Hi all, I like to propose adding a CI check for Category X transitive dependencies for Fineract.
At present, there is no check in the build that catches this. A Category X license could be introduced transitively through an otherwise unrelated dependency bump and remain unnoticed until a release audit. Or even direct dependency license changes [One example i recall is at the time of liquibase where they changes their license on the new release] and sometime needs manual reviews What's already in place, and why it doesn't cover this: - Apache RAT (./gradlew rat) already runs in CI, but RAT checks whether our own source files have the correct Apache license headers. It does not audit dependency licenses, including transitive dependencies, so it is not a substitute for dependency license compliance checking. - CycloneDX is already applied at the root of build.gradle and generates a complete SBOM. However, nothing currently consumes the SBOM to enforce license policy. This would involve generating an SBOM for the `develop` branch and for the PR head, then comparing the changes to flag any dependency using a license that requires review. [This will also keep the existing dependencies as it is but will flag for new changes] I'd like to gather feedback and reach consensus on the approach before starting implementation. Please share your thoughts, concerns, or objections. Once there is rough agreement, I'll follow up with a JIRA ticket to track the implementation. Thanks and Regards Aman
