feat: add licscan init interactive setup wizard

Generates .licscan.yml (policy, project_license, CRA metadata) and
.github/workflows/licscan.yml (CI workflow with optional SARIF upload,
CRA evidence, PR comments) via interactive prompts. Existing files
are never overwritten without confirmation.

Author: akyroslabs

internal/cli/init.go

@@ -0,0 +1,283 @@
+package cli
+
+import (
+	"bufio"
+	"fmt"
+	"io"
+	"os"
+	"path/filepath"
+	"strings"
+
+	"github.com/spf13/cobra"
+)
+
+func newInitCommand() *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "init [path]",
+		Short: "Generate .licscan.yml and/or GitHub Actions workflow",
+		Long: `Interactive setup wizard that generates configuration files:
+
+  1. .licscan.yml          — license policy, manufacturer & product metadata
+  2. .github/workflows/licscan.yml — CI workflow with optional SARIF + CRA
+
+Run in your project root. Existing files are never overwritten without confirmation.`,
+		Args: cobra.MaximumNArgs(1),
+		RunE: func(cmd *cobra.Command, args []string) error {
+			path := "."
+			if len(args) == 1 {
+				path = args[0]
+			}
+			return runInit(cmd, path)
+		},
+	}
+	return cmd
+}
+
+func runInit(cmd *cobra.Command, path string) error {
+	absPath, err := filepath.Abs(path)
+	if err != nil {
+		return fmt.Errorf("resolve path %q: %w", path, err)
+	}
+
+	r := bufio.NewReader(cmd.InOrStdin())
+	w := cmd.ErrOrStderr()
+
+	_, _ = fmt.Fprintln(w)
+	_, _ = fmt.Fprintln(w, "  licscan init — interactive setup")
+	_, _ = fmt.Fprintln(w, "  ────────────────────────────────")
+	_, _ = fmt.Fprintln(w)
+
+	genPolicy := askYN(r, w, "Generate .licscan.yml (license policy)?", true)
+	genAction := askYN(r, w, "Generate .github/workflows/licscan.yml (CI workflow)?", true)
+
+	if !genPolicy && !genAction {
+		_, _ = fmt.Fprintln(w, "\nNothing to generate. Done.")
+		return nil
+	}
+
+	if genPolicy {
+		if err := generatePolicy(r, w, absPath); err != nil {
+			return err
+		}
+	}
+
+	if genAction {
+		if err := generateAction(r, w, absPath); err != nil {
+			return err
+		}
+	}
+
+	_, _ = fmt.Fprintln(w, "\n  ✓ Done. Run `licscan scan .` to test your setup.")
+	return nil
+}
+
+func generatePolicy(r *bufio.Reader, w io.Writer, root string) error {
+	_, _ = fmt.Fprintln(w, "\n── .licscan.yml ──")
+
+	projectLicense := askString(r, w, "Project license (SPDX, e.g. MIT, Apache-2.0)", "")
+
+	_, _ = fmt.Fprintln(w, "\nDefault policy: deny GPL/AGPL/SSPL/BUSL, warn LGPL/MPL/EPL/CDDL.")
+	useDefault := askYN(r, w, "Use default deny/warn lists?", true)
+
+	var denyList, warnList string
+	if !useDefault {
+		denyList = askString(r, w, "Deny list (comma-separated SPDX IDs)", "GPL-3.0-or-later, AGPL-3.0-or-later, SSPL-1.0, BUSL-1.1")
+		warnList = askString(r, w, "Warn list (comma-separated SPDX IDs)", "LGPL-3.0-or-later, MPL-2.0, EPL-2.0")
+	}
+
+	enableCRA := askYN(r, w, "Add EU CRA manufacturer/product metadata?", false)
+
+	var mfgName, mfgEmail, mfgURL, mfgCountry string
+	var prodName, prodVersion string
+	if enableCRA {
+		_, _ = fmt.Fprintln(w, "\n  Manufacturer (CRA Art. 13):")
+		mfgName = askString(r, w, "  Company name", "")
