[Feature Request] Add a flag to handle Unknown licenses

[jcasner]

Because it is so difficult to build and maintain a database of all licenses for all packages, it would be great if there were some options for what to do when a package with an unknown license is added.

Option 1: Comment on the PR so someone at least gets a heads up to double check the license manually

Option 2: Allow the option to explicitly deny packages with unknown licenses.

• Note - we'd probably need to also add a feature to explicitly allow specific packages in this situation...

I'm open to other options, too :)

Thanks

[febuiles]

More details about unknown licenses in #182 (comment)

[febuiles]

@jcasner I'm currently working on improving the license support to get much more complete coverage of projects hosted in GitHub/supported by GitHub's Licenses API. Your second proposal sounds reasonable even with better license coverage, so I think we can do something about this soon.

The packages allowlist sounds like a "nice to have", but not mandatory in order to block PRs on null licenses. Is this a "someone could want" feature, or would it affect you if we only shipped what's outlined in your "Option 2"?

[febuiles]

PR in progress here.

[febuiles]

@jcasner we've improved license detection following the approach outlined above. We are also reporting unknown licenses in the output, I hope this helps. Closing this issue, please re-open if needed.

[wmmc88]

I think a flag to explicitly deny unknown licenses is still warranted.

The following run fails to be able to detect the license of anstyle:
https://github.com/wmmc88/windows-drivers-rs/actions/runs/7632001216/job/20791223328?pr=18

I am unsure why this is the case since the license is available here.

In any case, I still think there should be a wail to fail the job if unknown license is encountered. There are situations where you wont catch this in PR comments (ex. if triggered on push, or if triggered on PR from a fork)

[febuiles]

@wmmc88 Thanks for your input. Do you mind creating a new issue for your Cargo runs so the problem doesn't get lost in the comments here?

[wmmc88]

@wmmc88 Thanks for your input. Do you mind creating a new issue for your Cargo runs so the problem doesn't get lost in the comments here?

@febuiles created new issue to track: #672