checkgate-dev · akosidencio · Jul 18, 2026 · Jul 18, 2026
diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
@@ -22,7 +22,7 @@ jobs:
     name: Rust tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -73,7 +73,7 @@ jobs:
           --health-timeout 5s
           --health-retries 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -120,15 +120,15 @@ jobs:
           --health-timeout 5s
           --health-retries 10
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
 
       - name: Cache Rust build artifacts
         uses: Swatinem/rust-cache@v2
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
 
@@ -165,7 +165,7 @@ jobs:
     name: Dashboard build
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - uses: oven-sh/setup-bun@v2
         with:
@@ -190,9 +190,9 @@ jobs:
     name: CLI tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
 
@@ -211,9 +211,9 @@ jobs:
     name: Edge evaluator tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
 
@@ -228,9 +228,9 @@ jobs:
     name: SSR helpers tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
 
@@ -246,9 +246,9 @@ jobs:
     name: Node SDK tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
 
@@ -268,9 +268,9 @@ jobs:
       matrix:
         sdk: [web, react-native]
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
 
@@ -290,7 +290,7 @@ jobs:
     name: Flutter SDK tests
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - uses: subosito/flutter-action@v2
         with:
@@ -318,9 +318,9 @@ jobs:
           - integrations/terraform-provider-checkgate
           - integrations/kubernetes-operator
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
-      - uses: actions/setup-go@v5
+      - uses: actions/setup-go@v6
         with:
           go-version: "1.25"
           cache-dependency-path: ${{ matrix.module }}/go.sum

diff --git a/.github/workflows/docs.yml b/.github/workflows/docs.yml
@@ -21,9 +21,9 @@ jobs:
   build:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: '22.x'
           cache: npm
@@ -51,4 +51,4 @@ jobs:
     steps:
       - name: Deploy to GitHub Pages
         id: deployment
-        uses: actions/deploy-pages@v4
+        uses: actions/deploy-pages@v5
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -40,9 +40,9 @@ jobs:
     name: Verify — JS packages
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
 
@@ -116,7 +116,7 @@ jobs:
             artifact: checkgate.win32-x64-msvc.node
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -128,7 +128,7 @@ jobs:
         with:
           key: ${{ matrix.target }}
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
 
@@ -152,7 +152,7 @@ jobs:
           fi
 
       - name: Upload artifact
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: node-${{ matrix.target }}
           path: sdks/nodejs/${{ matrix.artifact }}
@@ -164,7 +164,7 @@ jobs:
       # publish job to assemble alongside all six `.node` binaries.
       - name: Upload JS dispatch loader
         if: matrix.target == 'x86_64-unknown-linux-gnu'
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: node-js-binding
           path: |
@@ -177,7 +177,7 @@ jobs:
     name: Verify — web WASM
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Install Rust toolchain
         uses: dtolnay/rust-toolchain@stable
@@ -190,7 +190,7 @@ jobs:
       - name: Install wasm-pack
         run: curl https://rustwasm.github.io/wasm-pack/installer/init.sh -sSf | sh
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
 
@@ -219,7 +219,7 @@ jobs:
         run: node scripts/smoke-core.mjs
 
       - name: Upload built WASM
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@v6
         with:
           name: web-dist
           path: sdks/web/dist
@@ -230,7 +230,7 @@ jobs:
     name: Verify — Flutter package
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Install Flutter (stable)
         uses: subosito/flutter-action@v2
@@ -269,7 +269,7 @@ jobs:
     name: Verify — Docker image
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Set up QEMU (multi-arch)
         uses: docker/setup-qemu-action@v3
@@ -313,15 +313,15 @@ jobs:
       contents: read
       id-token: write # OIDC token for npm provenance
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
           registry-url: https://registry.npmjs.org
 
       - name: Download all native artifacts
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           pattern: node-*
           merge-multiple: true
@@ -382,15 +382,15 @@ jobs:
       contents: read
       id-token: write # OIDC token for npm provenance
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
-      - uses: actions/setup-node@v4
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
           registry-url: https://registry.npmjs.org
 
       - name: Download built WASM
-        uses: actions/download-artifact@v4
+        uses: actions/download-artifact@v7
         with:
           name: web-dist
           path: sdks/web/dist
@@ -428,8 +428,8 @@ jobs:
       contents: read
       id-token: write # OIDC token for npm provenance
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
           registry-url: https://registry.npmjs.org
@@ -455,8 +455,8 @@ jobs:
       contents: read
       id-token: write # OIDC token for npm provenance
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
           registry-url: https://registry.npmjs.org
@@ -482,8 +482,8 @@ jobs:
       contents: read
       id-token: write # OIDC token for npm provenance
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
           registry-url: https://registry.npmjs.org
@@ -509,8 +509,8 @@ jobs:
       contents: read
       id-token: write # OIDC token for npm provenance
     steps:
-      - uses: actions/checkout@v4
-      - uses: actions/setup-node@v4
+      - uses: actions/checkout@v5
+      - uses: actions/setup-node@v5
         with:
           node-version: 22
           registry-url: https://registry.npmjs.org
@@ -539,7 +539,7 @@ jobs:
     permissions:
       id-token: write
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Install Flutter (stable)
         uses: subosito/flutter-action@v2
@@ -581,7 +581,7 @@ jobs:
       packages: write
       id-token: write # Required for Cosign keyless signing
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@v5
 
       - name: Set up QEMU (multi-arch)
         uses: docker/setup-qemu-action@v3

diff --git a/CHANGELOG.md b/CHANGELOG.md
@@ -7,6 +7,16 @@ and this project adheres to [Semantic Versioning](https://semver.org/).
 
 ## [0.1.22] - 2026-07-18
 
+### Changed — License
+
+- **Checkgate is now licensed under the Apache License 2.0** (previously MIT). Both are permissive
+  and neither restricts commercial or closed-source use; Apache 2.0 adds an **explicit patent grant**
+  from contributors to users, which MIT is silent on, plus a defensive patent-retaliation clause and
+  an explicit statement that trademark rights are not granted. The SPDX identifier on every crate
+  and npm package is now `Apache-2.0`, and a `NOTICE` file has been added.
+- Releases up to and including **`v0.1.21` remain MIT-licensed** — that grant is irrevocable for
+  those versions and for anyone who already received them.
+
 ### Added
 
 - **Slack & Microsoft Teams alerts** — flag and change-request activity can now be delivered straight

diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md
@@ -100,4 +100,6 @@ Use the GitHub issue templates:
 
 ## License
 
-By contributing you agree that your changes will be licensed under the [MIT License](LICENSE).
+By contributing you agree that your changes will be licensed under the
+[Apache License 2.0](LICENSE), and that you have the right to grant that licence
+for the work you submit.
diff --git a/Cargo.toml b/Cargo.toml
@@ -11,3 +11,4 @@ resolver = "2"
 
 [workspace.package]
 version = "0.1.22"
+license = "Apache-2.0"
Original file line number	Diff line number	Diff line change
Expand Up		@@ -11,3 +11,4 @@ resolver = "2"

		[workspace.package]
		version = "0.1.22"
		license = "Apache-2.0"