Skip to content

How a scan works#

How licenseal works, in four steps. Read: manifests and lockfiles. Resolve: the whole dependency tree. Classify: each license against yours. Report: a verdict CI can gate on. No dependency installs, no builds, no package downloads.

  1. Read. licenseal finds the manifests and lockfiles under the scanned directory: see What is scanned. The files it reads are listed for each ecosystem. It runs no package manager.
  2. Resolve. A lockfile gives the dependency tree as it is installed. Where no lockfile covers a dependency, licenseal walks the registry and marks the versions it picks as estimates. See Dependency resolution and Versions and estimates. A dependency that comes from a git repository, a URL, or a path is an off-registry dependency.
  3. Classify. A package's license is read from public registry metadata, or from composer.lock for a locked PHP package. It is read as a license expression, given a risk level, and compared with the project license. See How licenseal decides.
  4. Report. The result is a table, a Markdown file, or JSON, and an exit code that CI can gate on. See What fails a check.

Nothing is installed or built, and no package archive is downloaded. Every host that is contacted is listed under Network egress, and what is sent to it under What leaves the process.