Skip to content

Verification · Supply chain · Dependency audit

License policy

Allow or deny dependencies by license.

How to build it

Write an allow list of licenses in the policy file.
Deny any dependency whose license is not on the list and fail the check.
Run the license check on every dependency change.

Signals in a repository

A deny.toml with a [licenses] section listing allowed licenses.
A dependency-review step configured with allowed or denied license values.

In practice

31 repositories run a tool for this check in the scanned set.

cargo-deny · 19 repos
dependency-review · 12 repos

Examples

axios/axios · dependency-review
```
uses actions/dependency-review-action
```
mermaid-js/mermaid · dependency-review
```
uses actions/dependency-review-action
```
home-assistant/core · dependency-review
```
uses actions/dependency-review-action
```
zed-industries/zed · dependency-review
```
uses actions/dependency-review-action
```

astral-sh/uv · cargo-deny

cargo deny --all-features check licenses