Skip to main content

License Check

At VGV, we keep track of the rights and restrictions external dependencies might impose on Dart or Flutter projects.

info

The License Check functionality is powered by Very Good CLI's license checker, for a deeper understanding of some inputs refer to its documentation.

Steps​

The License Check workflow consists of the following steps:

  1. Setup Dart or Flutter
  2. Set SSH Key (if provided)
  3. Install project dependencies
  4. Check licenses

Inputs​

working_directory​

Optional The path to the root of the Dart or Flutter package.

Default "."

runs_on​

Optional An optional operating system on which to run the workflow.

Default "ubuntu-latest"

dart_sdk​

Optional Which Dart SDK version to use. It can be a version (e.g. 3.5.0) or a channel (e.g. stable). Ignored when flutter_version is set.

Default "stable"

flutter_channel​

Optional The Flutter channel to use (e.g. stable, beta). Only used when flutter_version is set.

Default "stable"

flutter_version​

Optional Which Flutter SDK version to use. When set, Flutter is used instead of Dart to install dependencies. It can be a version (e.g. 3.24.0) or a version constraint (e.g. 3.24.x).

Default ""

flutter_version_file​

Optional Path to a file that holds the Flutter version to use, such as pubspec.yaml or .fvmrc, resolved from the repository root rather than working_directory. This lets you keep a single source of truth for the Flutter version. When set, the workflow uses Flutter instead of Dart to install dependencies.

caution

flutter_version_file and flutter_version are mutually exclusive. Setting both fails the job with Cannot specify both a version and a version file.

Files other than .fvmrc and fvm_config.json (such as pubspec.yaml) are parsed with yq, which Windows runners don't provide. On Windows, use .fvmrc or fvm_config.json.

Default ""

allowed​

Optional Only allow the use of certain licenses. The expected format is a comma-separated list.

Default "MIT,BSD-3-Clause,BSD-2-Clause,Apache-2.0"

forbidden​

Optional Deny the use of certain licenses. The expected format is a comma-separated list.

Default ""

warning

The allowed and forbidden options can't be used at the same time. If you want to use forbidden set allowed to an empty string.

skip_packages​

Optional Skip packages from having their licenses checked.

Default ""

dependency_type​

Optional The type of dependencies to check licenses for.

Default "direct-main,transitive"

ignore_retrieval_failures​

Optional Disregard licenses that failed to be retrieved.

Default false

Secrets​

ssh_key​

Optional An SSH key to use for setting up the credentials for fetching dependencies that are not publicly available.

Example Usage​

name: license_check

concurrency:
  group: ${{ github.workflow }}-${{ github.ref }}
  cancel-in-progress: true

on:
  pull_request:
    paths:
      - 'pubspec.yaml'
      - '.github/workflows/license_check.yaml'
  push:
    branches:
      - main
    paths:
      - 'pubspec.yaml'
      - '.github/workflows/license_check.yaml'

jobs:
  license_check:
    uses: VeryGoodOpenSource/very_good_workflows/.github/workflows/license_check.yml@v1
    with:
      allowed: 'MIT,BSD-3-Clause,BSD-2-Clause,Apache-2.0'

The example workflow file will trigger the license_check job on every push to the main branch and on every pull request that modifies the pubspec.yaml or the license_check.yaml workflow file.

If you are committing the pubspec.lock file for an application package you may consider adding it to the list of paths to trigger the workflow.

tip

For repositories with multiple packages we recommend adding a workflow file per package to avoid triggering a license check for packages which dependencies haven't been modified.