Handle unknown licenses.

src/licenses.ts

@@ -10,7 +10,7 @@ import {Change, ChangeSchema} from './schemas'
  * we will ignore the deny list.
  * @param {Change[]} changes The list of changes to filter.
  * @param { { allow?: string[], deny?: string[]}} licenses An object with `allow`/`deny` keys, each containing a list of licenses.
- * @returns {Array<Change} The list of denied changes.
+ * @returns {[Array<Change>, Array<Change]} A tuple where the first element is the list of denied changes and the second one is the list of changes with unknown licenses
  */
 export function getDeniedLicenseChanges(
   changes: Array<Change>,
@@ -18,15 +18,17 @@ export function getDeniedLicenseChanges(
     allow?: Array<string>
     deny?: Array<string>
   }
-): Array<Change> {
+): [Array<Change>, Array<Change>] {
   let {allow, deny} = licenses
 
   let disallowed: Change[] = []
+  let unknown: Change[] = []
 
   for (const change of changes) {
     let license = change.license
     // TODO: be loud about unknown licenses
     if (license === null) {
+      unknown.push(change)
       continue
     }
     if (allow !== undefined) {
@@ -40,5 +42,5 @@ export function getDeniedLicenseChanges(
     }
   }
 
-  return disallowed
+  return [disallowed, unknown]
 }

src/main.ts

@@ -36,14 +36,6 @@ async function run(): Promise<void> {
       deny: config.deny_licenses
     }
 
-    let licenseErrors = getDeniedLicenseChanges(changes, licenses)
-
-    if (licenseErrors.length > 0) {
-      printLicensesError(licenseErrors, licenses)
-      core.setFailed('Dependency review detected incompatible licenses.')
-      return
-    }
-
     let filteredChanges = filterChangesBySeverity(
       minSeverity as Severity,
       changes
@@ -60,8 +52,19 @@ async function run(): Promise<void> {
       }
     }
 
+    let [licenseErrors, unknownLicenses] = getDeniedLicenseChanges(
+      changes,
+      licenses
+    )
+
+    if (licenseErrors.length > 0) {
+      printLicensesError(licenseErrors, licenses)
+      printNullLicenses(unknownLicenses)
+      core.setFailed('Dependency review detected incompatible licenses.')
+    }
+
     if (failed) {
-      throw new Error('Dependency review detected vulnerable packages.')
+      core.setFailed('Dependency review detected vulnerable packages.')
     } else {
       core.info(
         `Dependency review did not detect any vulnerable packages with severity level "${minSeverity}" or higher.`
@@ -126,7 +129,7 @@ function printLicensesError(
 
   let {allow = [], deny = []} = licenses
 
-  core.info('The following dependencies have incompatible licenses:\n')
+  core.info('\nThe following dependencies have incompatible licenses:\n')
   for (const change of changes) {
     core.info(
       `${styles.bold.open}${change.manifest} » ${change.name}@${change.version}${styles.bold.close} – License: ${styles.color.red.open}${change.license}${styles.color.red.close}`
@@ -134,4 +137,13 @@ function printLicensesError(
   }
 }
 
+function printNullLicenses(changes: Array<Change>): void {
+  core.info('\nWe could not detect a license for the following dependencies:\n')
+  for (const change of changes) {
+    core.info(
+      `${styles.bold.open}${change.manifest} » ${change.name}@${change.version}${styles.bold.close}`
+    )
+  }
+}
+
 run()