Add license policy exceptions for github-mcp-server Debian base OS packages

.grant.yaml

@@ -10,7 +10,8 @@ allow:
   - ISC
 
 # Base OS packages of upstream container images that gh-aw executes (Alpine
-# variants of the MCP server and runtime images) and the Node/npm runtime those
+# variants of the MCP server and runtime images, plus the Debian-based
+# ghcr.io/github/github-mcp-server image) and the Node/npm runtime those
 # images ship. These packages come with the upstream base image, are never linked
 # into or redistributed with gh-aw, and are therefore accepted as a documented
 # policy exception. The allowlist above still applies to every other package in
@@ -37,6 +38,13 @@ ignore-packages:
   - ssl_client
   - zlib
   - zstd-libs
+  # Debian base OS (ghcr.io/github/github-mcp-server)
+  - base-files
+  - libc6
+  - libssl3
+  - media-types
+  - netbase
+  - tzdata
   # Node.js runtime and npm with its bundled dependencies
   - chownr
   - common-ancestor-path

CONTRIBUTING.md

@@ -409,7 +409,7 @@ The following licenses are **not allowed** as they conflict with our MIT license
 
 ### Container Base OS Packages
 
-The license policy in `.grant.yaml` is also applied to the container images referenced by compiled workflows (`gh aw compile --grant`). Packages that ship with the upstream base images are listed under `ignore-packages` as a documented exception: the Alpine base OS packages (`busybox`, `apk-tools`, `alpine-baselayout`, `musl-utils`, `git`, `libgcc`, `libstdc++`, and their variants) and the Node.js/npm runtime with npm's bundled dependencies (`node`, `npm`, `tar`, `glob`, `minipass`, and friends). They are executed as part of a third-party image, never linked into or redistributed with gh-aw, and cannot be changed without replacing the upstream image. Every other package in those images is still evaluated against the allowlist above.
+The license policy in `.grant.yaml` is also applied to the container images referenced by compiled workflows (`gh aw compile --grant`). Packages that ship with the upstream base images are listed under `ignore-packages` as a documented exception: the Alpine base OS packages (`busybox`, `apk-tools`, `alpine-baselayout`, `musl-utils`, `git`, `libgcc`, `libstdc++`, and their variants), the Debian base OS packages of the `ghcr.io/github/github-mcp-server` image (`base-files`, `libc6`, `libssl3`, `media-types`, `netbase`, `tzdata`), and the Node.js/npm runtime with npm's bundled dependencies (`node`, `npm`, `tar`, `glob`, `minipass`, and friends). They are executed as part of a third-party image, never linked into or redistributed with gh-aw, and cannot be changed without replacing the upstream image. Every other package in those images is still evaluated against the allowlist above.
 
 ### Before Adding a Dependency