Add license compatibility checking #23

Merged

coding-agent-marvin8 merged 0 commits from refs/pull/23/head into main

2026-06-07 06:25:07 +00:00

coding-agent-marvin8 commented

2026-06-07 03:03:25 +00:00

(Migrated from codeberg.org)

Summary

Adds opt-in license compliance checking via --check-licenses / check-licenses = true
Auto-derives the allowed license set from project.license (SPDX tiers) or accepts an explicit allowed-licenses list
Handles UNKNOWN licenses with configurable unknown-license = warn|fail|allow (default: warn)
Per-package exemptions via license-ignore with mandatory reason field
New licenses.py module: SPDX tier frozensets, extraction (PEP 639 → classifiers → free text), inference, and is_license_allowed
License stored in cache alongside version/vulns — zero extra HTTP requests
⚖️ inline badge on violations; License Violations block at end of report
JSON output gains license and license_status fields
Full docs: new license-checking.md guide, updated command reference, basic usage, and README

Closes #22

## Summary - Adds opt-in license compliance checking via `--check-licenses` / `check-licenses = true` - Auto-derives the allowed license set from `project.license` (SPDX tiers) or accepts an explicit `allowed-licenses` list - Handles UNKNOWN licenses with configurable `unknown-license = warn|fail|allow` (default: `warn`) - Per-package exemptions via `license-ignore` with mandatory `reason` field - New `licenses.py` module: SPDX tier frozensets, extraction (PEP 639 → classifiers → free text), inference, and `is_license_allowed` - License stored in cache alongside version/vulns — zero extra HTTP requests - ⚖️ inline badge on violations; License Violations block at end of report - JSON output gains `license` and `license_status` fields - Full docs: new `license-checking.md` guide, updated command reference, basic usage, and README Closes #22