Lucid is built on open-source software; see [`THIRD_PARTY_NOTICES.md`](THIRD_PARTY_NOTICES.md). Special thanks
+[MIT](LICENSE). Lucid is built on open-source software; the list of what it bundles and their licences comes with the app
+(Help, Licences of the Software Lucid Uses). Special thanks
 to [BlockNote](https://www.blocknotejs.org), [Mermaid](https://mermaid.js.org), [Tectonic](https://tectonic-typesetting.github.io),
 [Electron](https://www.electronjs.org) and [iA Writer Mono](https://github.com/iaolo/iA-Fonts).

apps/desktop/package.json

@@ -11,7 +11,7 @@
     "preview": "electron-vite preview",
     "e2e": "electron-vite build && playwright test",
     "e2e:real": "electron-vite build && playwright test -c playwright.real.config.ts",
-    "prepack": "node ../../scripts/fetch-tectonic.mjs && node node_modules/electron/install.js && pnpm --filter @lucid/mcp bundle && electron-vite build",
+    "prepack": "node ../../scripts/notices.mjs && node ../../scripts/fetch-tectonic.mjs && node node_modules/electron/install.js && pnpm --filter @lucid/mcp bundle && electron-vite build",
     "dist": "pnpm prepack && electron-builder --publish never",
     "e2e:packaged": "playwright test -c playwright.packaged.config.ts",
     "dist:dir": "pnpm prepack && electron-builder --dir"

package.json

@@ -23,7 +23,6 @@
     "ci": "pnpm typecheck && pnpm lint && pnpm format:check && pnpm test",
     "mcp:build": "pnpm --filter @lucid/mcp bundle",
     "notices": "node scripts/notices.mjs",
-    "notices:check": "node scripts/notices.mjs --check",
     "eval": "node packages/evals/scripts/eval.mjs",
     "dist": "pnpm --filter @lucid/desktop dist",
     "e2e:packaged": "pnpm --filter @lucid/desktop e2e:packaged",

scripts/notices.mjs

@@ -1,19 +1,24 @@
 import { execFileSync } from "node:child_process";
-import { readFileSync, writeFileSync } from "node:fs";
+import { writeFileSync } from "node:fs";
 import { fileURLToPath } from "node:url";
 
 /**
  * Writes THIRD_PARTY_NOTICES.md from the production dependencies pnpm installed: `node scripts/notices.mjs`.
- * `--check` fails when the file is out of date (run it after changing dependencies).
+ * The file comes with the packaged app (Help, Third-party notices), because the licenses of what is bundled ask for it; it is
+ * made when the app is packaged (`prepack`) and is not kept in the repository.
  */
-const OUT = fileURLToPath(new URL("../THIRD_PARTY_NOTICES.md", import.meta.url));
+const ROOT = fileURLToPath(new URL("..", import.meta.url));
+const OUT = `${ROOT}THIRD_PARTY_NOTICES.md`;
 
 // A license pnpm cannot read from a package, checked by hand against the package's own repository.
 const KNOWN = { khroma: "MIT" };
 
 const raw = execFileSync("pnpm", ["licenses", "list", "--prod", "--json"], {
   encoding: "utf8",
   maxBuffer: 50_000_000,
+  cwd: ROOT,
+  // On Windows pnpm is a .cmd file, which only a shell can start.
+  shell: process.platform === "win32",
 });
 const byLicense = JSON.parse(raw);
 
@@ -58,20 +63,5 @@ for (const [lic, list] of groups) {
 }
 const text = `${lines.join("\n")}\n`;
 
-if (process.argv.includes("--check")) {
-  const current = (() => {
-    try {
-      return readFileSync(OUT, "utf8");
-    } catch {
-      return "";
-    }
-  })();
-  if (current !== text) {
-    console.error("THIRD_PARTY_NOTICES.md is out of date. Run: node scripts/notices.mjs");
-    process.exit(1);
-  }
-  console.log("THIRD_PARTY_NOTICES.md is up to date.");
-} else {
-  writeFileSync(OUT, text);
-  console.log(`wrote ${OUT} (${String(rows.length)} packages)`);
-}
+writeFileSync(OUT, text);
+console.log(`wrote ${OUT} (${String(rows.length)} packages)`);

site/index.html

@@ -1014,9 +1014,7 @@ <h2>Good to know.</h2>
             <a href="https://github.com/triggeredcode/lucid/blob/main/SECURITY.md">Security</a>
           </li>
           <li>
-            <a href="https://github.com/triggeredcode/lucid/blob/main/THIRD_PARTY_NOTICES.md"
-              >Licences</a
-            >
+            <a href="https://github.com/triggeredcode/lucid/blob/main/LICENSE">Licences</a>
           </li>
         </ul>
       </div>