licensed 2.11.1 → 2.14.0

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 22d2a3480b9386c6041c7ab17c90ca28ffedfb58f802974c9e7a4aef6c017919
-  data.tar.gz: c441684e72e0bdc85f55da6e34181758902226dd89f4abf844b6a8cb5c8c9907
+  metadata.gz: b246cf67fe29bfe3612770c81b44006cdc185e2875deba36aa339b7f8be6d654
+  data.tar.gz: 47e90e173cd914d214c270db673c1ffdff61f155853fec18da41837cebe7740b
 SHA512:
-  metadata.gz: 11527ca53a55700ec9626fe8d625ada1539453e53482d4d75394ef8115d79f2ee697f93fbc200eed6dbb0f76dde2138b6874dfd5de7c01ff10fc78c669374b8b
-  data.tar.gz: b24cedd6ab775e54c0fa503ca79e0ad93eef0f19ae15199aac3db66f891dbf8f71c98bc4fc58dff167e606be589ffee25ccf827da4ca5892b95ae25e356cdb5e
+  metadata.gz: 8e651c1ce72c6802b7f13e813ea4227c8dbeb53058deb8f68f1c8eabbcf4b9c4b9bd4a130b2d00b4238e14577f0a341d55fabac5aa72d0c3d0195a4b75bd1c86
+  data.tar.gz: b07832f775f62da3fef628bf3ca9769e6f33e9d32338ffe468dad212f27d65d2be455e57ac73786930017d55308cd5222f2280f2944c832a1f32fa5c8a3557bb

data/.github/workflows/release.yml

@@ -1,18 +1,12 @@
-name: Create release
+name: Build and publish release assets
 
-on: create
+on:
+  release:
+    types: [created]
 
 jobs:
-  tag_filter:
-    runs-on: ubuntu-latest
-    if: startsWith(github.ref, 'refs/tags/')
-    steps:
-      - run: exit 0
-
   package_linux:
     runs-on: ubuntu-latest
-    needs: tag_filter
-
     steps:
     - uses: actions/checkout@v2
     - name: Set up Ruby 2.6
@@ -23,17 +17,15 @@ jobs:
     - name: Build package
       run: script/packages/linux
       env:
-        VERSION: ${{github.event.ref}}
+        VERSION: ${{github.event.release.tag_name}}
 
     - uses: actions/upload-artifact@v2
       with:
-        name: ${{github.event.ref}}-linux
-        path: pkg/${{github.event.ref}}/licensed-${{github.event.ref}}-linux-x64.tar.gz
+        name: ${{github.event.release.tag_name}}-linux
+        path: pkg/${{github.event.release.tag_name}}/licensed-${{github.event.release.tag_name}}-linux-x64.tar.gz
 
   package_mac:
     runs-on: macOS-latest
-    needs: tag_filter
-
     steps:
     - uses: actions/checkout@v2
     - name: Set up Ruby 2.6
@@ -44,17 +36,15 @@ jobs:
     - name: Build package
       run: script/packages/mac
       env:
-        VERSION: ${{github.event.ref}}
+        VERSION: ${{github.event.release.tag_name}}
 
     - uses: actions/upload-artifact@v2
       with:
-        name: ${{github.event.ref}}-darwin
-        path: pkg/${{github.event.ref}}/licensed-${{github.event.ref}}-darwin-x64.tar.gz
+        name: ${{github.event.release.tag_name}}-darwin
+        path: pkg/${{github.event.release.tag_name}}/licensed-${{github.event.release.tag_name}}-darwin-x64.tar.gz
 
   build_gem:
     runs-on: ubuntu-latest
-    needs: tag_filter
-
     steps:
     - uses: actions/checkout@v2
     - name: Set up Ruby 2.6
@@ -63,25 +53,16 @@ jobs:
         ruby-version: 2.6.x
 
     - name: Build gem
-      run: gem build *.gemspec
+      run: gem build licensed.gemspec -o licensed-${{github.event.release.tag_name}}.gem
 
     - uses: actions/upload-artifact@v2
       with:
-        name: ${{github.event.ref}}-gem
-        path: licensed-${{github.event.ref}}.gem
-
-  create_release:
-    runs-on: ubuntu-latest
-    needs: [package_linux, package_mac, build_gem]
-    steps:
-    - uses: Roang-zero1/github-create-release-action@v1.0.2
-      env:
-        GITHUB_TOKEN: ${{ secrets.API_AUTH_TOKEN }}
-        VERSION_REGEX: "^[[:digit:]]+\\.[[:digit:]]+\\.[[:digit:]]+"
+        name: ${{github.event.release.tag_name}}-gem
+        path: licensed-${{github.event.release.tag_name}}.gem
 
   upload_packages:
     runs-on: ubuntu-latest
-    needs: [create_release]
+    needs: [package_linux, package_mac, build_gem]
 
     steps:
     - name: Set up Ruby 2.6
@@ -92,32 +73,45 @@ jobs:
     - name: Download linux package
       uses: actions/download-artifact@v2
       with:
-        name: ${{github.event.ref}}-linux
+        name: ${{github.event.release.tag_name}}-linux
 
