Metadata-Version: 2.4
Name: foretop-lading
Version: 0.4.0
Summary: Traces licence obligations across code dependencies and model weights as one dependency graph — resolves each artifact's licence via Hugging Face / PyPI and prints a flat, honest table (unknown rather than guessed).
License-Expression: Apache-2.0
License-File: LICENSE
Requires-Dist: typer>=0.15
Requires-Dist: rich>=13.9
Requires-Dist: httpx>=0.28
Requires-Dist: pydantic>=2.9
Requires-Dist: pyyaml>=6.0
Requires-Dist: pathspec>=0.12
Requires-Dist: huggingface-hub>=1.28
Requires-Python: >=3.12
Description-Content-Type: text/markdown

# lading

> Trace licence obligations across Python dependencies and AI assets before they ship.

`lading` discovers packages, Hugging Face models and datasets, and vendored PEFT adapters,
resolves their licences, and turns them into reviewable obligations and policy decisions.
Its output is engineering evidence to review with counsel, not legal advice.

## Install and run

```console
uvx foretop-lading scan .
```

Without a policy, the command reports what it finds and exits successfully. Add a built-in
policy only when you want the scan to gate CI:

```console
uvx foretop-lading scan . --policy permissive-only
```

Run `uvx foretop-lading scan --help` for every option.

## What it checks

- Python dependencies declared in `uv.lock`.
- Hugging Face model and dataset identifiers referenced in Python source.
- Vendored PEFT adapter configuration and base-model relationships.
- Optional artifacts from the local Hugging Face cache or an existing CycloneDX 1.6 JSON SBOM.
- Attribution, redistribution, acceptable-use, field-of-use, and share-alike obligations.

When discovery supplies a package version or Hugging Face revision, Lading resolves metadata
for that exact release rather than the registry's latest state. Unresolved licences remain
`unknown`; they are never treated as permissive.

## Output and CI gating

`--format` supports `table`, `json`, `mermaid`, `markdown`, `sarif`, `annotations`, and
`triage-json`. `--policy` accepts `permissive-only`, `no-copyleft`,
`no-field-of-use-restrictions`, or a YAML policy path. Exit code `1` means an explicit policy
failed, while `2` means the scan itself failed. Warnings alone never fail the command.

## GitHub Action

```yaml
- uses: foretop-dev/lading@v0.4.0
  with:
    policy: permissive-only
```

The Action uses `permissive-only` by default, emits inline annotations, and can maintain one
summary comment on pull requests. Grant `pull-requests: write` when comments are enabled. Set
`policy` to an empty string for report-only use.

## Privacy

Repository discovery is local. Licence resolution sends package or asset identifiers—not
source contents—to the public PyPI and Hugging Face APIs. The machine-wide Hugging Face cache
is read only when `--scan-hf-cache` is passed. `--report` and `--gate` are explicit hosted-mode
options and never send document or source bodies.

## Current limitations

- Native dependency discovery currently reads `uv.lock`; other ecosystems require an imported
  CycloneDX SBOM.
- Namespace-less Hugging Face model identifiers may not be distinguishable from ordinary strings.
- Licence metadata can be absent or inconsistent, so unresolved evidence remains `unknown`.

## License

Apache-2.0. See [LICENSE](LICENSE).

Questions and bug reports are welcome in
[GitHub Issues](https://github.com/foretop-dev/lading/issues).
