ci: add a full-tree license scan for both ecosystems - #175
Merged
Conversation
dependency-review only inspects dependencies that CHANGE in a pull request, and its matcher silently passes a crate whose licence string it cannot parse — which is how unescaper's GPL arm sat in the tree unnoticed until upstream rewrote the deprecated slash syntax as real SPDX. This is the backstop that check structurally cannot be. It found two licences on its first run that the deny-list had never surfaced, both benign and both now explicitly allowed rather than silently passing: CDLA-Permissive-2.0 (webpki-root-certs, the root CA bundle via reqwest) and OFL-1.1 (the bundled IBM Plex fonts). Weekly rather than per-PR, since dependency-review already gates changed dependencies; the PR trigger is scoped to lockfile and config edits.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
dependency-reviewhas two structural blind spots: it only inspects dependencies that change in a pull request, and its matcher silently passes a crate whose license string it cannot parse.unescapercarried a GPL arm in the tree unnoticed for exactly the second reason — it declared the deprecatedGPL-3.0/MITslash syntax, which the parser could not read, until upstream rewrote it as real SPDX in 0.1.10 and it suddenly failed a PR.This adds the backstop that check cannot be.
What it does
cargo deny check licensesagainstsrc-tauri/deny.toml. cargo-deny parses every entry inCargo.lockas an SPDX expression, so a dualMIT OR GPL-3.0-onlycorrectly resolves to its MIT arm, and anything unparseable fails loudly instead of sailing through.license-checker-rseidelsohn --onlyAllowover the production tree.Weekly on Monday (same day as Dependabot), plus a PR trigger scoped to lockfiles and this config, plus
workflow_dispatch.It found two licenses on its first run
Both benign, both now explicitly allowed rather than silently passing:
CDLA-Permissive-2.0webpki-root-certsviareqwest→rustls-platform-verifierOFL-1.1@fontsource/ibm-plex-mono/-sansNeither had ever appeared in a
dependency-reviewrun, because neither is GPL-shaped and the check is a deny-list.Note on the allow-lists
The Cargo list includes
MPL-2.0becauseserialport— a direct dependency — is MPL-2.0. That is file-level weak copyleft and already shipped; the list records reality rather than changing it.Unused allowances were removed, so cargo-deny stays quiet and a genuinely new license surfaces as a failure rather than hiding among warnings.
Validation
Both checks run clean locally:
cargo deny check licenses→licenses ok(exit 0), and the npm checker exits 0 across the production tree.