     - name: Download macOS package
       uses: actions/download-artifact@v2
       with:
-        name: ${{github.event.ref}}-darwin
+        name: ${{github.event.release.tag_name}}-darwin
 
     - name: Download gem
       uses: actions/download-artifact@v2
       with:
-        name: ${{github.event.ref}}-gem
+        name: ${{github.event.release.tag_name}}-gem
 
-    - name: Publish packages to GitHub Release
-      uses: Roang-zero1/github-upload-release-artifacts-action@v2.0.0
+    - name: Publish linux package
+      uses: actions/upload-release-asset@v1
+      env:
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       with:
-        args: licensed-${{github.event.ref}}-linux-x64.tar.gz licensed-${{github.event.ref}}-darwin-x64.tar.gz
+        upload_url: ${{ github.event.release.upload_url }}
+        asset_path: ./licensed-${{github.event.release.tag_name}}-linux-x64.tar.gz
+        asset_name: licensed-${{github.event.release.tag_name}}-linux-x64.tar.gz
+        asset_content_type: application/gzip
+
+    - name: Publish mac package
+      uses: actions/upload-release-asset@v1
       env:
-        GITHUB_TOKEN: ${{secrets.API_AUTH_TOKEN}}
+        GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      with:
+        upload_url: ${{ github.event.release.upload_url }}
+        asset_path: ./licensed-${{github.event.release.tag_name}}-darwin-x64.tar.gz
+        asset_name: licensed-${{github.event.release.tag_name}}-darwin-x64.tar.gz
+        asset_content_type: application/gzip
 
     - name: Publish gem to RubyGems
       run: |
         mkdir -p $HOME/.gem
         touch $HOME/.gem/credentials
         chmod 0600 $HOME/.gem/credentials
-        printf -- "---\n:rubygems_api_key: ${GEM_HOST_API_KEY}\n" > $HOME/.gem/credentials
+        printf -- "---\n:rubygems_api_key: ${RUBYGEMS_API_KEY}\n" > $HOME/.gem/credentials
         gem push $GEM
       env:
-        GEM_HOST_API_KEY: ${{secrets.RUBYGEMS_AUTH_TOKEN}}
-        GEM: licensed-${{github.event.ref}}.gem
+        RUBYGEMS_API_KEY: ${{secrets.RUBYGEMS_AUTH_TOKEN}}
+        GEM: licensed-${{github.event.release.tag_name}}.gem

data/.github/workflows/test.yml

@@ -116,7 +116,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        ruby: [ 2.4.x, 2.5.x, 2.6.x ]
+        ruby: [ 2.4.x, 2.5.x, 2.6.x, 2.7.x ]
     steps:
     - uses: actions/checkout@v2
     - name: Set up Ruby
@@ -165,7 +165,7 @@ jobs:
     runs-on: ubuntu-latest
     strategy:
       matrix:
-        go: [ '1.7.x', '1.10.x', '1.11.x', '1.12.x', '1.13.x', '1.14.x' ]
+        go: [ '1.10.x', '1.11.x', '1.12.x', '1.13.x', '1.14.x', '1.15.x' ]
     steps:
     - uses: actions/checkout@v2
     - name: Setup go

data/CHANGELOG.md

@@ -6,6 +6,48 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 ## [Unreleased]
 
+## 2.14.0
+2020-10-04
+
+### Addded
+- `reviewed` dependencies can use glob pattern matching (https://github.com/github/licensed/pull/313)
+
+### Fixed
+- Fix configuring source path globs that expand into a single directory (https://github.com/github/licensed/pull/312)
+
+## 2.13.0
+2020-09-23
+
+### Added
+- `status` command results can be output in YAML and JSON formats (:tada: @julianvilas https://github.com/github/licensed/pull/303)
+
+### Fixed
+- `licensed` no longer crashes when parsing invalid YAML from cached records (https://github.com/github/licensed/pull/306)
+- NPM source will no longer crash when invalid JSON is returned from npm CLI calls (https://github.com/github/licensed/pull/300)
+- Bundler source is fixed to work properly with `gems.rb` lockfiles (https://github.com/github/licensed/pull/299)
+
+## 2.12.2
+2020-07-07
+
+### Changed
+- Cleaned up ruby 2.7 warnings (:tada: @jurre https://github.com/github/licensed/pull/292)
+- Cleaned up additional warnings in tests (https://github.com/github/licensed/pull/293)
+
+## 2.12.1
+2020-06-30
+
+### Fixed
+- `licensed` no longer exits an error code when using the `--sources` CLI argument (https://github.com/github/licensed/pull/290)
+
+## 2.12.0
+2020-06-19
+
+### Added
+- `--sources` argument for cache, list, status and notices commands to filter running sources (https://github.com/github/licensed/pull/287)
+
+### Fixed
+- `cache` command will not remove files outside of enabled source cache paths (https://github.com/github/licensed/pull/287)
+
 ## 2.11.1
 2020-06-09
 
@@ -318,4 +360,4 @@ and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.
 
