Configuring a license policy as code in SourceCraft

In SourceCraft, the dependency license management policy can be coded (Policy as Code) using the .sourcecraft/security/licenses.yaml configuration file. The platform automatically checks the licenses of all repository dependencies and flags those with risk level exceeding the allowed threshold. For more on vulnerability analysis, see Analyzing vulnerabilities in SourceCraft repository dependencies.

Example of a SourceCraft repository with a license policy

To configure a license policy as code:

  1. Enable dependency vulnerability analysis in the repository.

  2. Create a file named .sourcecraft/security/licenses.yaml with the following contents in the repository:

    version: 0.0.1
licenses:
  MIT:
    risk: 0
  ISC:
    risk: 5
  BSD-3-Clause:
    risk: 10

    Where:

    • version: Configuration schema version. Current version: 0.0.1.
    • licenses: Dictionary of licenses and their risk levels.
    • risk: Integer value representing the risk level from 0 to 10.
      • 0-2: License is completely acceptable.
      • 3-6: License requires attention.
      • 7-9: License is undesirable.
      • 10: License is prohibited.

    Tip

    In addition to a repository-level license policy, you can configure a policy for an organization. Proceed as follows:

    1. Create a dedicated repository named .sourcecraft in your organization.
    2. In a similar way, add the .sourcecraft/security/licenses.yaml file with the policy description to the repository.

    When analyzing vulnerabilities, the policy configured for the target repository takes priority. If no .sourcecraft/security/licenses.yaml file exists in the target repository, the policy from the .sourcecraft repository applies. If there is no such policy either, the default SourceCraft global configuration is used.

  3. To save your changes:

    1. In the top-right corner, click Commit changes.

    2. In the window that opens, configure the procedure for changes:

      • In the Commit message field, give a comment that will describe the changes you make.
      • Under Commit branch, select the branch you want to change. Create a new branch as needed.
      • Under After commit action, select an action to take after saving changes: Save and create a new change proposal or Just save.

    3. Confirm your changes.

Test the policy

You can test dependency license policies as follows:

  1. On each commit to the default branch, SourceCraft scans the repository for vulnerabilities.
  2. For each vulnerability, SourceCraft detects its license.
  3. The license is evaluated against the configuration in the following order: target repository policy → .sourcecraft repository policy → SourceCraft global policy.
  4. If the license’s risk level exceeds the allowed threshold, the dependency is flagged in the Security section of the repository or organization on the Packages and Dependency map tabs.

For more information, see Analyzing vulnerabilities in SourceCraft repository dependencies.

Useful links

Previous
Analyzing dependencies
Next
Scan history