license_patrol 1.0.0 → 1.2.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 6d2e13b85fa48187c33aa76ef484cbdf3022e10551286d94ad79e5e53811d6a2
-  data.tar.gz: d763c2015d71fa8f20ba67258151e013886ed057c6a4c1c8e1831ec27f43106c
+  metadata.gz: bfadea16931d270ad27f48e5db7d22d95751c39335299a0375b037b192d88925
+  data.tar.gz: acba13bf06366eb312bde648d1aefc653576ff2fa67cae75a2cbddf9d697a84b
 SHA512:
-  metadata.gz: a011b12567263048cdba247fc4cd8270e2183a8ba6baf314c0342e65ca15cb73d0c12ab83c8bbd2f0cdc30d39823e3dc3ec409379f7433fe27d969e22e794cda
-  data.tar.gz: 5eafee911a325c2fa65263deaceb81159a198f495d543c0cccdcb0a0782a99cc3bd66762307521f927ec04ffec8f1999d37480e035efcbc3795d50814ba0adc3
+  metadata.gz: bd3c0356c36aa7aae5ed0891ce8e4b4baff329fdbbd21f26316f87f13d6de4daf9f4d3b6ed1831f4b1cbac9a7763f0224ef371d9cc2a87abf8ea67e760ad8a10
+  data.tar.gz: ba987bba63a5b6161407ad3fb73c904d15e6d4d2438cf6ce8cfea6e867dfb7435e8cfab1be6c7f2b3c2bb34bd19ff955de05155356d0cff3519c58863f7ac89d

data/.github/CODEOWNERS

@@ -0,0 +1,2 @@
+# Managed by https://github.com/powerhome/software. Do not make changes here, they will be reverted.
+* @powerhome/heroes-for-hire

data/.github/workflows/stale.yml

@@ -0,0 +1,35 @@
+# Managed by https://github.com/powerhome/software. Do not make changes here, they will be reverted.
+
+name: 'Close stale issues and PRs'
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: '37 21 * * *'
+
+jobs:
+  stale:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/stale@4391f3da665fdf50b6810c1a66712fb9ba21aa93 # v11.0.0
+        with:
+          operations-per-run: 200
+          delete-branch: true
+          stale-pr-message: >
+            This issue has been automatically marked as stale because it has not had
+            recent activity. It will be closed in 24 hours if no further activity occurs.
+
+            If this change is desirable, please accelerate completing it. If it is not,
+            please close the PR. If you're blocked on something, please ensure there's
+            a reference to this PR in a story on your team's board so the team will
+            follow up, and consider closing the PR for now.
+
+            Please do not artificially extend the deadline with a dummy comment. If
+            necessary, provide a status update, such as "this change is being actively
+            tested".
+
+            Thank you for your contributions and your collaboration in reducing WIP
+            and cycle time.
+          days-before-stale: 14
+          days-before-close: 3
+          days-before-issue-stale: -1
+          exempt-pr-labels: dependencies

data/CHANGELOG.md

@@ -1,4 +1,17 @@
-# [1.0.0] / Unreleased
+# [1.2.0] / 2026-10-28
+
+### Fixed
+* Yarn 2, 3 and 4 projects scan without the third-party licenses plugin, reading packages from the built-in `yarn info` - [6a46a083](https://github.com/powerhome/license_patrol/commit/6a46a083) - Carlos Palhares
+
+### Changed
+* Yarn 2+ no longer reports workspaces as packages, and `--prepare` only runs `yarn install` - [6a46a083](https://github.com/powerhome/license_patrol/commit/6a46a083) - Carlos Palhares
+
+# [1.1.0] / 2026-10-21
+
+### Added
+* `bundler_gemfiles` option to scan many gemfiles, such as Appraisal's `gemfiles/*.gemfile`, in one run - [5d7e1372](https://github.com/powerhome/license_patrol/commit/5d7e1372) - Carlos Palhares
+
+# [1.0.0] / 2026-10-21
 
 First release as `license_patrol`, forked from LicenseFinder 7.2.1. Earlier entries are LicenseFinder's history.
 
