---
url: /en/security/sca-license.md
description: >
  Usage of the License Scan plugin (cnbcool/sca-license), including parameters,
  the LicenseRisk gate, log output, and incremental rules.
---
The License Scan plugin compares the dependency changes of a Pull Request and
reports only the License risks it newly introduces. It gates on LicenseRisk severity — when a finding
matches, the check fails.

## Features

* **Incremental License scanning**: checks only the License risks newly introduced by the current PR;
* **Component License detection**: identifies the License Expression of dependencies;
* **Risk gate**: can fail on `low`, `medium`, or `high`.

## Plugin image

```text
cnbcool/sca-license:latest
```

## Parameters

Plugin parameters are passed through `settings`:

| Parameter | Description | Default |
|---|---|---|
| `failOnSeverity` | Minimum License risk severity that blocks the check: `low`, `medium`, or `high`. If unset, findings are reported without applying a gate | none |

## Usage in CNB

```yaml title=".cnb.yml"
main:
  pull_request:
    - stages:
        - name: License Scan
          image: cnbcool/sca-license:latest
          settings:
            failOnSeverity: high
```

The configuration above fails the check when the PR introduces a High License risk.

### Scan without blocking

Omit `failOnSeverity` to report new License risks without applying a severity gate:

```yaml title=".cnb.yml"
main:
  pull_request:
    - stages:
        - name: License Scan
          image: cnbcool/sca-license:latest
```

## Output

The plugin prints new License risks directly to the CI log:

```text
service/pom.xml: HIGH GPL-3.0-only
  component: example:library@2.0.0
  license: GPL-3.0-only
  message: component uses GPL-3.0-only

SCA gate failed: 1 new risk findings, 1 matched gate
```

## Incremental rules

* A component whose version changed but whose License Expression is unchanged is not blocked again;
* A new component or a new License Expression forms a new risk;
* A License risk that already exists on Base is not blocked again in the current PR.

## Exit codes

| Exit code | Description |
|---:|---|
| `0` | Scan completed and no new License risk matched the gate |
| `1` | A new License risk matched the gate |
| `2` | Configuration error or scan failure |

## Next steps

* [Overview](./sca-plugins.md) — overall configuration and gates for the three plugins
* [Open-Source Component Vulnerability Scan](./sca-vulnerability.md) — vulnerability gate and incremental rules
* [SBOM Generation](./sca-sbom.md) — component change list