/**
 * CI software-composition-analysis (SCA) workflow: scan dependency licenses and
 * fail the build on copyleft that legal will not accept. The license matrix
 * encodes the blueprint's "Open-Source Compliance Gates" tiers — permissive is
 * auto-approved, weak copyleft alerts, strong copyleft fails, and network
 * copyleft (AGPL) is hard-blocked.
 *
 * This emits a GENERATED FILE only. The harness never runs CI — the workflow
 * executes in the customer's pipeline (see the accompanying `doc`).
 */
export type LicenseDisposition = "auto-approve" | "alert" | "fail" | "block";
export interface LicenseTier {
    /** Compliance category from the blueprint. */
    category: string;
    /** SPDX identifiers that fall in this tier. */
    spdx: string[];
    disposition: LicenseDisposition;
    note: string;
}
/** License matrix (blueprint: Legal and Open-Source Compliance Gates). */
export declare const LICENSE_MATRIX: LicenseTier[];
/** SPDX ids whose presence must FAIL the gate (strong + network copyleft). */
export declare function blockingLicenses(): string[];
/**
 * The blocking SPDX ids actually present in an SBOM document — a faithful mirror of
 * the generated workflow's gate (`grep -q "\"$spdx\"" sbom.spdx.json`). Exported so
 * the gate's POLICY is unit-tested against representative SBOM fixtures (MIT passes,
 * GPL/AGPL fail), not merely asserted as generated strings. Empty list = gate passes.
 */
export declare function blockedLicensesFound(sbomText: string, blocked?: string[]): string[];
/** SHA-256 for gitleaks_8.24.2_linux_x64.tar.gz from the upstream release asset. */
export declare const GITLEAKS_LINUX_X64_TAR_SHA256 = "fa0500f6b7e41d28791ebc680f5dd9899cd42b58629218a5f041efa899151a8e";
/**
 * SHA-pinned actions/checkout ref shared by every workflow aih generates (this
 * one and the risk-gates consumer) — one authored source so the pin cannot drift
 * between generated workflows.
 */
export declare const CHECKOUT_ACTION_PIN = "actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1";
/** Render `.github/workflows/sca.yml` — license scan that blocks AGPL/strong copyleft. */
export declare function scaWorkflowYaml(): string;