@@ -1068,3 +1081,5 @@ Bugfixes:
 [7.1.0]: https://github.com/pivotal/LicenseFinder/compare/v7.0.1...v7.1.0
 [7.2.0]: https://github.com/pivotal/LicenseFinder/compare/v7.1.0...v7.2.0
 [7.2.1]: https://github.com/pivotal/LicenseFinder/compare/v7.2.0...v7.2.1
+[1.0.0]: https://github.com/powerhome/license_patrol/releases/tag/v1.0.0
+[1.1.0]: https://github.com/powerhome/license_patrol/compare/v1.0.0...v1.1.0

data/README.md

@@ -48,7 +48,7 @@ and give you an actionable exception report.
 * Objective-C, Swift (via Carthage, CocoaPods \[0.39 and below. See [CocoaPods Specs Repo Sharding](http://blog.cocoapods.org/Sharding/)\]) and Swift Package Manager(SPM)
 * Elixir (via `mix`)
 * Golang (via `gvt`, `glide`,`dep`, `trash` and `govendor`)
-* JavaScript (via `yarn`)
+* JavaScript (via `yarn` 1.x through 4.x)
 * C++/C (via `conan`)
 * Scala (via `sbt`)
 * Rust (via `cargo`)
@@ -328,7 +328,7 @@ be approved. The project name at the top of the report can be set with
 `license_patrol project_name add`.
 
 ### Note:
-When using the yarn package manager, when a node_module's package.json doesn't
+When using Yarn 1, when a node_module's package.json doesn't
 explicitly declare a license, yarn indicates that it has inferred the license based
 on some keywords in other files by appending an asterisk to the license name. If you
 see a * at the end of the license name, this is intended.
@@ -466,6 +466,18 @@ If you store rebar dependencies in a custom directory (by setting `deps_dir` in
 You can also invoke a custom Mix script `remix` with `--mix_command remix` and
 set `--mix_deps_dir` to fetch Mix dependencies from a custom directory.
 
+By default, `bundler` dependencies are read from the gemfile in `BUNDLE_GEMFILE`,
+or from `Gemfile`. If your project locks dependencies in more than one gemfile
+(e.g. when using [Appraisal](https://github.com/thoughtbot/appraisal)), pass all
+of them to `--bundler_gemfiles`, relative to the project path. Glob patterns are
+accepted, as long as they are quoted:
+
+```
+$ license_patrol --bundler_gemfiles Gemfile 'gemfiles/*.gemfile'
+```
+
+Every gem locked by any of the gemfiles will be reported, once per version.
+
 ### Narrow down Package Manager
 
 By default, license_patrol will check for all supported package managers,
@@ -492,6 +504,9 @@ rebar_command: './rebarw'
 rebar_deps_dir: './rebar_deps'
 mix_command: './mixw'
 mix_deps_dir: './mix_deps'
+bundler_gemfiles:
+  - Gemfile
+  - gemfiles/*.gemfile
 enabled_package_managers:
   - bundler
   - gradle

data/VERSION

@@ -1 +1 @@
-1.0.0
+1.2.0

data/lib/license_patrol/cli/base.rb

@@ -40,6 +40,7 @@ module LicensePatrol
           :project_path,
           :decisions_file,
           :enabled_package_managers,
+          :bundler_gemfiles,
           :go_full_version,
           :gradle_command,
           :gradle_include_groups,

data/lib/license_patrol/cli/main.rb

@@ -24,6 +24,10 @@ module LicensePatrol
         'junit' => JunitReport
       }.freeze
 
