Check License Compliance

What Check License Compliance is

Check License Compliance is a free, Apache-2.0-licensed open-source GitHub Action for checking repository dependencies against license policies. It supports Node.js packages from NPM, Python packages from PyPI, Maven, and Go. The action reads manifest files and recursively retrieves dependency trees through the deps.dev API, so packages do not need to be installed first. Policies can allow, forbid, or warn on licenses, with configurable handling for other or unknown licenses. Configuration comes from YAML, action inputs, or both, and can select or exclude dependencies and files. It runs in GitHub Actions workflows, while a composite action can post results as pull-request comments. Reports are available as text, Markdown, or JSON, including noncompliant dependencies, installation paths, and licenses. Deployment uses a Docker image defined by the repository’s Dockerfile. License expressions using AND or OR are unsupported; simple SPDX identifiers, plus-ranges, and exceptions are supported. The stated platforms are Linux and self-hosted, with on-premise deployment.