Check License Compliance

What Check License Compliance is

Check License Compliance is an open-source GitHub Action for checking repository dependencies against license policies. It supports Node.js packages from NPM, Python packages from PyPI, Maven and Go. The action reads manifest files and retrieves dependency-tree details recursively through the deps.dev API, so packages do not need to be installed first. Policies can allow, forbid or warn on licenses, with configurable treatment for other or unknown licenses. Configuration can come from a YAML file, action inputs, or both, and can select or exclude dependencies and files. It runs in GitHub Actions workflows, and a composite action can post results as a pull request comment. Reports are available as text, Markdown or JSON, with details about noncompliant dependencies, installation paths and licenses. The action runs using a Docker image defined by the repository's Dockerfile. The project is licensed under Apache-2.0 and identifies Telefónica Innovación Digital as its author. The listed plan costs nothing. License expressions using AND or OR are not supported; simple SPDX identifiers, plus-ranges and exceptions are supported.

Who it suits

It suits teams that want to check repository dependency licenses in GitHub Actions, including those working with NPM, PyPI, Maven or Go projects.

Limits

License expressions using AND or OR are not supported. The listed plan is free and is Apache-2.0 licensed.

Getting started

1. Open the project website on GitHub.
2. Add the GitHub Action to a GitHub Actions workflow.
3. Set configuration in a YAML file, action inputs, or both.
4. Choose which dependencies and files to include or exclude.
5. Set license policies and choose a report format.

Verdict

Check License Compliance offers configurable license checks within GitHub Actions, with detailed reports and pull request comments. Its unsupported AND and OR expressions are an important policy-matching limit to consider.