 Initial release :tada:
 
-[Unreleased]: https://github.com/github/licensed/compare/2.11.1...HEAD
+[Unreleased]: https://github.com/github/licensed/compare/2.14.0...HEAD

data/CONTRIBUTING.md

@@ -39,7 +39,7 @@ Pull requests that include a new dependency source must also
 ## Releasing
 If you are the current maintainer of this gem:
 
-1. Create a branch for the release: git checkout -b cut-release-vxx.xx.xx
+1. Create a branch for the release: git checkout -b cut-release-xx.xx.xx
 2. Make sure your local dependencies are up to date: `script/bootstrap`
 3. Ensure that tests are green: `bundle exec rake test`
 4. Bump gem version in lib/licensed/version.rb.
@@ -51,15 +51,16 @@ If you are the current maintainer of this gem:
    2. Install the new gem locally
    3. Test behavior locally, branch deploy, whatever needs to happen
 9. Merge github/licensed PR
-10. Tag and push: `git tag x.xx.xx; git push --tags`
+10. Create a new [github/licensed release](https://github.com/github/licensed/releases)
+   - Set the release name and tag to the release version - `x.xx.x`
+   - Set the release body to the changelog entries for the release
 
 The following steps will happen automatically from a GitHub Actions workflow
-after pushing a new tag. In case that fails, the following steps can be performed manually
+after creating the release. In case that fails, the following steps can be performed manually
 
-11. Push to rubygems.org -- `gem push licensed-x.xx.xx.gem`
+11. Push the gem from (7) to rubygems.org -- `gem push licensed-x.xx.xx.gem`
 12. Build packages for new tag: `VERSION=x.xx.xx bundle exec rake package`
-13. Create release for new tag at github/licensed.
-14. Add built packages to new release
+13. Upload packages from (12) to release from (10)
 
 ## Resources
 

data/docs/commands.md

@@ -6,10 +6,14 @@ Run `licensed -h` to see help content for running licensed commands.
 
 Running the list command finds the dependencies for all sources in all configured applications.  No additional actions are taken on each dependency.
 
+An optional `--sources` flag can be given to limit which dependency sources are run.  This is a filter over sources that are enabled via the licensed configuration file and cannot be used to run licensed with a disabled source.
+
 ## `cache`
 
 The cache command finds all dependencies and ensures that each dependency has an up-to-date cached record.
 
+An optional `--sources` flag can be given to limit which dependency sources are run.  This is a filter over sources that are enabled via the licensed configuration file and cannot be used to run licensed with a disabled source.
+
 Dependency records will be saved if:
 1. The `force` option is set
 2. No cached record is found
@@ -22,6 +26,8 @@ After the cache command is run, any cached records that don't match up to a curr
 
 The status command finds all dependencies and checks whether each dependency has a valid cached record.
 
+An optional `--sources` flag can be given to limit which dependency sources are run.  This is a filter over sources that are enabled via the licensed configuration file and cannot be used to run licensed with a disabled source.
+
 A dependency will fail the status checks if:
 1. No cached record is found
 2. The cached record's version is different than the current dependency's version
@@ -35,6 +41,8 @@ A dependency will fail the status checks if:
 
 Outputs license and notice text for all dependencies in each app into a `NOTICE` file in the app's `cache_path`.  If an app uses a shared cache path, the file name will contain the app name as well, e.g. `NOTICE.my_app`.
 
+An optional `--sources` flag can be given to limit which dependency sources are run.  This is a filter over sources that are enabled via the licensed configuration file and cannot be used to run licensed with a disabled source.
+
 The `NOTICE` file contents are retrieved from cached records, with the assumption that cached records have already been reviewed in a compliance workflow.
 
 ## `env`

data/docs/configuration.md

@@ -23,7 +23,7 @@ If a root path is not specified, it will default to using the following, in orde
 
 The `source_path` property can use a glob path to share configuration properties across multiple application entrypoints.
 