+      class_option :bundler_gemfiles,
+                   type: :array,
+                   desc: "Gemfiles to be scanned, relative to the project path. Accepts glob patterns (e.g. 'gemfiles/*.gemfile' for Appraisal).
+                          Only meaningful if used with a Ruby/bundler project. Defaults to BUNDLE_GEMFILE, or 'Gemfile'."
       class_option :go_full_version, desc: 'Whether dependency version should include full version. Only meaningful if used with a Go project. Defaults to false.'
       class_option :gradle_include_groups, desc: 'Whether dependency name should include group id. Only meaningful if used with a Java/gradle project. Defaults to false.'
       class_option :gradle_command,

data/lib/license_patrol/configuration.rb

@@ -77,6 +77,10 @@ module LicensePatrol
       get(:gradle_command)
     end
 
+    def bundler_gemfiles
+      get(:bundler_gemfiles)
+    end
+
     def go_full_version
       get(:go_full_version)
     end

data/lib/license_patrol/core.rb

@@ -95,6 +95,7 @@ module LicensePatrol
         log_directory: File.join(config.log_directory, project_name),
         ignored_groups: decisions.ignored_groups,
         enabled_package_manager_ids: config.enabled_package_manager_ids,
+        bundler_gemfiles: config.bundler_gemfiles,
         go_full_version: config.go_full_version,
         gradle_command: config.gradle_command,
         gradle_include_groups: config.gradle_include_groups,

data/lib/license_patrol/package_managers/bundler.rb

@@ -2,23 +2,22 @@
 
 require 'bundler'
 require 'securerandom'
+require 'shellwords'
 
 module LicensePatrol
   class Bundler < PackageManager
     def initialize(options = {})
       super
       @ignored_groups = options[:ignored_groups]
+      @gemfiles = Array(options[:bundler_gemfiles]) unless options[:bundler_gemfiles].nil?
       @definition = options[:definition] # dependency injection for tests
     end
 
     def current_packages
-      with_gemfile do
-        logger.debug self.class, "including groups #{included_groups.inspect}"
-        details.map do |gem_detail, bundle_detail|
-          BundlerPackage.new(gem_detail, bundle_detail, logger: logger).tap do |package|
-            log_package_dependencies package
-          end
-        end
+      packages = existing_gemfile_paths.flat_map { |gemfile_path| current_packages_for(gemfile_path) }
+
+      packages.group_by { |package| [package.name, package.version] }.map do |_, same_packages|
+        merge_groups(same_packages)
       end
     end
 
@@ -32,68 +31,81 @@ module LicensePatrol
       gem_path = "lf-bundler-gems-#{SecureRandom.uuid}"
       logger.info self.class, "Running bundle install for #{Dir.pwd} with path #{gem_path}", color: :blue
 
-      "bundle install #{ignored_groups_argument} --path #{gem_path}".strip
+      return "bundle install #{ignored_groups_argument} --path #{gem_path}".strip if existing_gemfile_paths.size <= 1
+
+      existing_gemfile_paths.map do |gemfile_path|
+        gemfile_argument = "--gemfile #{Shellwords.escape(relative_to_project(gemfile_path))}"
+        "bundle install #{gemfile_argument} #{ignored_groups_argument} --path #{gem_path}".squeeze(' ')
+      end.join(' && ')
     end
 
     def possible_package_paths
-      [gemfile_path]
+      gemfile_paths
     end
 
     private
 
     attr_reader :ignored_groups
 
-    def definition
-      return @definition if @definition
+    def current_packages_for(gemfile_path)
+      with_gemfile(gemfile_path) do
+        definition = definition_for(gemfile_path)
+        included_groups = definition.groups - ignored_groups.map(&:to_sym)
+        logger.debug self.class, "including groups #{included_groups.inspect} from #{gemfile_path}"
 
-      @definition = ::Bundler::Definition.build(detected_package_path, lockfile_path, nil) if detected_package_path
+        details(definition, included_groups, gemfile_path).map do |gem_detail, bundle_detail|
+          BundlerPackage.new(gem_detail, bundle_detail, logger: logger).tap do |package|
+            log_package_dependencies package
+          end
+        end
+      end
     end
 
-    def with_gemfile
-      previous_gemfile = ENV['BUNDLE_GEMFILE']
-      ENV['BUNDLE_GEMFILE'] = gemfile_path.to_s
-      yield
-    ensure
-      ENV['BUNDLE_GEMFILE'] = previous_gemfile
+    def definition_for(gemfile_path)
+      @definition || ::Bundler::Definition.build(gemfile_path, lockfile_path(gemfile_path), nil)
     end
 
