License audit

Enable License audit

To enable License audit, add these lines to the qodana.yaml file in your project root:

include:
  - name: CheckDependencyLicenses

Ignore dependencies

For some reasons, you may need to ignore a specific dependency in your project, which can be specified in qodana.yaml:

dependencyIgnores:
  - name: "dependency/name"

Allow or prohibit dependency licenses

You can override the license matrix and specify the list of dependency licenses that are allowed or prohibited for a specific project license.

In this snippet, the keys key accepts application licenses, and the allowed and prohibited keys accept the lists of allowed and prohibited dependency licenses respectively. As a result, the AGPL-3.0-only becomes compatible with the AFL-2.0 project license, while the Apache-1.0 dependency license becomes incompatible.

licenseRules:
  - keys:
      - "AFL-2.0"
    allowed:
      - "AGPL-3.0-only"
    prohibited:
      - "Apache-1.0"

tip

All keys from this sample can accept several values.

Override a dependency license

You can override a dependency license identifier. This can be useful when a dependency is dual-licensed and you want to omit some license, or when the license name cannot be detected from the dependency sources correctly.

Using this sample, Qodana will detect only the CDDL-1.1 and GPL-2.0-with-classpath-exception licenses for jaxb-runtime version 2.3.1.

dependencyOverrides:
  - name: "jaxb-runtime"
    version: "2.3.1"
    url: "https://github.com/javaee/jaxb-v2"
    licenses:
      - key: "CDDL-1.1"
        url: "https://github.com/javaee/jaxb-v2/blob/master/LICENSE"
      - key: "GPL-2.0-with-classpath-exception"
        url: "https://github.com/javaee/jaxb-v2/blob/master/LICENSE"

Create custom dependencies

If you want to include the dependency that should be mentioned in the report but is impossible to detect from the project sources, you can use the customDependencies key to specify it:

customDependencies:
  - name: ".babelrc JSON Schema (.babelrc-schema.json)"
    version: "JSON schema for Babel 6+ configuration files"
    licenses:
      - key: "Apache-2.0"
        url: "https://github.com/SchemaStore/schemastore/blob/master/LICENSE"