-For example, there is a common pattern in go projects to include multiple executable entrypoints under folders in `cmd`.  Using a glob pattern allows users to avoid manually configuring and maintaining multiple licensed application `source_path`s.  Using a glob pattern will also ensure that any new entrypoints matching the pattern are automatically picked up by licensed commands as they are added.
+For example, there is a common pattern in Go projects to include multiple executable entrypoints under folders in `cmd`.  Using a glob pattern allows users to avoid manually configuring and maintaining multiple licensed application `source_path`s.  Using a glob pattern will also ensure that any new entrypoints matching the pattern are automatically picked up by licensed commands as they are added.
 
 ```yml
 sources:
@@ -118,12 +118,6 @@ ignored:
   bower:
     - some-internal-package
 
-  go:
-    # ignore all go packages from import paths starting with github.com/internal-package
-    # see the `File.fnmatch?` documentation for details on how patterns are matched.
-    # comparisons use the FNM_CASEFOLD and FNM_PATHNAME flags
-    - github.com/internal-package/**/*
-
 # These dependencies have licenses not on the `allowed` list and have been reviewed.
 # They will be cached and checked, but will not raise errors or warnings for a
 # non-allowed license.  Dependencies on this list will still raise errors if

data/docs/sources/go.md

@@ -24,6 +24,26 @@ The setting supports absolute, relative and expandable (e.g. "~") paths.  Relati
 
 Non-empty `GOPATH` configuration settings will override the `GOPATH` environment variable while enumerating `go` dependencies.  The `GOPATH` environment variable is restored once dependencies have been enumerated.
 
+#### Reviewing and ignoring all packages from a Go module
+
+Go's package and module structure has common conventions that documentation and metadata for all packages in a module live in the module root.  In this scenario all packages share the same LICENSE information and can be reviewed or ignored at the module level rather than per-package using glob patterns.
+
+```yaml
+reviewed:
+  go:
+    # review all Go packages from import paths starting with github.com/external-package
+    # see the `File.fnmatch?` documentation for details on how patterns are matched.
+    # comparisons use the FNM_CASEFOLD and FNM_PATHNAME flags
+    - github.com/external-package/**/*
+
+ignored:
+  go:
+    # ignore all Go packages from import paths starting with github.com/internal-package
+    # see the `File.fnmatch?` documentation for details on how patterns are matched.
+    # comparisons use the FNM_CASEFOLD and FNM_PATHNAME flags
+    - github.com/internal-package/**/*
+```
+
 #### Versioning
 
 The go source supports multiple versioning strategies to determine if cached dependency metadata is stale.  A version strategy is chosen based on the availability of go module information along with the current app configuration.

data/lib/licensed/cli.rb

@@ -10,29 +10,40 @@ module Licensed
       desc: "Overwrite licenses even if version has not changed."
     method_option :config, aliases: "-c", type: :string,
       desc: "Path to licensed configuration file"
+    method_option :sources, aliases: "-s", type: :array,
+      desc: "Individual source(s) to evaluate.  Must also be enabled via configuration."
     def cache
-      run Licensed::Commands::Cache.new(config: config), force: options[:force]
+      run Licensed::Commands::Cache.new(config: config),
+          force: options[:force], sources: options[:sources]
     end
 
     desc "status", "Check status of dependencies' cached licenses"
+    method_option :format, enum: ["yaml", "json"],
+      desc: "Output format"
     method_option :config, aliases: "-c", type: :string,
       desc: "Path to licensed configuration file"
+    method_option :sources, aliases: "-s", type: :array,
+      desc: "Individual source(s) to evaluate.  Must also be enabled via configuration."
     def status
-      run Licensed::Commands::Status.new(config: config)
+      run Licensed::Commands::Status.new(config: config), sources: options[:sources], reporter: options[:format]
     end
 
     desc "list", "List dependencies"
     method_option :config, aliases: "-c", type: :string,
       desc: "Path to licensed configuration file"
+    method_option :sources, aliases: "-s", type: :array,
+      desc: "Individual source(s) to evaluate.  Must also be enabled via configuration."
     def list
-      run Licensed::Commands::List.new(config: config)
+      run Licensed::Commands::List.new(config: config), sources: options[:sources]
     end
 
     desc "notices", "Generate a NOTICE file from cached records"
     method_option :config, aliases: "-c", type: :string,
       desc: "Path to licensed configuration file"
+    method_option :sources, aliases: "-s", type: :array,
+      desc: "Individual source(s) to evaluate.  Must also be enabled via configuration."
     def notices
-      run Licensed::Commands::Notices.new(config: config)
+      run Licensed::Commands::Notices.new(config: config), sources: options[:sources]
     end
 
     map "-v" => :version
@@ -48,7 +59,7 @@ module Licensed
     method_option :config, aliases: "-c", type: :string,
