chore(ci)#11: removal of check-license.yml drops incompatible-license guardrail

[venkycs]

Finding

PR #11 ("chore(ci): remove redundant workflows and add path filtering") deletes .github/workflows/check-license.yml, which was the only gate scanning PR diffs for license text that is incompatible with ZySec AI's proprietary/commercial distribution model (AGPL, SSPL, Commons Clause, Elastic, Business Source, PolyForm, GPL family). No replacement was added.

Labels attempted: review,severity:high,dimension:supply-chain — these labels do not exist in the repository (only bug, documentation, duplicate, enhancement, good first issue, help wanted, invalid, question, wontfix, bot-reviewed, needs-info are configured). Falling back to bug.

Why it matters

• The deleted workflow explicitly stated: "ZySec AI software is proprietary and commercially distributed. Use only: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, ISC, Python-2.0, MPL-2.0". Removing the only enforcement of that policy means an AGPL/SSPL/etc. dependency or file copy/paste can now land without CI rejection.
• License contamination in a proprietary/commercial product is typically irreversible (re-publishing obligations, source disclosure). This is a supply-chain / IP risk, not a code-style issue.
• The PR title frames the workflows as "redundant", but check-license.yml had no functional overlap with the modified security.yml / quality.yml — different inputs, different output (PR comments blocking merge).

Suggested fix

Restore .github/workflows/check-license.yml (recoverable from git history of 61f4f09..8eb9dad) and confirm it is not suppressed on PRs to develop, stage, or release. If the intent is to retire it, replace it with an equivalent license-policy check in _reusable-security.yml so coverage is not lost.

Location

• Deleted file: .github/workflows/check-license.yml (was present at 61f4f09)
• Commit: 8eb9dad ("chore(ci): remove redundant workflows and add path filtering")