-    def details
-      gem_details.map do |gem_detail|
+    def details(definition, included_groups, gemfile_path)
+      bundler_details = definition.dependencies
+
+      gem_details(definition, included_groups, gemfile_path).map do |gem_detail|
         bundle_detail = bundler_details.detect { |bundler_detail| bundler_detail.name == gem_detail.name }
         [gem_detail, bundle_detail]
       end
     end
 
-    def gem_details
-      return @gem_details if @gem_details
-
+    def gem_details(definition, included_groups, gemfile_path)
       # clear gem paths before running specs_for
       Gem.clear_paths
-      if bundler_config_path_found
+      if bundler_config_path_found(gemfile_path)
         ::Bundler.reset!
         ::Bundler.configure
       end
-      @gem_details = definition&.specs_for(included_groups) || []
+      definition.specs_for(included_groups)
     end
 
-    def bundler_details
-      @bundler_details ||= definition&.dependencies || []
-    end
-
-    def included_groups
-      definition_groups - ignored_groups.map(&:to_sym)
+    # The same gem (name and version) may be locked by several gemfiles,
+    # in which case it should be reported once, but under all its groups.
+    def merge_groups(packages)
+      packages.first.tap do |package|
+        package.groups.concat(packages.drop(1).flat_map(&:groups)).uniq!
+      end
     end
 
-    def definition_groups
-      definition&.groups || []
+    def with_gemfile(gemfile_path)
+      previous_gemfile = ENV['BUNDLE_GEMFILE']
+      ENV['BUNDLE_GEMFILE'] = gemfile_path.to_s
+      yield
+    ensure
+      ENV['BUNDLE_GEMFILE'] = previous_gemfile
     end
 
-    def lockfile_path
+    def lockfile_path(gemfile_path)
       Pathname("#{gemfile_path}.lock")
     end
 
     # Bundler keeps the config (e.g. BUNDLE_PATH for vendored gems) next to the gemfile
-    def bundler_config_path_found
+    def bundler_config_path_found(gemfile_path)
       config_file = gemfile_path.dirname.join('.bundle/config')
 
       return false unless File.exist?(config_file)
@@ -114,14 +126,41 @@ module LicensePatrol
       end
     end
 
-    def gemfile_path
-      @gemfile_path ||= project_path.join(gemfile)
+    # All the gemfiles to be scanned, from the `bundler_gemfiles` option
+    # (which accepts glob patterns, e.g. `gemfiles/*.gemfile` for Appraisal),
+    # or the one in BUNDLE_GEMFILE, or `Gemfile`, relative to the project path.
+    def gemfile_paths
+      @gemfile_paths ||= gemfiles.flat_map { |gemfile| expand_gemfile(gemfile) }.uniq
+    end
+
+    def existing_gemfile_paths
+      gemfile_paths.select(&:exist?)
+    end
+
+    def gemfiles
+      @gemfiles || [default_gemfile]
+    end
+
+    def relative_to_project(gemfile_path)
+      gemfile_path.expand_path.relative_path_from(project_path.expand_path).to_s
+    end
+
+    def expand_gemfile(gemfile)
+      return [project_path.join(gemfile)] unless glob?(gemfile)
+
+      Dir.glob(gemfile, base: project_path.to_s).sort
+         .reject { |path| path.end_with?('.lock') }
+         .map { |path| project_path.join(path) }
+    end
+
+    def glob?(gemfile)
+      gemfile.match?(/[*?\[{]/)
     end
 
     # BUNDLE_GEMFILE is taken as relative to the project path. Through `bundle exec`
     # it gets expanded to an absolute path, which may point to another project
     # (e.g. when using --project_path), in which case only its basename is kept.
-    def gemfile
+    def default_gemfile
       gemfile = ENV['BUNDLE_GEMFILE']
       return 'Gemfile' if gemfile.nil? || gemfile.empty?
       return gemfile unless Pathname(gemfile).absolute?

