Skip to content

False positive for License file when using actions/dependency-review-action #17072

@alexander-akait

Description

@alexander-akait

Currently our License file contains all licenses of our dependencies. So when you use an actions like https://github.com/actions/dependency-review-action (it is the official github security and license and I think other tools can have such problems too) to verify your licenses (and deps licenses) you will get a false positive about our real license, I understand what some parsers can be non MIT compatibility licenses and I can't use them in some cases, but prettier itself is under MIT, but now I need to put prettier under ignore section to fix license checking.

Example of false positive - https://github.com/webpack/webpack/actions/runs/13166972081?pr=19196

Package
prettier

Version
3.4.2

License
Apache-2.0 AND BSD-2-Clause AND BSD-3-Clause AND ISC AND MIT

Issue Type
Incompatible License

We didn't have this problem before, apparently we started generate license with deps recently, so I suggest that to avoid such confusion (and I'm afraid there may be more tools with such a problem) separate the deps licenses into a separate file, for example ArtifactLicenses (maybe better name).

This question is not related to changing licenses, it is only about eliminating false positive for such tools.

/cc @sosukesuzuki @fisker

Metadata

Metadata

Assignees

No one assigned

    Labels

    locked-due-to-inactivityPlease open a new issue and fill out the template instead of commenting.

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions