license.yml

name: 'License Check'
on: [pull_request]

permissions:
  contents: read

jobs:
  dependency-review:
    runs-on: ubuntu-latest
    steps:
      - name: 'Checkout Repository'
        uses: actions/checkout@v4
      - name: 'Dependency Review'
        uses: actions/dependency-review-action@v4
        with:
          vulnerability-check: false
          license-check: true
          # Incompatible licenses addressed here: https://www.apache.org/legal/resolved.html
          # Special notice for GPL licenses: https://www.apache.org/licenses/GPL-compatibility.html
          # Find SPDX identifiers here: https://spdx.org/licenses/
          deny-licenses: >
            MS-LPL, BUSL-1.1,
            CC-BY-NC-1.0, CC-BY-NC-2.0, CC-BY-NC-2.5, CC-BY-NC-3.0, CC-BY-NC-4.0,
            GPL-1.0, GPL-2.0, GPL-3.0, AGPL-3.0, LGPL-2.0, LGPL-2.1, LGPL-3.0,
            GPL-1.0-only, GPL-2.0-only, GPL-3.0-only, AGPL-3.0-only, LGPL-2.0-only, LGPL-2.1-only, LGPL-3.0-only,
            QPL-1.0, Sleepycat, SSPL-1.0, CPOL-1.02,
            BSD-4-Clause, BSD-4-Clause-UC, NPL-1.0, NPL-1.1, JSON
          # Artifacts with multiple licenses, where at least one license is compatible with Apache 2.0, are allowed.
          allow-dependencies-licenses: >
            pkg:maven/com.rabbitmq/amqp-client,
            pkg:maven/ch.qos.logback/logback-classic, pkg:maven/ch.qos.logback/logback-core,
            pkg:maven/javax.xml.stream/stax-api