       desc: "Path to licensed configuration file"
     def env
-      run Licensed::Commands::Environment.new(config: config), format: options[:format]
+      run Licensed::Commands::Environment.new(config: config), reporter: options[:format]
     end
 
     desc "migrate", "Migrate from a previous version of licensed"
@@ -87,7 +98,7 @@ module Licensed
     end
 
     def run(command, **args)
-      exit command.run(args)
+      exit command.run(**args)
     end
   end
 end

data/lib/licensed/commands/cache.rb

@@ -2,12 +2,12 @@
 module Licensed
   module Commands
     class Cache < Command
-      # Create a reporter to use during a command run
+      # Returns the default reporter to use during the command run
       #
       # options - The options the command was run with
       #
-      # Raises a Licensed::Reporters::CacheReporter
-      def create_reporter(options)
+      # Returns a Licensed::Reporters::CacheReporter
+      def default_reporter(options)
         Licensed::Reporters::CacheReporter.new
       end
 
@@ -32,19 +32,26 @@ module Licensed
 
       protected
 
-      # Run the command for all enabled sources for an application configuration,
+      # Run the command for all enumerated dependencies found in a dependency source,
       # recording results in a report.
+      # Enumerating dependencies in the source is skipped if a :sources option
+      # is provided and the evaluated `source.class.type` is not in the :sources values
       #
-      # app - An application configuration
+      # app - The application configuration for the source
+      # source - A dependency source enumerator
       #
-      # Returns whether the command succeeded for the application.
-      def run_app(app)
-        result = super
-
-        # add the full cache path to the list of cache paths evaluted during this run
-        cache_paths << app.cache_path
+      # Returns whether the command succeeded for the dependency source enumerator
+      def run_source(app, source)
+        super do |report|
+          if Array(options[:sources]).any? && !options[:sources].include?(source.class.type)
+            report.warnings << "skipped source"
+            next :skip
+          end
 
-        result
+          # add the full cache path to the list of cache paths
+          # that should be cleaned up after the command run
+          cache_paths << app.cache_path.join(source.class.type)
+        end
       end
 
       # Cache dependency record data.

data/lib/licensed/commands/command.rb

@@ -21,7 +21,9 @@ module Licensed
         begin
           result = reporter.report_run(self) do |report|
             # allow additional report data to be given by commands
-            yield report if block_given?
+            if block_given?
+              next true if (yield report) == :skip
+            end
 
             config.apps.sort_by { |app| app["name"] }
                        .map { |app| run_app(app) }
@@ -35,13 +37,29 @@ module Licensed
         result
       end
 
-      # Create a reporter to use during a command run
+      # Creates a reporter to use during a command run
       #
       # options - The options the command was run with
       #
-      # Raises an error
+      # Returns the reporter to use during the command run
       def create_reporter(options)
-        raise "`create_reporter` must be implemented by commands"
+        return options[:reporter] if options[:reporter].is_a?(Licensed::Reporters::Reporter)
+
+        if options[:reporter].is_a?(String)
+          klass = "#{options[:reporter].capitalize}Reporter"
+          return Licensed::Reporters.const_get(klass).new if Licensed::Reporters.const_defined?(klass)
+        end
+
+        default_reporter(options)
+      end
+
+      # Returns the default reporter to use during the command run
+      #
+      # options - The options the command was run with
+      #
+      # Raises an error
+      def default_reporter(options)
+        raise "`default_reporter` must be implemented by commands"
       end
 
       protected
@@ -54,10 +72,18 @@ module Licensed
       # Returns whether the command succeeded for the application.
       def run_app(app)
         reporter.report_app(app) do |report|
+          # ensure the app source path exists before evaluation
+          if !Dir.exist?(app.source_path)
+            report.errors << "No such directory #{app.source_path}"
+            next false
+          end
+
           Dir.chdir app.source_path do
             begin
               # allow additional report data to be given by commands
-              yield report if block_given?
+              if block_given?
+                next true if (yield report) == :skip
+              end
 
               app.sources.select(&:enabled?)
                          .sort_by { |source| source.class.type }
@@ -81,7 +107,9 @@ module Licensed
         reporter.report_source(source) do |report|
           begin
             # allow additional report data to be given by commands
-            yield report if block_given?
+            if block_given?
+              next true if (yield report) == :skip
+            end
 
             source.dependencies.sort_by { |dependency| dependency.name }
                                .map { |dependency| run_dependency(app, source, dependency) }
@@ -114,10 +142,12 @@ module Licensed
 
           begin
             # allow additional report data to be given by commands
-            yield report if block_given?
+            if block_given?
+              next true if (yield report) == :skip
+            end
 
             evaluate_dependency(app, source, dependency, report)
-          rescue Licensed::Shell::Error => err
+          rescue Licensed::DependencyRecord::Error, Licensed::Shell::Error => err
             report.errors << err.message
             false
           end

data/lib/licensed/commands/environment.rb

@@ -35,13 +35,13 @@ module Licensed
         end
       end
 
-      def create_reporter(options)
-        case options[:format]
-        when "json"
-          Licensed::Reporters::JsonReporter.new
-        else
-          Licensed::Reporters::YamlReporter.new
-        end
+      # Returns the default reporter to use during the command run
+      #
+      # options - The options the command was run with
+      #
+      # Returns a Licensed::Reporters::StatusReporter
+      def default_reporter(options)
+        Licensed::Reporters::YamlReporter.new
       end
 
       protected

data/lib/licensed/commands/list.rb

@@ -2,17 +2,36 @@
 module Licensed
   module Commands
     class List < Command
-      # Create a reporter to use during a command run
+      # Returns the default reporter to use during the command run
       #
       # options - The options the command was run with
       #
       # Returns a Licensed::Reporters::ListReporter
-      def create_reporter(options)
+      def default_reporter(options)
         Licensed::Reporters::ListReporter.new
       end
 
       protected
 
+      # Run the command for all enumerated dependencies found in a dependency source,
+      # recording results in a report.
+      # Enumerating dependencies in the source is skipped if a :sources option
+      # is provided and the evaluated `source.class.type` is not in the :sources values
+      #
+      # app - The application configuration for the source
+      # source - A dependency source enumerator
+      #
+      # Returns whether the command succeeded for the dependency source enumerator
+      def run_source(app, source)
+        super do |report|
+          next if Array(options[:sources]).empty?
+          next if options[:sources].include?(source.class.type)
+
+          report.warnings << "skipped source"
+          :skip
+        end
+      end
+
       # Listing dependencies requires no extra work.
       #
       # app - The application configuration for the dependency

data/lib/licensed/commands/notices.rb

@@ -2,17 +2,36 @@
 module Licensed
   module Commands
     class Notices < Command
-      # Create a reporter to use during a command run
+      # Returns the default reporter to use during the command run
       #
       # options - The options the command was run with
       #
-      # Raises a Licensed::Reporters::CacheReporter
-      def create_reporter(options)
+      # Returns a Licensed::Reporters::CacheReporter
+      def default_reporter(options)
         Licensed::Reporters::NoticesReporter.new
       end
 
       protected
 
+      # Run the command for all enumerated dependencies found in a dependency source,
+      # recording results in a report.
+      # Enumerating dependencies in the source is skipped if a :sources option
+      # is provided and the evaluated `source.class.type` is not in the :sources values
+      #
+      # app - The application configuration for the source
+      # source - A dependency source enumerator
+      #
+      # Returns whether the command succeeded for the dependency source enumerator
+      def run_source(app, source)
+        super do |report|
+          next if Array(options[:sources]).empty?
+          next if options[:sources].include?(source.class.type)
+
+          report.warnings << "skipped source"
+          :skip
+        end
+      end
+
       # Load stored dependency record data to add to the notices report.
       #
       # app - The application configuration for the dependency
@@ -25,7 +44,7 @@ module Licensed
         filename = app.cache_path.join(source.class.type, "#{dependency.name}.#{DependencyRecord::EXTENSION}")
         report["cached_record"] = Licensed::DependencyRecord.read(filename)
         if !report["cached_record"]
-          report["warning"] = "expected cached record not found at #{filename}"
+          report.warnings << "expected cached record not found at #{filename}"
         end
 
         true

data/lib/licensed/commands/status.rb

@@ -4,17 +4,36 @@ require "yaml"
 module Licensed
   module Commands
     class Status < Command
-      # Create a reporter to use during a command run
+      # Returns the default reporter to use during the command run
       #
       # options - The options the command was run with
       #
       # Returns a Licensed::Reporters::StatusReporter
-      def create_reporter(options)
+      def default_reporter(options)
         Licensed::Reporters::StatusReporter.new
       end
 
       protected
 
+      # Run the command for all enumerated dependencies found in a dependency source,