+		mfgEmail = askString(r, w, "  Contact email", "")
+		mfgURL = askString(r, w, "  Website URL", "")
+		mfgCountry = askString(r, w, "  Country (ISO 3166)", "")
+
+		_, _ = fmt.Fprintln(w, "\n  Product:")
+		prodName = askString(r, w, "  Product name", "")
+		prodVersion = askString(r, w, "  Version", "")
+	}
+
+	// Build YAML
+	var b strings.Builder
+	b.WriteString("# licscan policy — generated by `licscan init`\n")
+	b.WriteString("# Docs: https://github.com/codelake-dev/licscan#policy-engine\n\n")
+
+	if projectLicense != "" {
+		fmt.Fprintf(&b, "project_license: %s\n\n", projectLicense)
+	}
+
+	if useDefault {
+		b.WriteString("# Using default deny/warn lists.\n")
+		b.WriteString("# Uncomment and customise to override:\n")
+		b.WriteString("# deny:\n")
+		b.WriteString("#   - GPL-3.0-or-later\n")
+		b.WriteString("#   - AGPL-3.0-or-later\n")
+		b.WriteString("#   - SSPL-1.0\n")
+		b.WriteString("#   - BUSL-1.1\n")
+		b.WriteString("#\n")
+		b.WriteString("# warn:\n")
+		b.WriteString("#   - LGPL-3.0-or-later\n")
+		b.WriteString("#   - MPL-2.0\n")
+		b.WriteString("#   - EPL-2.0\n")
+	} else {
+		b.WriteString("deny:\n")
+		for _, id := range splitCSV(denyList) {
+			fmt.Fprintf(&b, "  - %s\n", id)
+		}
+		b.WriteString("\nwarn:\n")
+		for _, id := range splitCSV(warnList) {
+			fmt.Fprintf(&b, "  - %s\n", id)
+		}
+	}
+
+	b.WriteString("\n# allow_exceptions:\n")
+	b.WriteString("#   - package: github.com/some/lib\n")
+	b.WriteString("#     reason: \"vendored, isolated in tests\"\n")
+
+	if enableCRA {
+		b.WriteString("\nmanufacturer:\n")
+		writeYAMLField(&b, "  name", mfgName)
+		writeYAMLField(&b, "  email", mfgEmail)
+		writeYAMLField(&b, "  url", mfgURL)
+		writeYAMLField(&b, "  country", mfgCountry)
+
+		b.WriteString("\nproduct:\n")
+		writeYAMLField(&b, "  name", prodName)
+		writeYAMLField(&b, "  version", prodVersion)
+	}
+
+	outPath := filepath.Join(root, ".licscan.yml")
+	if err := writeFileWithConfirm(r, w, outPath, b.String()); err != nil {
+		return err
+	}
+
+	_, _ = fmt.Fprintf(w, "  ✓ %s written\n", outPath)
+	return nil
+}
+
+func generateAction(r *bufio.Reader, w io.Writer, root string) error {
+	_, _ = fmt.Fprintln(w, "\n── .github/workflows/licscan.yml ──")
+
+	failOnViolation := askYN(r, w, "Fail the build on policy violation?", true)
+	prComment := askYN(r, w, "Post scan report as PR comment?", true)
+	enableCRA := askYN(r, w, "Enable EU CRA evidence (PDF + JSON)?", false)
+	enableSARIF := askYN(r, w, "Upload SARIF to GitHub Code Scanning?", false)
+	uploadArtifact := askYN(r, w, "Upload report as workflow artifact?", true)
+
+	var b strings.Builder
+	b.WriteString("# License compliance — generated by `licscan init`\n")
+	b.WriteString("# Docs: https://github.com/codelake-dev/licscan-action\n\n")
+	b.WriteString("name: License compliance\n\n")
+	b.WriteString("on:\n")
+	b.WriteString("  pull_request:\n")
+	b.WriteString("  push:\n")
+	b.WriteString("    branches: [main]\n\n")
+
+	if enableSARIF {
+		b.WriteString("permissions:\n")
+		b.WriteString("  contents: read\n")
+		b.WriteString("  pull-requests: write\n")
