jaredsburrows/gradle-license-plugin

Idea for a new task to check found licenses against list of allowed licenses

Open

#189 opened on Apr 14, 2022

View on GitHub
 (2 comments) (0 reactions) (0 assignees)Groovy (440 stars) (70 forks)batch import
help wanted

Description

Motivation Certain licenses of project dependencies might be allowed and others not. A gradle task could automate the check if there are dependencies with licenses which are not allowed.

Specification There is a plugin configuration that allows specifying a file name for the list of allowed licenses. When the new task is run, the file is read and licenses are collected as usual. If all licenses found are listed in the file, the task succeeds. If at least one licenses is found that is not in the file, the task fails. Problematic licenses and the dependencies using them are reported via file output and command line.

Contributor guide

Tech stack
groovy
Domain
tooling
Issue type
feature
DifficultyEstimated implementation difficulty for a new contributor, from 1 for very small changes to 5 for expert-level work.
3
Estimated timeA rough time range for an experienced contributor to investigate, implement, test, and prepare a pull request.
1-3 hours
Activity statusHow available the issue appears right now: fresh, active, stale, blocked, or waiting on maintainer input.
fresh
ClarityHow clearly the issue explains the expected change, acceptance criteria, and next step.
mostly clear
Prerequisites
Gradle plugin developmentGroovy
Newbie friendlinessA 1-100 score estimating how approachable this issue is for first-time contributors.
45
Research direction
Review the existing license collection code in the plugin, likely in a task or extension class. Understand how licenses are currently gathered and reported. Then implement a new task that reads an allowed licenses file (e.g., allowed licenses.txt), collects all found licenses, and compares them against the allowed list. The task should fail if any license is not allowed, and output the problematic licenses and their dependencies to a file and console. Consider using the existing reporting infrastructure for consistency.