search

actions / dependency-review-action

A GitHub Action for detecting vulnerable dependencies and invalid licenses in your PRs
MIT License
616 stars 107 forks source link

MIT is an invalid SPDX license identifier? #742

Open recurly-bearley opened 7 months ago

recurly-bearley commented 7 months ago

I have dependency-review setup to deny a whole slew of licenses:

fail-on-severity: high
comment-summary-in-pr: never
warn-only: true
license-check: true
deny-licenses: 
  - Abstyles
  - AdaCore-doc
  - Adobe-2006
  - Adobe-Glyph
  - Adobe-Utopia
  -  ......

It's failing to recognize MIT as a valid SPDX license identifier:

Warning: The validity of the licenses of the dependencies below could not be determined. Ensure that they are valid SPDX licenses: .github/workflows/dependency-check.yml » actions/checkout@4.*.* – License: MIT Error: Dependency review could not detect the validity of all licenses.

This doesn't seem right. MIT is very common, not on the deny list, on the complete list and this is a github action it's failing on. Additionally, why is it failing the job for this?

jonjanego commented 7 months ago

Could you please share the full deny list, as well as the dependency that it's failing on?

recurly-bearley commented 7 months ago

`fail-on-severity: high comment-summary-in-pr: never warn-only: true license-check: true deny-licenses:

The dependency that it's failing on is in the report. actions/checkout@4.*.* – License: MIT

github-actions[bot] commented 1 month ago

👋 This issue has been marked as stale because it has been open with no activity for 180 days. You can: comment on the issue or remove the stale label to hold stalebot off for a while, add the Keep label to hold stale off permanently, or do nothing. If you do nothing, this issue will be closed eventually by the stalebot. Please see CONTRIBUTING.md for more policy details.