search

kalessil / production-dependencies-guard

MIT License
87 stars 3 forks source link

Allow missing license #10

Closed ScreamingDev closed 5 years ago

ScreamingDev commented 5 years ago

Using PDG (production-dependencies-guard) in existing projects stops the whole team because after installing and setting the config like this:

"production-dependencies-guard": [
      "check-description",
      "check-license"
    ]

You get lots of errors:

Dependencies guard has found violations in require-dependencies (source: manifest):
foo missing-license

Please add an option to ignore missing license. Otherwise we would have to add almost 13 packages to whitelist by now.

kalessil commented 5 years ago

Got it, in this case, check-license should be removed from the config - license check will be skipped. BTW are those modules are internal or third-party?

ScreamingDev commented 5 years ago

What I meant was that some things are okay to have no license at all because they are either custom or proprietary bought without really showing it. Some companies use packagist.com and host their own things there including bought packages. So having an option to ignore those missing things is better instead of asking every vendor to add a license and wait for them to patch it.

This for local development. To not block the dev going on (with things that are agreed on by the stakeholders). Tech shall never stop humans from working ^^

Before releasing things I totally want all those error messages on the CI server. This is why switching on and off would be so great.

Hint: We still use a workaround like two different composer.json files but this does not help much :/