Licenses

Check the licenses of your dependencies and enforce compliance policies.

Basic usage

git pkgs licenses               # show license for each dependency
git pkgs licenses --group       # group output by license

Compliance checking

Flag copyleft licenses:

git pkgs licenses --permissive

Use an explicit allow list:

git pkgs licenses --allow=MIT,Apache-2.0,BSD-2-Clause,BSD-3-Clause,ISC

The command exits with code 1 if any dependency has a license not in the allow list, making it suitable for CI.

CI example

name: License Check
on: pull_request

jobs:
  licenses:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v7
        with:
          fetch-depth: 0

      - uses: git-pkgs/actions/setup@v1

      - name: Check licenses
        run: git-pkgs licenses --allow=MIT,Apache-2.0,BSD-2-Clause,BSD-3-Clause,ISC

Options

    --allow=LIST        Comma-separated list of allowed SPDX identifiers
    --permissive        Flag copyleft licenses (GPL, AGPL, etc.)
    --group             Group output by license instead of by package
-e, --ecosystem=NAME    Filter by ecosystem
-f, --format=FORMAT     Output format (text, json)

Data source

License information is fetched from package registries via ecosyste.ms. Results are cached locally.

Vulnerabilities Outdated