Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

[BUG] Using allow-dependencies-licenses still warns as no license found #889

Open
mbbeaudry-coveo opened this issue Jan 29, 2025 · 0 comments
Labels
bug Something isn't working

Comments

@mbbeaudry-coveo
Copy link

Describe the bug
We are hoping to use allow-dependencies-licenses to ignore internal org dependencies. Doing so seems to still warn on the fact that no licenses were found:

Image

I cannot post more information due to internal details leakage, but the 42 count are all internal and part of the allow-dependencies-licenses config. We are able to skip the check for those that do have a license.

To Reproduce
Steps to reproduce the behavior:

  1. Add a package (we tried maven) known to have no licenses to allow-dependencies-licenses. We used an internal one
  2. Check the output, the warn section still mentions the package

Expected behavior
Ignoring a license should not warn that there is no license.

Version

      - name: Scan
        uses: actions/dependency-review-action@72eb03d02c7872a771aacd928f3123ac62ad6d3a # v4.3.3

Example

      - name: Scan
        uses: actions/dependency-review-action@72eb03d02c7872a771aacd928f3123ac62ad6d3a # v4.3.3
        with:
          allow-dependencies-licenses: 'pkg:maven/<org>/<pkg>, pkg:maven/org.springframework.retry/[email protected]'

The first one shows up in the warnings, the second is skipped.

@mbbeaudry-coveo mbbeaudry-coveo added the bug Something isn't working label Jan 29, 2025
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
bug Something isn't working
Projects
None yet
Development

No branches or pull requests

1 participant