Kevin Dangoor
3a2b68706a
There are many packages that are dual-licensed, offering a choice of licenses (e.g. `MIT OR Apache-2.0`). There are some that include code from multiple sources and require multiple licenses (e.g. `MIT AND Apache-2.0`). There are also complex combinations that can exist for a variety of reasons, such as `MIT AND (Apache-2.0 OR BSD-3-Clause)`. The most straightforward approach to handle these is to have an allow list. As long as the licenses on the allow list can satisfy the license expression of the package in question, it should pass. To implement this, I the newest release of spdx-satisfies which changed the interface to be exactly as described `satisfies(license, allowList)` (see https://github.com/jslicense/spdx-satisfies.js/pull/17). Fixes https://github.com/actions/dependency-review-action/issues/263
66 lines
1.9 KiB
JSON
66 lines
1.9 KiB
JSON
{
|
|
"name": "dependency-review-action",
|
|
"version": "4.6.0",
|
|
"private": true,
|
|
"description": "A GitHub Action for Dependency Review",
|
|
"main": "lib/main.js",
|
|
"scripts": {
|
|
"build": "tsc -p tsconfig.build.json",
|
|
"format": "prettier --write '**/*.ts'",
|
|
"format-check": "prettier --check '**/*.ts'",
|
|
"lint": "eslint src/**/*.ts",
|
|
"package": "ncc build --source-map --license licenses.txt",
|
|
"test": "jest",
|
|
"all": "npm run build && npm run format && npm run lint && npm run package && npm test"
|
|
},
|
|
"repository": {
|
|
"type": "git",
|
|
"url": "git+https://github.com/github/dependency-review-action.git"
|
|
},
|
|
"keywords": [
|
|
"actions",
|
|
"node",
|
|
"setup"
|
|
],
|
|
"author": "GitHub",
|
|
"license": "MIT",
|
|
"dependencies": {
|
|
"@actions/core": "^1.10.1",
|
|
"@actions/github": "^6.0.0",
|
|
"@octokit/plugin-retry": "^6.1.0",
|
|
"@octokit/request-error": "^5.1.1",
|
|
"@octokit/types": "12.5.0",
|
|
"@onebeyond/spdx-license-satisfies": "^1.0.1",
|
|
"ansi-styles": "^6.2.1",
|
|
"got": "^14.4.5",
|
|
"jest": "^29.7.0",
|
|
"octokit": "^3.1.2",
|
|
"spdx-expression-parse": "^3.0.1",
|
|
"spdx-satisfies": "^6.0.0",
|
|
"ts-jest": "^29.2.5",
|
|
"yaml": "^2.3.4",
|
|
"zod": "^3.24.1"
|
|
},
|
|
"devDependencies": {
|
|
"@types/jest": "^29.5.12",
|
|
"@types/node": "^20",
|
|
"@types/spdx-expression-parse": "^3.0.4",
|
|
"@types/spdx-satisfies": "^0.1.1",
|
|
"@typescript-eslint/eslint-plugin": "^6.21.0",
|
|
"@typescript-eslint/parser": "^6.21.0",
|
|
"@vercel/ncc": "^0.38.3",
|
|
"esbuild-register": "^3.6.0",
|
|
"eslint": "^8.57.0",
|
|
"eslint-plugin-github": "^4.10.2",
|
|
"eslint-plugin-jest": "^28.8.3",
|
|
"eslint-plugin-prettier": "^5.1.3",
|
|
"js-yaml": "^4.1.0",
|
|
"nodemon": "^3.1.9",
|
|
"prettier": "3.2.5",
|
|
"typescript": "^5.4.5"
|
|
},
|
|
"overrides": {
|
|
"cross-spawn": ">=7.0.5",
|
|
"@octokit/[email protected]": "5.1.1"
|
|
}
|
|
} |