data/lib/license_patrol/package_managers/yarn.rb

@@ -8,30 +8,17 @@ module LicensePatrol
     end
 
     SHELL_COMMAND = 'yarn licenses list --recursive --json'
+    BERRY_SHELL_COMMAND = 'yarn info --all --recursive --json --extra manifest'
 
     def possible_package_paths
       [project_path.join('yarn.lock')]
     end
 
     def current_packages
-      # the licenses plugin supports the classic production flag
-      cmd = "#{Yarn::SHELL_COMMAND}#{classic_yarn_production_flag}"
       if yarn_version == 1
-        cmd += ' --no-progress'
-        cmd += " --cwd #{project_path}" unless project_path.nil?
-        cmd += " #{@yarn_options}" unless @yarn_options.nil?
-      end
-
-      stdout, stderr, status = Dir.chdir(project_path) { Cmd.run(cmd) }
-      raise "Command '#{cmd}' failed to execute: #{stderr}" unless status.success?
-
-      json_strings = stdout.encode('ASCII', invalid: :replace, undef: :replace, replace: '?').split("\n")
-      json_objects = json_strings.map { |json_object| JSON.parse(json_object) }
-
-      if yarn_version == 1
-        get_yarn1_packages(json_objects)
+        get_yarn1_packages(run_json_command(classic_shell_command))
       else
-        get_yarn_packages(json_objects)
+        get_yarn_packages(run_json_command(BERRY_SHELL_COMMAND))
       end
     end
 
@@ -62,20 +49,28 @@ module LicensePatrol
 
     private
 
+    # devDependencies are left out when reading the packages, so all of them are installed
     def yarn_prepare_command
-      "#{yarn_plugin_production_command}yarn install && yarn plugin import https://raw.githubusercontent.com/mhassan1/yarn-plugin-licenses/#{yarn_licenses_plugin_version}/bundles/@yarnpkg/plugin-licenses.js"
+      'yarn install'
     end
 
     def classic_yarn_prepare_command
       "yarn install --ignore-engines --ignore-scripts#{classic_yarn_production_flag}"
     end
 
-    def yarn_licenses_plugin_version
-      if yarn_version == 2
-        'v0.6.0'
-      else
-        'v0.7.2'
-      end
+    def classic_shell_command
+      cmd = "#{Yarn::SHELL_COMMAND}#{classic_yarn_production_flag} --no-progress"
+      cmd += " --cwd #{project_path}" unless project_path.nil?
+      cmd += " #{@yarn_options}" unless @yarn_options.nil?
+      cmd
+    end
+
+    def run_json_command(cmd)
+      stdout, stderr, status = Dir.chdir(project_path) { Cmd.run(cmd) }
+      raise "Command '#{cmd}' failed to execute: #{stderr}" unless status.success?
+
+      json_strings = stdout.encode('ASCII', invalid: :replace, undef: :replace, replace: '?').split("\n")
+      json_strings.map { |json_object| JSON.parse(json_object) }
     end
 
