License Compliance

Purpose

ScanCode performs text-level license, copyright and provenance detection — comparing actual file contents against a database of license texts. This finds what Trivy's package-metadata license scan misses: licenses in vendored code, copied snippets, and undeclared/ambiguous files.

Relation to Trivy (similar but more): Trivy reports declared dependency licenses from manifests. ScanCode reads the source itself, adding file-level detection Trivy cannot do. Use ScanCode when real license compliance matters; for a quick dependency-license view, Trivy is enough.

What it actually outputs (important)

By default the scan does not leave a JSON in your repo. It mounts the project read-only, writes the full result to a temporary directory, evaluates a license policy against it, prints a verdict, and deletes the temp JSON on exit. So the normal output is the PASS / FAIL / REVIEW verdict, not a per-file file in the tree. To keep the full per-file JSON for review, opt in with SCANCODE_KEEP_JSON=/path/out.json.

The license policy gate

• SCANCODE_DENY is a case-insensitive regex of disallowed license expressions. Default: GPL/AGPL (copyleft) — LGPL is allowed.
• A detected disallowed license → RESULT: FAIL, exit 1 (a finding; in the suite this turns the verdict to FINDINGS).
• No disallowed license → RESULT: PASS, exit 0.
• SCANCODE_DENY="" → review-only mode: detect + report, never gate (RESULT: REVIEW, exit 0).

Because the suite runs ScanCode on every project, a single GPL/AGPL file flips the whole suite to FINDINGS — that is intentional. Adjust SCANCODE_DENY if a given copyleft license is acceptable for your project.

Core Workflow

1. Scan:

   ~/.claude/skills/license-compliance/scripts/scan.sh [TARGET_DIR]

   First run builds the scancode-local image (downloads ScanCode, a few minutes).
2. On FAIL, the verdict lists the disallowed license expression(s) and an example file. Replace/remove the offending dependency or file, or — if the license is acceptable — widen SCANCODE_DENY.
3. For a deep per-file review (copyrights, provenance, ambiguous files), re-run with SCANCODE_KEEP_JSON=/tmp/scancode.json and inspect that JSON.
4. Re-run until RESULT: PASS.

Notes

• Project is mounted read-only; the result JSON lives in a temp dir and is removed on exit — nothing is written into the scanned tree.
• Scanning is CPU-intensive; node_modules, .git, */test/*, dist, build and megalinter-reports are ignored by default. Add globs via SCANCODE_IGNORE.
• SCANCODE_PROCESSES controls parallelism (default 4). SCANCODE_PLATFORM defaults to linux/amd64 (ScanCode's native libs are amd64 wheels).

Resources

• scripts/Dockerfile — builds a minimal ScanCode image from PyPI.
• scripts/scan.sh — builds the image if needed, runs ScanCode (license + copyright + package) to a temp JSON, evaluates the license policy, and exits 0/1 (or 125 on an operational error). Env: SCANCODE_DENY, SCANCODE_KEEP_JSON, SCANCODE_IGNORE, SCANCODE_PROCESSES, SCANCODE_PLATFORM, SCANCODE_IMAGE.