Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

feat: Github fallback for empty PURL for license exclusion #848

Open
wants to merge 2 commits into
base: main
Choose a base branch
from

Conversation

jscaltreto
Copy link

The action uses the change's package_url (as returned from the dependency graph API) to match against the exclusions passed via allow-dependencies-licenses. However, some changes do not include package_url, but they can still result in the action failing a license check as the check itself doesn't rely on package_url. Currently there's no mechanism in place to exclude a dependency from the license check if the package_url is empty.

This adds a fallback mechanism that parses source_repository_url to attempt to match based on the repository name. So allow-dependencies-licenses could include, for example, pkg:github/owner/repo and that would match a change with source_repository_url: "https://github.com/owner/repo".

This doesn't cover all cases; if source_repository_url is empty or doesn't point to a github-hosted repository then it will still fail to match.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

1 participant