From 2c07404717cef9916dd19fea3d1b59d0ca3939f5 Mon Sep 17 00:00:00 2001 From: AndreasIgel Date: Sat, 12 Sep 2026 18:13:37 +0200 Subject: [PATCH] Allow LGPL-3.0 for sonarqube-scan-action in dependency review MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit The action only executes the scanner on the runner — use of an unmodified tool, not distribution — so LGPL obligations do not apply. Scope the exception via allow-dependencies-licenses so the fail-closed allow-licenses list stays strict for all other dependencies. Generated with [Devin](https://devin.ai) Co-Authored-By: Devin <158243242+devin-ai-integration[bot]@users.noreply.github.com> --- .github/workflows/dependency-review.yml | 8 ++++++++ 1 file changed, 8 insertions(+) diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 32005331..06fac0c8 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -68,3 +68,11 @@ jobs: # Fail closed with licenses derived from the project's full dependency tree, # replacing the deprecated deny-licenses option. allow-licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, EPL-1.0, EPL-2.0, CDDL-1.0, CDDL-1.1, ISC, Unlicense, CC0-1.0 + # Per-dependency exception to the allowlist above: sonarqube-scan-action + # (used in fork-sonar.yml) is LGPL-3.0. The action only executes the + # scanner on the runner — use of an unmodified tool, not distribution + # or a derivative work — so LGPL obligations do not apply. The purl is + # deliberately version-less: dependency-review-action's matcher ignores + # the version anyway, and it is the usage as a CI action that makes the + # license unproblematic, independent of the pinned revision. + allow-dependencies-licenses: 'pkg:githubactions/SonarSource/sonarqube-scan-action'