tophat / yarn-plugin-licenses

Audit your dependency licenses with this yarn berry plugin
Apache License 2.0
26 stars 7 forks source link

Audit Silently Succeeds When No Tests Run #22

Open Kurt-von-Laven opened 2 years ago

Kurt-von-Laven commented 2 years ago

Describe the bug

The audit should fail when the license auditor is configured with a malformed validator function.

To reproduce

Steps to reproduce the behavior:

  1. Create .licenses.config.ts with the following contents:

      const VALID_LICENSES =
        "(MIT|Apache-2.0|0BSD|BSD-[2-3]-Clause|ISC)";
      const VALIDATOR = new RegExp(
        `^(${VALID_LICENSES}|\\(${VALID_LICENSES}( OR ${VALID_LICENSES})*\\))$`
      );
    
      /* Test what happens when the auditor is misconfigured. The correct configuration would be:
       * module.exports = { isValidLicense: (license) => VALIDATOR.test(license) };
       */
      module.exports = { isValidLicense: VALIDATOR.test };
  2. Run yarn set version 3.0.0 to install Yarn 3.0.0.
  3. Run yarn add --dev ts-node@10.8.1.
  4. Run yarn licenses audit --output-file=reports/junit/licenses.xml --config=.licenses.config.ts --loose.
  5. Run echo $? to see that the audit succeeded, exiting with code 0.
  6. reports/junit/licenses.xml contains:
      <?xml version="1.0" encoding="UTF-8"?>
      <testsuites>
        <testsuite name="Dependency Licenses Audit" tests="0" failures="0" errors="0" skipped="0"/>
      </testsuites>

Expected behavior

I expected the audit to fail because the license validator function itself was invalid.

Environment (please complete the following information):