actions
Failure to determine license and flag to explicitly deny unknown licenses
I think a flag to explicitly deny unknown licenses is still warranted.
The following run fails to be able to detect the license of anstyle: https://github.com/wmmc88/windows-drivers-rs/actions/runs/7632001216/job/20791223328?pr=18
I am unsure why this is the case since the license is available here.
In any case, I still think there should be a way to fail the job if unknown license is encountered. There are situations where you wont catch this in PR comments (ex. if triggered on push, or if triggered on PR from a fork)
Originally posted by @wmmc88 in https://github.com/actions/dependency-review-action/issues/264#issuecomment-1907051320
For the specific reproduction PR you gave, I wasn't able to reproduce the issue in a test repository with the same Cargo.lock file. The license also appears correct in the "view rich diff"/dependency review feature of the pull request itself.
So it looks like that part may have been a transient issue on our end.
On the topic of adding a fail-on-unknown-license option - I'll keep this issue open for tracking that.
https://github.com/actions/dependency-review-action/issues/714 also suggests the value of failing on unknown.
The example we have run into is with this github action, Docker Scout.
Clearly not an SPDX license type, so I am not saying that I would expect a different result from the dependency review action, but the ability to (a) fail when unknown and (b) possibly allow for this specific dependency to pass once the team determines it is OK to include would be nice.
👋 This issue has been marked as stale because it has been open with no activity for 180 days. You can: comment on the issue or remove the stale label to hold stalebot off for a while, add the Keep label to hold stale off permanently, or do nothing. If you do nothing, this issue will be closed eventually by the stalebot. Please see CONTRIBUTING.md for more policy details.
![github-actions[bot] avatar](https://avatars.githubusercontent.com/in/15368?v=4 "Published by a pub.dev verified publisher"){kind=small}
@jonjanego is this going to be added?
at the moment we do not have bandwidth to add this new feature, but would love to review any community contributions to it!
👋 This issue has been marked as stale because it has been open with no activity for 180 days. You can: comment on the issue or remove the stale label to hold stalebot off for a while, add the Keep label to hold stale off permanently, or do nothing. If you do nothing, this issue will be closed eventually by the stalebot. Please see CONTRIBUTING.md for more policy details.
👋 This issue has been closed by stalebot because it has been open with no activity for over 180 days. Please see CONTRIBUTING.md for more policy details.