License Scan

About 341 wordsAbout 1 min

The License Scan plugin compares the dependency changes of a Pull Request and reports only the License risks it newly introduces. It gates on LicenseRisk severity — when a finding matches, the check fails.

Features

Incremental License scanning: checks only the License risks newly introduced by the current PR;
Component License detection: identifies the License Expression of dependencies;
Risk gate: can fail on low, medium, or high.

Plugin image

cnbcool/sca-license:latest

Parameters

Plugin parameters are passed through settings:

Parameter	Description	Default
`failOnSeverity`	Minimum License risk severity that blocks the check: `low`, `medium`, or `high`. If unset, findings are reported without applying a gate	none

Usage in CNB

.cnb.yml
main:
  pull_request:
    - stages:
        - name: License Scan
          image: cnbcool/sca-license:latest
          settings:
            failOnSeverity: high

The configuration above fails the check when the PR introduces a High License risk.

Scan without blocking

Omit failOnSeverity to report new License risks without applying a severity gate:

.cnb.yml
main:
  pull_request:
    - stages:
        - name: License Scan
          image: cnbcool/sca-license:latest

Output

The plugin prints new License risks directly to the CI log:

service/pom.xml: HIGH GPL-3.0-only
  component: example:library@2.0.0
  license: GPL-3.0-only
  message: component uses GPL-3.0-only

SCA gate failed: 1 new risk findings, 1 matched gate

Incremental rules

A component whose version changed but whose License Expression is unchanged is not blocked again;
A new component or a new License Expression forms a new risk;
A License risk that already exists on Base is not blocked again in the current PR.

Exit codes

Exit code	Description
`0`	Scan completed and no new License risk matched the gate
`1`	A new License risk matched the gate
`2`	Configuration error or scan failure

Next steps

Overview — overall configuration and gates for the three plugins
Open-Source Component Vulnerability Scan — vulnerability gate and incremental rules
SBOM Generation — component change list