+      # recording results in a report.
+      # Enumerating dependencies in the source is skipped if a :sources option
+      # is provided and the evaluated `source.class.type` is not in the :sources values
+      #
+      # app - The application configuration for the source
+      # source - A dependency source enumerator
+      #
+      # Returns whether the command succeeded for the dependency source enumerator
+      def run_source(app, source)
+        super do |report|
+          next if Array(options[:sources]).empty?
+          next if options[:sources].include?(source.class.type)
+
+          report.warnings << "skipped source"
+          :skip
+        end
+      end
+
       # Verifies that a cached record exists, is up to date and
       # has license data that complies with the licensed configuration.
       #

data/lib/licensed/configuration.rb

@@ -69,7 +69,9 @@ module Licensed
 
     # Is the given dependency reviewed?
     def reviewed?(dependency)
-      Array(self["reviewed"][dependency["type"]]).include?(dependency["name"])
+      Array(self["reviewed"][dependency["type"]]).any? do |pattern|
+        File.fnmatch?(pattern, dependency["name"], File::FNM_PATHNAME | File::FNM_CASEFOLD)
+      end
     end
 
     # Is the given dependency ignored?
@@ -158,19 +160,22 @@ module Licensed
     def self.expand_app_source_path(app_config)
       return app_config if app_config["source_path"].to_s.empty?
 
+      # check if the source path maps to an existing directory
       source_path = File.expand_path(app_config["source_path"], AppConfiguration.root_for(app_config))
+      return app_config if Dir.exist?(source_path)
+
+      # try to expand the source path for glob patterns
       expanded_source_paths = Dir.glob(source_path).select { |p| File.directory?(p) }
-      # return the original configuration if glob didn't result in multiple paths
-      return app_config if expanded_source_paths.size <= 1
+      configs = expanded_source_paths.map { |path| app_config.merge("source_path" => path) }
 
-      # map the expanded paths to new application configurations
-      expanded_source_paths.map do |path|
-        config = app_config.merge("source_path" => path)
+      # if no directories are found for the source path, return the original config
+      return app_config if configs.size == 0
 
-        # update configured values for name and cache_path for uniqueness.
-        # this is only needed when values are explicitly set, AppConfiguration
-        # will handle configurations that don't have these explicitly set
-        dir_name = File.basename(path)
+      # update configured values for name and cache_path for uniqueness.
+      # this is only needed when values are explicitly set, AppConfiguration
+      # will handle configurations that don't have these explicitly set
+      configs.each do |config|
+        dir_name = File.basename(config["source_path"])
         config["name"] = "#{config["name"]}-#{dir_name}" if config["name"]
 
         # if a cache_path is set and is not marked as shared, append the app name
@@ -178,9 +183,9 @@ module Licensed
         if config["cache_path"] && config["shared_cache"] != true
           config["cache_path"] = File.join(config["cache_path"], dir_name)
         end
-
-        config
       end
+
+      configs
     end
 
     # Find a default configuration file in the given directory.

data/lib/licensed/dependency_record.rb

@@ -5,6 +5,8 @@ require "licensee"
 
 module Licensed
   class DependencyRecord
+    class Error < StandardError; end
+
     class License
       attr_reader :text, :sources
       def initialize(content)
@@ -46,6 +48,8 @@ module Licensed
         notices: data.delete("notices"),
         metadata: data
       )
+    rescue Psych::SyntaxError => e
+      raise Licensed::DependencyRecord::Error.new(e.message)
     end
 
     def_delegators :@metadata, :[], :[]=

data/lib/licensed/reporters/list_reporter.rb

@@ -28,6 +28,22 @@ module Licensed
           shell.info "  #{source.class.type}"
           result = yield report
 
+          warning_reports = report.all_reports.select { |r| r.warnings.any? }.to_a
+          if warning_reports.any?
+            shell.newline
+            shell.warn "  * Warnings:"
+            warning_reports.each do |r|
+              display_metadata = r.map { |k, v| "#{k}: #{v}" }.join(", ")
+
+              shell.warn "    * #{r.name}"
+              shell.warn "    #{display_metadata}" unless display_metadata.empty?
+              r.warnings.each do |warning|
+                shell.warn "      - #{warning}"
+              end
+              shell.newline
+            end
+          end
+
           errored_reports = report.all_reports.select { |r| r.errors.any? }.to_a
           if errored_reports.any?
             shell.newline

data/lib/licensed/reporters/notices_reporter.rb

@@ -33,6 +33,26 @@ module Licensed
         end
       end
 
+
+      # Reports on a dependency source enumerator in a notices command run.
+      # Shows warnings encountered during the run.
+      #
+      # source - A dependency source enumerator
+      #
+      # Returns the result of the yielded method
+      # Note - must be called from inside the `report_run` scope
+      def report_source(source)
