Ecosyste.ms: Awesome

An open API service indexing awesome lists of open source software.

Awesome Lists | Featured Topics | Projects

https://github.com/jpfulton/java-license-auditor-cli


https://github.com/jpfulton/java-license-auditor-cli

Last synced: 4 days ago
JSON representation

Awesome Lists containing this project

README 

        
# java-license-auditor-cli



[![ci](https://github.com/jpfulton/java-license-auditor-cli/actions/workflows/ci.yml/badge.svg)](https://github.com/jpfulton/java-license-auditor-cli/actions/workflows/ci.yml)

[![npm version](https://badge.fury.io/js/%40jpfulton%2Fjava-license-auditor-cli.svg)](https://www.npmjs.com/package/@jpfulton/java-license-auditor-cli)

![License](https://img.shields.io/badge/License-MIT-blue)

![Visitors](https://visitor-badge.laobi.icu/badge?page_id=jpfulton.java-license-auditor-cli)



A CLI designed to list and audit licenses in project dependencies in Java projects. The CLI

can output both markdown reports and CSV files and is designed to run in CI workflows.

Included in the package is a [DangerJS](https://danger.systems/js) plugin that can be

used to audit licenses in the PR process.



In current state, only Java projects using Maven or Gradle are supported.



## Installation of the CLI



You can install this tool globally, using the following yarn command:



```bash

yarn global add @jpfulton/java-license-auditor-cli

```



## Local Configuration



To override the default configuration, which is extremely minimal, place a `.license-checker.json` file in the

root directory of your project with the following format:



```json

{

  "blackList": ["blacklisted-license"],

  "whiteList": ["whitelisted-license"]

}

```



Licenses in the blackList array will generate errors in the report. Licenses in the

whiteList array will generate information lines and licenses types that exist in neither

array generate warnings for further investigation.



## Remote Configurations



Remote configurations can be used to override the default configuration. To use a remote

configuration, specify the URL to the configuration file using the `--remote-config` flag.

Remote configurations are useful when applying the same configuration to multiple projects

to avoid the need to copy the configuration file to each project and maintain the configurations

in multiple places.



```bash

java-license-auditor-cli csv --remote-config https://raw.githubusercontent.com/jpfulton/node-license-auditor-cli/main/.license-checker.json . > report.csv

```



```bash

java-license-auditor-cli markdown --remote-config https://raw.githubusercontent.com/jpfulton/node-license-auditor-cli/main/.license-checker.json . > report.md

```



## Usage as a DangerJS Plugin



This project can be used as a [DangerJS](https://danger.systems/js/) plugin. To use the

plugin, install the plugin using the following command:



```bash

yarn add -D danger @jpfulton/java-license-auditor-cli

```



Then, add the following to your `dangerfile.ts`:



```typescript

import { javaLicenseAuditor } from "@jpfulton/java-license-auditor-cli";



export default async () => {

  // Run the license auditor plugin

  await licenseAuditor({

    // optionally choose to fail the build if a blacklisted license is found

    failOnBlacklistedLicense: false,

    // specify the path to the project's package.json file, useful in a monorepo

    // defaults to the current working directory

    projectPath: ".",

    // optionally specify a remote configuration file

    // useful when applying the same configuration to multiple projects

    // defaults to usage of a local configuration file found at the root of the project repo

    remoteConfigurationUrl:

      "https://raw.githubusercontent.com/jpfulton/jpfulton-license-audits/main/.license-checker.json",

    // show a summary of the license audit in the PR comment

    // includes the number of unique dependencies and counts for each category of license found

    showMarkdownSummary: true,

    // show details of the license audit in the PR comment

    // includes a table with the name, version and license of each dependency

    // that was discovered that was not explicitly whitelisted in the configuration

    showMarkdownDetails: true,

  });

};

```



## Layering this Project over Maven and Gradle Java Projects



Both Maven and Gradle have the ability to generate a dependency tree for a project. In the

case of Maven, a license report can be generated using a default Maven plugin:

[project-info-reports:dependencies](https://maven.apache.org/plugins/maven-project-info-reports-plugin/dependencies-mojo.html). In the case of Gradle, a license report can be generated using a third-party plugin: [com.github.jk1.dependency-license-report](https://github.com/jk1/Gradle-License-Report/).



This project is designed to be layered over the results of the reports generated by those plugins.

The advantage of this project and its use with the [jpfulton/danger-js-action](https://github.com/jpfulton/danger-js-action/)

project is that it can be used to centralize the license audit process across multiple projects

and languages. Additionally, it brings the audit project into the PR review process in an automated

and ongoing way.



### Usage with Maven



To use this project with Maven, first generate a dependency license report using the following command:



```bash

mvn project-info-reports:dependencies

```



The utilize the CLI functionality of the project or the DangerJS plugin to audit the licenses.



### Usage with Gradle



To use this project with Gradle, first integrate the [com.github.jk1.dependency-license-report](https://github.com/jk1/Gradle-License-Report/) into your project. Then, generate a dependency license report using the following command:



```bash

./gradlew generateLicenseReport

```



The Gradle-License-Report plugin needs to be configured to use its `JsonReportRenderer` to generate the report in JSON format. The following is an example Groovy configuration:



```groovy

licenseReport {

    outputDir = file("$buildDir/build/licenses")

    renderers = [new JsonReportRenderer('licenses.json')]

}

```



In current state, this project will look for the `licenses.json` file in the following

locations:



- `build/licenses/licenses.json`

- `licenses/licenses.json`



Then, utilize the CLI functionality of the project or the DangerJS plugin to audit the licenses.