-
-
Notifications
You must be signed in to change notification settings - Fork 4.7k
False positive for License file when using actions/dependency-review-action #17072
Description
Currently our License file contains all licenses of our dependencies. So when you use an actions like https://github.com/actions/dependency-review-action (it is the official github security and license and I think other tools can have such problems too) to verify your licenses (and deps licenses) you will get a false positive about our real license, I understand what some parsers can be non MIT compatibility licenses and I can't use them in some cases, but prettier itself is under MIT, but now I need to put prettier under ignore section to fix license checking.
Example of false positive - https://github.com/webpack/webpack/actions/runs/13166972081?pr=19196
Package
prettierVersion
3.4.2License
Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND MITIssue Type
Incompatible License
We didn't have this problem before, apparently we started generate license with deps recently, so I suggest that to avoid such confusion (and I'm afraid there may be more tools with such a problem) separate the deps licenses into a separate file, for example ArtifactLicenses (maybe better name).
This question is not related to changing licenses, it is only about eliminating false positive for such tools.
/cc @sosukesuzuki @fisker