+		b.WriteString("  security-events: write\n\n")
+	}
+
+	b.WriteString("jobs:\n")
+	b.WriteString("  licscan:\n")
+	b.WriteString("    runs-on: ubuntu-latest\n")
+	b.WriteString("    steps:\n")
+	b.WriteString("      - uses: actions/checkout@v4\n\n")
+	b.WriteString("      - uses: codelake-dev/licscan-action@v1\n")
+	b.WriteString("        with:\n")
+	fmt.Fprintf(&b, "          fail-on-violation: %s\n", boolStr(failOnViolation))
+	fmt.Fprintf(&b, "          pr-comment: %s\n", boolStr(prComment))
+	fmt.Fprintf(&b, "          cra: %s\n", boolStr(enableCRA))
+	fmt.Fprintf(&b, "          upload-artifact: %s\n", boolStr(uploadArtifact))
+
+	if enableSARIF {
+		b.WriteString("\n      - name: Generate SARIF\n")
+		b.WriteString("        run: licscan scan . --format sarif > results.sarif\n\n")
+		b.WriteString("      - uses: github/codeql-action/upload-sarif@v3\n")
+		b.WriteString("        with:\n")
+		b.WriteString("          sarif_file: results.sarif\n")
+	}
+
+	outDir := filepath.Join(root, ".github", "workflows")
+	if err := os.MkdirAll(outDir, 0o755); err != nil {
+		return fmt.Errorf("create %s: %w", outDir, err)
+	}
+
+	outPath := filepath.Join(outDir, "licscan.yml")
+	if err := writeFileWithConfirm(r, w, outPath, b.String()); err != nil {
+		return err
+	}
+
+	_, _ = fmt.Fprintf(w, "  ✓ %s written\n", outPath)
+	return nil
+}
+
+func askYN(r *bufio.Reader, w io.Writer, question string, defaultYes bool) bool {
+	hint := "[Y/n]"
+	if !defaultYes {
+		hint = "[y/N]"
+	}
+	_, _ = fmt.Fprintf(w, "  %s %s ", question, hint)
+	line, _ := r.ReadString('\n')
+	line = strings.TrimSpace(strings.ToLower(line))
+	if line == "" {
+		return defaultYes
+	}
+	return line == "y" || line == "yes"
+}
+
+func askString(r *bufio.Reader, w io.Writer, question, defaultVal string) string {
+	if defaultVal != "" {
+		_, _ = fmt.Fprintf(w, "  %s [%s]: ", question, defaultVal)
+	} else {
+		_, _ = fmt.Fprintf(w, "  %s: ", question)
+	}
+	line, _ := r.ReadString('\n')
+	line = strings.TrimSpace(line)
+	if line == "" {
+		return defaultVal
+	}
+	return line
+}
+
+func writeFileWithConfirm(r *bufio.Reader, w io.Writer, path, content string) error {
+	if _, err := os.Stat(path); err == nil {
+		overwrite := askYN(r, w, fmt.Sprintf("  %s already exists. Overwrite?", path), false)
+		if !overwrite {
+			_, _ = fmt.Fprintf(w, "  ⏭ Skipped %s\n", path)
+			return nil
+		}
+	}
+	return os.WriteFile(path, []byte(content), 0o600)
+}
+
+func writeYAMLField(b *strings.Builder, key, value string) {
+	if value != "" {
+		fmt.Fprintf(b, "%s: %s\n", key, value)
+	}
+}
+
+func splitCSV(s string) []string {
+	parts := strings.Split(s, ",")
+	result := make([]string, 0, len(parts))
+	for _, p := range parts {
+		p = strings.TrimSpace(p)
+		if p != "" {
+			result = append(result, p)
+		}
+	}
+	return result
+}
+
+func boolStr(b bool) string {
+	if b {
+		return "true"
+	}
+	return "false"
+}

internal/cli/root.go

@@ -40,6 +40,7 @@ func NewRootCommand() *cobra.Command {
 	root.AddCommand(
 		newScanCommand(),
 		newNoticeCommand(),
+		newInitCommand(),
 		newAboutCommand(),
 	)