     def yarn_version
@@ -88,40 +83,64 @@ module LicensePatrol
       end
     end
 
+    # Yarn 2+ prints one line per package in the lockfile, keyed by its locator
+    # (e.g. "@babel/core@npm:7.18.6"). Workspaces are the project's own code,
+    # so only the packages they depend on are reported.
     def get_yarn_packages(json_objects)
-      packages = []
-      incompatible_packages = []
-      json_objects.each do |json_object|
-        license = json_object['value']
-        body = json_object['children']
-
-        body.each do |package_name, vendor_info|
-          valid_match = %r{(?<name>@?[\w/.-]+)@(?<manager>\D*):\D*(?<version>(\d+\.?)+)} =~ package_name.to_s
-          valid_match = %r{(?<name>@?[\w/.-]+)@virtual:.+#(\D*):\D*(?<version>(\d+\.?)+)} =~ package_name.to_s if manager.eql?('virtual')
-
-          if valid_match
-            homepage = vendor_info['children']['vendorUrl']
-            author = vendor_info['children']['vendorName']
-            package = YarnPackage.new(
-              name,
-              version,
-              spec_licenses: [license],
-              homepage: homepage,
-              authors: author,
-              install_path: project_path.join(modules_folder, name)
-            )
-            packages << package
-          end
-
-          incompatible_match = %r{(?<name>@?[\w/.-]+)@[a-z]*:(?<version>(\.))} =~ package_name.to_s
-          if incompatible_match
-            package = YarnPackage.new(name, version, spec_licenses: [license])
-            incompatible_packages.push(package)
-          end
+      infos = json_objects.map { |json_object| [json_object['value'], json_object['children']] }.to_h
+      locators = ignore_dev_dependencies? ? production_locators(infos) : infos.keys
+
+      packages = locators.reject { |locator| workspace_locator?(locator) }.map do |locator|
+        name = locator_name(locator)
+        info = infos[locator]
+        manifest = info['Manifest'] || {}
+        YarnPackage.new(
+          name,
+          info['Version'],
+          spec_licenses: [manifest['License']].compact,
+          homepage: manifest['Homepage'],
+          install_path: project_path.join(modules_folder, name)
+        )
+      end
+
+      # a patched package (e.g. typescript) is listed next to the package it patches
+      packages.uniq { |package| [package.name, package.version] }
+    end
+
+    # Walks the dependencies of every workspace, skipping the ones they declare
+    # in devDependencies, like "yarn workspaces focus --all --production".
+    def production_locators(infos)
+      seen = Set.new
+      pending = infos.keys.select { |locator| workspace_locator?(locator) }
+      until pending.empty?
+        locator = devirtualize(pending.shift)
+        next unless infos.key?(locator) && seen.add?(locator)
+
+        dev_dependencies = workspace_locator?(locator) ? workspace_dev_dependencies(locator) : []
+        (infos[locator]['Dependencies'] || []).each do |dependency|
+          pending << dependency['locator'] unless dev_dependencies.include?(locator_name(dependency['descriptor']))
         end
       end
+      seen.to_a
+    end
 
-      packages + incompatible_packages.uniq
+    def workspace_dev_dependencies(locator)
+      workspace_path = locator.delete_prefix("#{locator_name(locator)}@workspace:")
+      manifest = JSON.parse(File.read(project_path.join(workspace_path, 'package.json')))
+      (manifest['devDependencies'] || {}).keys - (manifest['dependencies'] || {}).keys
+    end
+
+    def locator_name(locator)
+      locator[%r{\A(@[^/@]+/)?[^@]+}]
+    end
+
+    def workspace_locator?(locator)
+      locator.start_with?("#{locator_name(locator)}@workspace:")
+    end
+
+    # "react-dom@virtual:c6e8...#npm:18.2.0" is "react-dom@npm:18.2.0" with its peer dependencies resolved
+    def devirtualize(locator)
+      locator.sub(/@virtual:[^#]*#/, '@')
     end
 
     def get_yarn1_packages(json_objects)
@@ -181,15 +200,11 @@ module LicensePatrol
     end
 
     def classic_yarn_production_flag
-      return '' if @ignored_groups.nil?
-
-      @ignored_groups.include?('devDependencies') ? ' --production' : ''
+      ignore_dev_dependencies? ? ' --production' : ''
     end
 
-    def yarn_plugin_production_command
-      return '' if @ignored_groups.nil?
-
-      @ignored_groups.include?('devDependencies') ? 'yarn plugin import workspace-tools && yarn workspaces focus --all --production && ' : ''
+    def ignore_dev_dependencies?
+      !@ignored_groups.nil? && @ignored_groups.include?('devDependencies')
     end
   end
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: license_patrol
 version: !ruby/object:Gem::Version
-  version: 1.0.0
+  version: 1.2.0
 platform: ruby
 authors:
 - Ryan Collins
@@ -396,9 +396,11 @@ extensions: []
 extra_rdoc_files: []
 files:
 - ".force-build"
+- ".github/CODEOWNERS"
 - ".github/dependabot.yml"
 - ".github/workflows/install-test-tools.sh"
 - ".github/workflows/license_patrol.yml"
+- ".github/workflows/stale.yml"
 - ".gitignore"
 - ".pre-commit-hooks.yaml"
 - ".rspec"