chore: verify dependency licenses

app/build.gradle.kts

@@ -1,3 +1,5 @@
+import groovy.json.JsonSlurper
+
 plugins {
     alias(libs.plugins.kotlin.jvm)
 }
@@ -25,3 +27,28 @@ tasks.test {
         exceptionFormat = org.gradle.api.tasks.testing.logging.TestExceptionFormat.FULL
     }
 }
+
+tasks.register("verifyDependencyLicenses") {
+    group = "verification"
+    description = "Ensures every resolved JVM runtime/test artifact has a reviewed license entry."
+
+    doLast {
+        @Suppress("UNCHECKED_CAST")
+        val manifest = JsonSlurper().parse(rootProject.file("config/dependency-licenses.json")) as Map<String, Any>
+        @Suppress("UNCHECKED_CAST")
+        val components = manifest.getValue("components") as List<Map<String, Any>>
+        val reviewedCoordinates = components.mapNotNull { it["coordinates"] as String? }.toSet()
+        val resolvedCoordinates = configurations.getByName("testRuntimeClasspath")
+            .resolvedConfiguration
+            .resolvedArtifacts
+            .map { artifact ->
+                val id = artifact.moduleVersion.id
+                "${id.group}:${id.name}:${id.version}"
+            }
+            .toSet()
+        val missing = resolvedCoordinates - reviewedCoordinates
+        check(missing.isEmpty()) {
+            "Dependencies missing reviewed license entries: ${missing.sorted().joinToString()}"
+        }
+    }
+}