Dependabot-core: Pull license data?

[JacobEvelyn]

There's a good chance that this doesn't make sense as a Dependabot feature, but here goes! 😃

I noticed that Snyk (which works slightly differently but I consider it in the same space as Dependabot) scans for dependency licenses to help ensure an organization uses licenses they know they comply with.

I can't really figure out a good way for Dependabot to add that sort of behavior, and it might be best if we just put something like Pivotal's LicenseFinder in our CI build and called it a day, but I just wanted to flag that some feature along these lines might make sense for Dependabot.

[greysteil]

Interesting, thanks @JacobEvelyn.

I was hoping some inspiration would come to me over the last week on this, but it hasn't. I'll continue chewing it over. We're about to overhaul the Dependabot dashboard, so there'll be a show pay for each repo that has details of all your dependencies. Appending license information to that show page, and telling you in the PR if the dependency's license has changed, seem like a good option to me.

[JacobEvelyn]

Yeah, I've chewed it over some more as well and it's just tricky to think about how this should work with Dependabot's model. But what you describe would be a great first version of this feature!

[michaelglass]

we use https://github.com/pivotal-legacy/LicenseFinder to the same end

[stale[bot]]

This issue has been automatically marked as stale because it has not had recent activity. It will be closed if no further activity occurs within seven days. Thank you for your contributions.

[infin8x]

Closing this as GitHub's Dependency Graph and Dependency Insights features are responsible for providing this data.