chore(licensing): auto-generate per-module NOTICE-binary from jars' META-INF

.github/workflows/build.yml

@@ -107,7 +107,7 @@ jobs:
         run: yarn --cwd frontend format:ci
       - name: Prod build
         run: yarn --cwd frontend run build:ci
-      - name: Check bundled npm packages against LICENSE-binary
+      - name: Check bundled npm packages against per-module LICENSE-binary files
         if: matrix.os == 'ubuntu-latest'
         run: ./bin/licensing/check_binary_deps.py npm frontend/dist/3rdpartylicenses.json
       - name: Run frontend unit tests
@@ -224,6 +224,40 @@ jobs:
           ./bin/licensing/check_binary_deps.py jar "${lib_paths[@]}" || check_exit=$?
           ./bin/licensing/audit_jar_licenses.py "${lib_paths[@]}" || true
           exit "$check_exit"
+      - name: Verify per-module NOTICE-binary files match generator output
+        # NOTICE-binary files are generated from each module's bundled jars'
+        # META-INF/NOTICE content via bin/licensing/generate_notice_binary.py.
+        # Regenerate against the freshly-built dist lib dirs and diff against
+        # the committed files. Any drift means a dep was added/removed/bumped
+        # without rerunning the generator — fix by running:
+        #   ./bin/licensing/generate_notice_binary.py <module>/NOTICE-binary <lib-dir> [--extras ...]
+        run: |
+          set -euo pipefail
+          declare -A modules=(
+            [access-control-service]="/tmp/dists/access-control-service-*/lib"
+            [config-service]="/tmp/dists/config-service-*/lib"
+            [file-service]="/tmp/dists/file-service-*/lib"
+            [workflow-compiling-service]="/tmp/dists/workflow-compiling-service-*/lib"
+            [computing-unit-managing-service]="/tmp/dists/computing-unit-managing-service-*/lib"
+            [amber]="/tmp/dists/amber-*/lib"
+          )
+          drift=0
+          for module in "${!modules[@]}"; do
+            lib=$(eval echo "${modules[$module]}")
+            extras_arg=""
+            if [[ -f "${module}/NOTICE-binary-extras" ]]; then
+              extras_arg="--extras ${module}/NOTICE-binary-extras"
+            fi
+            ./bin/licensing/generate_notice_binary.py /tmp/notice-${module}.txt "$lib" $extras_arg
+            if ! diff -u "${module}/NOTICE-binary" /tmp/notice-${module}.txt; then
+              echo "::error::${module}/NOTICE-binary differs from generator output."
+              drift=1
+            fi
+          done
+          if (( drift )); then
+            echo "::error::Run bin/licensing/generate_notice_binary.py for the affected module(s) and commit the result."
+            exit 1
+          fi
       - name: Install dependencies
         # Only the backend test step needs the python deps; install just
         # before tests so a lint or dist failure does not pay for them.
@@ -293,7 +327,7 @@ jobs:
       - name: Generate pip-licenses manifest
         if: matrix.python-version == '3.12'
         run: pip-licenses --format=csv --ignore-packages pip-licenses prettytable wcwidth > /tmp/pip-licenses.csv
-      - name: Check installed Python packages against LICENSE-binary
+      - name: Check installed Python packages against per-module LICENSE-binary files
         if: matrix.python-version == '3.12'
         run: ./bin/licensing/check_binary_deps.py python /tmp/pip-licenses.csv
       - name: Create iceberg catalog database
@@ -353,7 +387,7 @@ jobs:
         run: |
           mkdir -p dist
           bun run bin/collect-licenses.ts > dist/3rdpartylicenses.json
-      - name: Check bundled agent-service packages against LICENSE-binary
+      - name: Check bundled agent-service packages against per-module LICENSE-binary files
         if: matrix.os == 'ubuntu-latest'
         run: ../bin/licensing/check_binary_deps.py agent-npm dist/3rdpartylicenses.json
       - name: Install development dependencies

.licenserc.yaml

@@ -13,9 +13,13 @@ header:
     - 'DESCRIPTION'
     - 'DISCLAIMER'
     - 'LICENSE'
-    - 'LICENSE-binary'
     - 'NOTICE'
-    - 'NOTICE-binary'
+    # Per-module LICENSE-binary / NOTICE-binary describing the third-party
+    # content bundled in each module's binary artifact (Universal dist zip
+    # or Docker image). Plain-text manifests, not source files.
+    - '**/LICENSE-binary'
+    - '**/LICENSE-binary-*'
+    - '**/NOTICE-binary'
     - '.dockerignore'
     - '.gitattributes'
     - '.github/PULL_REQUEST_TEMPLATE'