jEAP Frontend License Checker

License policy checker and third-party notice generator for jEAP frontend projects.

jeap-frontend-license-checker inspects the npm dependencies installed in a project, checks their licenses against a license policy and fails the build when a dependency is not covered. It also generates the third-party notice file that lists those dependencies and their licenses.

The accepted permissive licenses ship with the tool. A project without configuration is already checked against the jEAP policy and only declares the exceptions it actually needs.

The tool has no runtime dependencies.

Installation

npm install --save-dev @jeap/jeap-frontend-license-checker

Wire it into the project's scripts:

{
  "scripts": {
    "check-licenses": "jeap-frontend-license-checker",
    "generate-license-file": "jeap-frontend-license-checker notices --out ../THIRD-PARTY-FRONTEND-LICENSES.md"
  }
}

Usage

npx jeap-frontend-license-checker            # check the installed dependencies
npx jeap-frontend-license-checker notices    # write the third-party notices

The short alias jeap-license-check is installed as well.

Run jeap-frontend-license-checker --help for the full list of options; the settings behind them are documented in docs/configuration.md.

Exit codes:
  0  the check passed
  1  the license policy was violated
  2  the invocation or the configuration is wrong
  3  the dependency tree could not be scanned completely

The check only reports success when it examined everything. A dependency that could not be resolved or read makes the scan incomplete and fails the run, because a package nobody looked at must not be able to pass. See the "Incomplete scans" section of docs/policy.md.

Configuration

Everything is optional. Put the settings into jeap-license-check.json next to the project's package.json, or into a jeapLicenseCheck key inside package.json:

{
  "exceptions": {
    "@quadrel-enterprise-ui/*": {
      "reason": "Runtime dependencies whose published npm packages omit SPDX license metadata."
    }
  }
}

See docs/configuration.md for every setting and docs/policy.md for the licenses the built-in policy accepts.

Why this tool

The tool it replaces resolved a wildcard exception by taking everything before the first @ of a package key. For a scoped package such as @scope/package@1.2.3 that yields an empty package name, so @scope/package@* never matched and every exempted scoped package had to be pinned to an exact version — breaking the build on each dependency update. On top of that, the license policy lived in each project, so a new transitive dependency with an already approved license broke the build as well.

This tool splits a package key at its last @, ships the policy with the checker, and evaluates SPDX expressions instead of requiring an exception per dual licensed package.

Documentation

Topic	Description
Getting started	Adding the checker to a project
Notices	The third-party notice file and the license texts
Configuration	Every configuration setting
Policy	The licenses the built-in policy accepts, and how to change it
Migration	Replacing the previous license checker
Development	Local development, scripts and CI
Publishing and versioning	Release process
npm publishing setup	One-time maintainer setup

License

This project is licensed under the Apache License 2.0.