tophat / yarn-plugin-licenses

Audit your dependency licenses with this yarn berry plugin

yarn-plugin-licenses

Yarn Berry plugin to enforce valid licenses used in a project. Requires Yarn 4+.

Usage

Define a licenses.config.js file:

module.exports = {
    isValidLicense: (license) => {
        const valid = new RegExp('\\b(mit|apache\\b.*2|bsd|isc|unlicense)\\b', 'i')
        return valid.test(license)
    }
}

or

module.exports = {
    isValidLicense: new RegExp('\\b(mit|apache\\b.*2|bsd|isc|unlicense)\\b', 'i'),
    ignorePackages: ['react'],
}

or

module.exports = {
    isValidLicense: new RegExp('\\b(mit|apache\\b.*2|bsd|isc|unlicense)\\b', 'i'),
    // You can also provide a function for ignorePackages for more complex cases
    ignorePackages: (packageName, license) => packageName === 'scss-parser' && license === 'SEE LICENSE IN README',
}

and then:

yarn plugin import https://raw.githubusercontent.com/tophat/yarn-plugin-licenses/master/bundles/@yarnpkg/plugin-licenses-audit.js
yarn licenses audit --output-file=licenses.junit.xml --output-csv=licenses.csv --config=licenses.config.js --summary

this outputs a junit report to licenses.junit.xml, a CSV report to licenses.csv, and a summary of any violations to the console. You can omit some options to change which files are created or what is output, and if you pass - as a filename it will output to stdout instead of to a file.

You can use yarn licenses audit --summary for a human readable report for local dev.

By default license files are not traversed since there's no simple heuristic to parse the file, and developers often put custom wording inside. For this reason, if you would like to parse the license files, pass the --loose flag to the CLI.

Contributors

Noah 💻 🚇

Kurt von Laven 💻

Dobes Vandermeer 💻

Sarah 💻 🐛

To add a contributor to the README, signal the all-contributors bot by adding comments in your PRs like so:

@all-contributors please add <username> for <contribution type>