Skip to content

[BUG] Using allow-dependencies-licenses still warns as no license found #889

Open
@mbbeaudry-coveo

Description

@mbbeaudry-coveo

Describe the bug
We are hoping to use allow-dependencies-licenses to ignore internal org dependencies. Doing so seems to still warn on the fact that no licenses were found:

Image

I cannot post more information due to internal details leakage, but the 42 count are all internal and part of the allow-dependencies-licenses config. We are able to skip the check for those that do have a license.

To Reproduce
Steps to reproduce the behavior:

  1. Add a package (we tried maven) known to have no licenses to allow-dependencies-licenses. We used an internal one
  2. Check the output, the warn section still mentions the package

Expected behavior
Ignoring a license should not warn that there is no license.

Version

      - name: Scan
        uses: actions/dependency-review-action@72eb03d02c7872a771aacd928f3123ac62ad6d3a # v4.3.3

Example

      - name: Scan
        uses: actions/dependency-review-action@72eb03d02c7872a771aacd928f3123ac62ad6d3a # v4.3.3
        with:
          allow-dependencies-licenses: 'pkg:maven/<org>/<pkg>, pkg:maven/org.springframework.retry/spring-retry@2.0.11'

The first one shows up in the warnings, the second is skipped.

Metadata

Metadata

Assignees

No one assigned

    Labels

    bugSomething isn't working

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions