Python service: SBOM and license gate

License problems are cheaper to fix before a release than after a customer's audit. This template has the agents find and replace copyleft dependencies, then gives your CI a hard check against the project's SBOM.

Which agents run

1. Audit, by the Dependency Auditor: reads pyproject.toml and the README and lists packages with license conflicts, known vulnerabilities (from the model's knowledge, not a live database) or no maintenance, each with an upgrade path.
2. Upgrade, by the Migration Specialist: the replacement or removal plan, with rollback notes.
3. Test, by the Tester: how to prove nothing broke.
4. Verify secure, by the Security Auditor: checks the result.

The agent reads direct dependencies only. Lockfiles such as poetry.lock aren't included, so transitive licenses are mostly invisible to it; that is what the SBOM check covers.

The change then gets your test suite in an offline sandbox, a findings review with the audit as context (dependency findings show on the run page), and a human approval.

Record the SBOM

AI CodeOps doesn't generate SBOMs. Produce a CycloneDX or SPDX file with your build tooling, then record it against the project from a signed-in session through /api/sbom; there is no upload form or API-key recording in the open beta. The license roll-up under Secure → Security shows the exact license strings it found. Record a fresh SBOM after the dependency change merges, because the gate reads the project's latest one.

Gate releases on licenses

curl -sf -X POST "https://console.aicodeops.dev/api/release/check" \
  -H "Authorization: Bearer $WORKSPACE_API_KEY" \
  -H "Content-Type: application/json" \
  -d "{\"pullRequestURL\":\"$PR_URL\",\"disallowedLicenses\":[\"GPL-3.0-only\",\"GPL-3.0-or-later\",\"AGPL-3.0-only\",\"AGPL-3.0-or-later\"]}" \
  | jq -e '.allowed == true'

Matching is exact and case-insensitive, so GPL-3.0 doesn't match GPL-3.0-only. List every identifier as it appears in your SBOM's license roll-up. A match denies with licenseViolations. See security and SBOM.

For code changes that need a security audit, not a dependency one, use the auth change template.