+        super do |report|
+          result = yield report
+
+          report.warnings.each do |warning|
+            shell.warn "* #{report.name}: #{warning}"
+          end
+
+          result
+        end
+      end
+
       # Reports on a dependency in a notices command run.
       #
       # dependency - An application dependency
@@ -42,7 +62,9 @@ module Licensed
       def report_dependency(dependency)
         super do |report|
           result = yield report
-          shell.warn "* #{report["warning"]}" if report["warning"]
+          report.warnings.each do |warning|
+            shell.warn "* #{report.name}: #{warning}"
+          end
           result
         end
       end

data/lib/licensed/reporters/status_reporter.rb

@@ -15,6 +15,23 @@ module Licensed
           result = yield report
 
           all_reports = report.all_reports
+
+          warning_reports = all_reports.select { |r| r.warnings.any? }.to_a
+          if warning_reports.any?
+            shell.newline
+            shell.warn "Warnings:"
+            warning_reports.each do |r|
+              display_metadata = r.map { |k, v| "#{k}: #{v}" }.join(", ")
+
+              shell.warn "* #{r.name}"
+              shell.warn "  #{display_metadata}" unless display_metadata.empty?
+              r.warnings.each do |warning|
+                shell.warn "    - #{warning}"
+              end
+              shell.newline
+            end
+          end
+
           errored_reports = all_reports.select { |r| r.errors.any? }.to_a
 
           dependency_count = all_reports.select { |r| r.target.is_a?(Licensed::Dependency) }.size

data/lib/licensed/sources/bundler.rb

@@ -74,7 +74,7 @@ module Licensed
         end
       end
 
-      GEMFILES = %w{Gemfile gems.rb}.freeze
+      GEMFILES = { "Gemfile" => "Gemfile.lock", "gems.rb" => "gems.locked" }
       DEFAULT_WITHOUT_GROUPS = %i{development test}
 
       def enabled?
@@ -272,14 +272,15 @@ module Licensed
 
       # Returns the path to the Bundler Gemfile
       def gemfile_path
-        @gemfile_path ||= GEMFILES.map { |g| config.pwd.join g }
+        @gemfile_path ||= GEMFILES.keys
+                                  .map { |g| config.pwd.join g }
                                   .find { |f| f.exist? }
       end
 
       # Returns the path to the Bundler Gemfile.lock
       def lockfile_path
         return unless gemfile_path
-        @lockfile_path ||= gemfile_path.dirname.join("#{gemfile_path.basename}.lock")
+        @lockfile_path ||= gemfile_path.dirname.join(GEMFILES[gemfile_path.basename.to_s])
       end
 
       # Returns the configured bundler executable to use, or "bundle" by default.

data/lib/licensed/sources/npm.rb

@@ -30,7 +30,7 @@ module Licensed
       end
 
       def packages
-        root_dependencies = JSON.parse(package_metadata_command)["dependencies"]
+        root_dependencies = package_metadata["dependencies"]
         recursive_dependencies(root_dependencies).each_with_object({}) do |(name, results), hsh|
           results.uniq! { |package| package["version"] }
           if results.size == 1
@@ -56,6 +56,18 @@ module Licensed
         result
       end
 
+      # Returns parsed package metadata returned from `npm list`
+      def package_metadata
+        return @package_metadata if defined?(@package_metadata)
+
+        @package_metadata = begin
+          JSON.parse(package_metadata_command)
+        rescue JSON::ParserError => e
+          raise Licensed::Sources::Source::Error,
+            "Licensed was unable to parse the output from 'npm list'. Please run 'npm list --json --long' and check for errors. Error: #{e.message}"
+        end
+      end
+
       # Returns the output from running `npm list` to get package metadata
       def package_metadata_command
         args = %w(--json --long)

data/lib/licensed/version.rb

@@ -1,6 +1,6 @@
 # frozen_string_literal: true
 module Licensed
-  VERSION = "2.11.1".freeze
+  VERSION = "2.14.0".freeze
 
   def self.previous_major_versions
     major_version = Gem::Version.new(Licensed::VERSION).segments.first

data/licensed.gemspec

@@ -38,5 +38,4 @@ Gem::Specification.new do |spec|
   spec.add_development_dependency "rubocop", "~> 0.49", "< 0.67"
   spec.add_development_dependency "rubocop-github", "~> 0.6"
   spec.add_development_dependency "byebug", "~> 10.0.0"
-  spec.add_development_dependency "spy",  "~> 1.0.0"
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: licensed
 version: !ruby/object:Gem::Version
-  version: 2.11.1
+  version: 2.14.0
 platform: ruby
 authors:
 - GitHub
 autorequire: 
 bindir: exe
 cert_chain: []
-date: 2020-06-09 00:00:00.000000000 Z
+date: 2020-10-04 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: licensee
@@ -218,20 +218,6 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: 10.0.0
-- !ruby/object:Gem::Dependency
-  name: spy
-  requirement: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 1.0.0
-  type: :development
-  prerelease: false
-  version_requirements: !ruby/object:Gem::Requirement
-    requirements:
-    - - "~>"
-      - !ruby/object:Gem::Version
-        version: 1.0.0
 description: Licensed automates extracting and validating the licenses of dependencies.
 email:
 - opensource+licensed@github.com