Skip to content
Merged
Show file tree
Hide file tree
Changes from all commits
Commits
File filter

Filter by extension

Filter by extension


Conversations
Failed to load comments.
Loading
Jump to
The table of contents is too big for display.
Diff view
Diff view
  •  
  •  
  •  
The diff you're trying to view is too large. We only load the first 3000 changed files.
13 changes: 8 additions & 5 deletions .github/workflows/licensed.yml
Original file line number Diff line number Diff line change
@@ -1,20 +1,23 @@
name: Licensed

on:
push: {branches: main}
pull_request: {branches: main}
push: {branches: [main]}
pull_request: {branches: [main]}

jobs:
test:
runs-on: ubuntu-latest
name: Check licenses
steps:
- uses: actions/checkout@v2
- uses: actions/checkout@v6
- uses: actions/setup-node@v6
with:
node-version: '24'
- run: npm ci
- name: Install licensed
run: |
cd $RUNNER_TEMP
curl -Lfs -o licensed.tar.gz https://github.com/github/licensed/releases/download/2.12.2/licensed-2.12.2-linux-x64.tar.gz
curl -Lfs -o licensed.tar.gz https://github.com/licensee/licensed/releases/download/3.9.1/licensed-3.9.1-linux-x64.tar.gz
sudo tar -xzf licensed.tar.gz
sudo mv licensed /usr/local/bin/licensed
Comment on lines +20 to 22

Copilot AI Apr 5, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This workflow downloads and installs an executable directly into /usr/local/bin without integrity verification, and it also switches the download source from github/licensed to licensee/licensed. To harden this, pin to a known canonical distribution source (or justify the fork), and add integrity checks (e.g., verify a published SHA256/SHA512) before extraction/execution to reduce supply-chain risk.

Copilot uses AI. Check for mistakes.
- run: licensed status
- run: licensed status
1 change: 1 addition & 0 deletions .licensed.yml
Original file line number Diff line number Diff line change
Expand Up @@ -10,6 +10,7 @@ allowed:
- cc0-1.0
- unlicense
- 0bsd
- other

Copilot AI Apr 5, 2026

Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Allowing the other license category broadly reduces the effectiveness of license enforcement (it can silently permit licenses that aren't actually approved). A more reliable approach is to keep allowed restricted to concrete SPDX identifiers and, for the specific dependencies marked other, fix their declared SPDX in .licenses/** (or add explicit reviewed entries) so each “other” is justified and auditable.

Suggested change
- other

Copilot uses AI. Check for mistakes.

reviewed:
npm:
Expand Down
6 changes: 3 additions & 3 deletions .licenses/npm/@actions/cache.dep.yml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

6 changes: 3 additions & 3 deletions .licenses/npm/@actions/core.dep.yml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

20 changes: 20 additions & 0 deletions .licenses/npm/@actions/exec.dep.yml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

20 changes: 20 additions & 0 deletions .licenses/npm/@actions/glob.dep.yml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

32 changes: 32 additions & 0 deletions .licenses/npm/@actions/http-client.dep.yml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

20 changes: 20 additions & 0 deletions .licenses/npm/@actions/io.dep.yml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

32 changes: 32 additions & 0 deletions .licenses/npm/@azure/abort-controller.dep.yml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

33 changes: 33 additions & 0 deletions .licenses/npm/@azure/core-auth.dep.yml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

32 changes: 32 additions & 0 deletions .licenses/npm/@azure/core-client.dep.yml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

32 changes: 32 additions & 0 deletions .licenses/npm/@azure/core-http-compat.dep.yml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

33 changes: 33 additions & 0 deletions .licenses/npm/@azure/core-lro.dep.yml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

32 changes: 32 additions & 0 deletions .licenses/npm/@azure/core-paging.dep.yml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

32 changes: 32 additions & 0 deletions .licenses/npm/@azure/core-rest-pipeline.dep.yml

Some generated files are not rendered by default. Learn more about how customized files appear on GitHub.

Loading