chronograph-pe/verify-license
Cross-references dependency license violations against the authoritative package registry, corrects SBOM metadata where wrong, and returns only confirmed violations
View on GitHubTrust Signals
- Scorecard Score
- not yet scored
- Maintenance Recency
- Activelast commit Apr 16, 2026
- License
- None
Pinned Snippet
uses: chronograph-pe/verify-license@5d293dcdf0ab389cc96d32de0b4d8cd196b5cde6 # no releases — HEAD as of 2026-07-11tags can be moved; commit SHAs can't. why a SHA?
Inputs
| name | description | required | default |
|---|---|---|---|
| violations | JSON array of violations from Dependency Track | yes | — |
| language | Language of the scanned project (node or ruby) | yes | — |
| bom-file | Path to bom.xml relative to the workspace root | yes | — |
Outputs
| name | description |
|---|---|
| confirmed | JSON array of violations confirmed by the package registry |
| has_corrections | true if bom.xml was updated with corrected license metadata |