Dependency Graph is a GitHub Repository feature that builds a detailed mapping of the manifest and lock files stored in the repository. Exploring the dependencies with Dependency Graph.
The Dependency Graph includes open source license information for your dependencies via the GitHub API (Example GraphQL Query).
Dependency Graph also supports exporting a software bill of materials (SBOM) for your repository which includes license data.
- The Policy as Code (PaC) GitHub Action (Marketplace Listing) written by a member of the GitHub Advanced Security team aggregates GitHub API endpoints for Code Scanning, Secret Scanning and Dependabot Security. One if it's features allows you to define License usage compliance requirements within a "Policy as Code" config file (yaml) in your repository. These compliance requirements are run as a GitHub Action "Check" on pushes/PRs or any other trigger defined in your PaC workflow file.
-
The Generate Dependency Data File GitHub Marketplace Action generates a csv file that contains a list of the dependencies detected for each of the specified repos. This includes license information.
-
The gh-dependency-report is a GitHub CLI extension for generating a report on repository dependencies.
One item the Dependency Graph tracks is license usage of the open source dependencies in a repository. This means the license usage for the entire organization can be viewed/filtered in Dependency Insights.
The GitHub Dependency Review Action is an automated pull request check that allows you to configure open source dependency license policies via allow-licenses to permit or deny-licenses to reject.