Skip to content

onebeyond/license-checker

Repository files navigation

logo

npm version npm downloads run-tests workflow release-and-publish workflow socket.dev all-contributors

🕵️ Audit your NPM dependencies and reject any forbidden license.

Check our wiki!

📝 Description

This package allows you to do a quick audit on your NPM dependencies by adding it in your hooks.

You can optionally add options to exclude generating the report or avoid generating the error report in case a forbidden license is found (see more details here).

The package provides two commands:

Command Description
scan (default command) scan licenses of a project looking for forbidden licenses
check check if a license is SPDX compliant

🔎 How to use it in your project

  • Install the package
npm install @onebeyond/license-checker

check command

Just run the check command with the license expression you want to check against SPDX:

npx @onebeyond/license-checker check <license>

The process will fail if license is not SPDX compliant.

scan command

  • Add a script to run the package
npx @onebeyond/license-checker scan --failOn <license>
  • If you are using yarn you may want to run it from the node modules instead of using npx
node_modules/.bin/license-checker scan --failOn <license>
  • Use the script wherever you want (husky hook, in your CI/CD pipeline, ...)

🚩 Options

Option Description Requiered Type Default
--start Path of the initial json to look for false string process.cwd()
--failOn Fail (exit with code 1) if any package license does not satisfies any license in the provided list true string[]
--outputFileName Name of the report file generated false string license-report-<timestamp>.md
--errorReportFileName Name of the error report file generated when a license in the failOn option is found false string license-error-<timestamp>.md
--disableErrorReport Flag to disable the error report file generation false boolean false
--disableReport Flag to disable the report file generation, whether there is an error or not false boolean false
--customHeader Name of a text file containing the custom header to add at the start of the generated report false string This application makes use of the following open source packages:

🧑‍💻 Examples

check command

This command is intended to be used as a standalone functionality to check whether the value supplied is in compliance with SDPX. It is useful for checking the value before using it with the scan command:

npx @onebeyond/license-checker check "(MIT OR GPL-1.0+) AND 0BSD"

If the value provided is not SPDX compliant, the process fails (exit error 1).

scan command

All the values provided in the failOn list must be SPDX compliant. Otherwise, an error will be thrown (exit error 1). Check the SPDX license list.

npx @onebeyond/license-checker scan --failOn MIT GPL-1.0+

The input list is transformed into a SPDX expression with the OR logical operator. In the example, that is MIT OR GPL-1.0+. If any of the packages' licenses satisfies that expression, the process fails (exit error 1).

🔗 Useful links

⚠️ Temporal issue

An issue in spdx-satisfies has been found and it's pending resolution. Until then, GFDL 1x licenses are not supported and an error will be thrown if either packages or failOn arguments contain it.

Contributors ✨

Thanks goes to these wonderful people (emoji key):

Jose Manuel Torralvo Moyano
Jose Manuel Torralvo Moyano

💻 📖 🤔 🚧 👀
Mario Quiroga
Mario Quiroga

💻 📖 🤔 🚧 👀
Íñigo Marquínez
Íñigo Marquínez

💻 📖 🤔 🚧 👀
Sara Hernández
Sara Hernández

💻
Laura
Laura

👀
Adri Rodríguez
Adri Rodríguez

👀
David Miguel Yusta
David Miguel Yusta

💻 📖 🤔 🚧 👀 ⚠️
Lucía
Lucía

🎨
Ulises Gascón
Ulises Gascón

💻 📖 🚧
Fernando de la Torre
Fernando de la Torre

💻

This project follows the all-contributors specification. Contributions of any kind welcome!