license-compliance-auditor

License compliance auditing is the process of validating a project's dependency graph against an approved license whitelist. It checks direct and transitive dependencies to prevent accidental inclusion of restricted licenses, ensuring software projects remain legally compliant during onboarding, CI gates, or release audits.

You can audit transitive dependencies for restricted licenses by running an automated check with your project path, allowed licenses list, and specified ecosystem. The validator scans the dependency graph, identifies packages violating the whitelist, and outputs a structured compliance report detailing all status and violations.

Yes, the license compliance auditor supports Python and Go ecosystems alongside npm, cargo, and maven. You specify the ecosystem when running the audit, and the validator checks your dependency manifests against the approved license whitelist to generate a structured compliance report.

To generate a license compliance report, you need to provide the project path and a list of allowed licenses. You also specify the package ecosystem, such as npm or pip, so the validator can accurately parse manifests, check transitive dependencies against the whitelist, and output a structured compliance report.

Yes, you can enforce SPDX license whitelists in pull request pipelines by integrating this validation into your CI gates. By checking direct and transitive dependencies against approved SPDX identifiers, it blocks restricted licenses from merging and outputs a compliance report detailing any violations.