[Feature Request] Add a flag to handle Unknown licenses about dependency-review-action HOT 7 CLOSED

@wmmc88 Thanks for your input. Do you mind creating a new issue for your Cargo runs so the problem doesn't get lost in the comments here?

@febuiles created new issue to track: #672

from dependency-review-action.

More details about unknown licenses in #182 (comment)

from dependency-review-action.

@jcasner I'm currently working on improving the license support to get much more complete coverage of projects hosted in GitHub/supported by GitHub's Licenses API. Your second proposal sounds reasonable even with better license coverage, so I think we can do something about this soon.

The packages allowlist sounds like a "nice to have", but not mandatory in order to block PRs on null licenses. Is this a "someone could want" feature, or would it affect you if we only shipped what's outlined in your "Option 2"?

from dependency-review-action.

PR in progress here.

from dependency-review-action.

@jcasner we've improved license detection following the approach outlined above. We are also reporting unknown licenses in the output, I hope this helps. Closing this issue, please re-open if needed.

from dependency-review-action.

I think a flag to explicitly deny unknown licenses is still warranted.

The following run fails to be able to detect the license of anstyle:
https://github.com/wmmc88/windows-drivers-rs/actions/runs/7632001216/job/20791223328?pr=18

I am unsure why this is the case since the license is available here.

In any case, I still think there should be a wail to fail the job if unknown license is encountered. There are situations where you wont catch this in PR comments (ex. if triggered on push, or if triggered on PR from a fork)

from dependency-review-action.

@wmmc88 Thanks for your input. Do you mind creating a new issue for your Cargo runs so the problem doesn't get lost in the comments here?

from dependency-review-action.