Merge pull request #56 from madewithlove/feature/config-restructure

Restructure config: support allowed and denied license modes

Author: jdrieghe

.allowed-licenses

@@ -0,0 +1,6 @@
+allowed:
+    - Apache-2.0
+    - BSD-3-Clause
+    - ISC
+    - MIT
+    - OSL-3.0

.license-checker.yml

@@ -1,49 +1,78 @@
 # CLI Licence checker for composer dependencies
 This library offers a simple CLI tool to show the licenses used by composer dependencies in your project.
-These licenses can be verified against a list of allowed licenses to offer a way for your continuous integration
+These licenses can be verified against a list of allowed (or denied) licenses to offer a way for your continuous integration
 pipeline to block merging when a non-verified license is being introduced to the codebase.
 
+## Upgrading from 2.x
+
+Version 3.x introduces a new structured configuration format. Run the migration command to upgrade:
+
+```
+vendor/bin/license-checker migrate-config --remove-old
+```
+
+This converts your `.allowed-licenses` file to the new `.license-checker.yml` format. See [full migration details](#migrating-from-2x) below.
+
 ## Installation
 Installing should be a breeze thanks to `composer`:
-Note that you need PHP 8.3 to install the latest version (2.x).
-If you are using an older version of PHP, older versions can be installed.
+Note that you need PHP 8.4 to install the latest version (3.x).
 
 ```
 composer require madewithlove/license-checker
 ```
 
 ## Configuration
-To configure a list of allowed licenses, simply create an `.allowed-licenses` file in the root of your project (where `composer.json` is located).
-The file could look like this:
+Create a `.license-checker.yml` file in the root of your project (where `composer.json` is located).
+
+### Allowlist mode
+Only the listed licenses are permitted. Any dependency using a license not on this list will be flagged:
+```yaml
+# .license-checker.yml
+allowed:
+  - MIT
+  - BSD-3-Clause
+  - Apache-2.0
 ```
-# contents of .allowed-licenses
-- MIT
-- BSD-3-Clause
-- New BSD License
+
+### Denylist mode
+All licenses are permitted **except** the ones listed. Use this when you want to block specific licenses:
+```yaml
+# .license-checker.yml
+denied:
+  - GPL-3.0
+  - AGPL-3.0
 ```
 
+> **Note:** `allowed` and `denied` are mutually exclusive — you must use one or the other, not both.
+
 It's possible to use a custom configuration file by passing the `--filename` (or `-f`) option to the CLI commands.
 
 ## Usage
-These are the different CLI commands
+These are the different CLI commands:
+
+### Check licenses
+```
+vendor/bin/license-checker check
+```
 
 ### List used licenses
 ```
 vendor/bin/license-checker used
 ```
 
-### List allowed licenses
+### List configured licenses
+Shows the configured allowed or denied licenses:
 ```
-vendor/bin/license-checker allowed
+vendor/bin/license-checker list-config
 ```
 
-### Check licenses
+### Count used licenses
 ```
-vendor/bin/license-checker check
+vendor/bin/license-checker count
 ```
 
 ### Automatically generate configuration
-This command will automatically generate an `.allowed-licenses` configuration based on the currently used licenses.
+This command will automatically generate a `.license-checker.yml` configuration in allowlist mode based on the currently used licenses:
 ```
 vendor/bin/license-checker generate-config
 ```
@@ -52,23 +81,28 @@ vendor/bin/license-checker generate-config
 Passing the `--no-dev` option to the CLI commands will scope all checks to production dependencies only.
 Checking production and development dependencies against separate configuration files is possible by passing options:
 ```
-vendor/bin/license-checker check --no-dev --filename .allowed-licenses-production
-vendor/bin/license-checker check --filename .allowed-licenses-including-dev
+vendor/bin/license-checker check --no-dev --filename .license-checker-production.yml
+vendor/bin/license-checker check --filename .license-checker-including-dev.yml
 ```
 
 ### Output Formats (--format option)
-You can now choose how license information is displayed either as a human-readable table (text) or in machine-readable JSON format.
+You can choose how license information is displayed — either as a human-readable table (text) or in machine-readable JSON format.
 
 ```
 vendor/bin/license-checker check --format=json
 ```
 
 ```json
 {
-    "laravel/framework": "MIT",
-    "phpunit/phpunit": "BSD-3-Clause"
+    "laravel/framework": {
+        "license": "MIT",
+        "is_allowed": true
+    },
+    "phpunit/phpunit": {
+        "license": "BSD-3-Clause",
+        "is_allowed": false
+    }
 }
-
 ```
 
 ```
@@ -78,8 +112,49 @@ vendor/bin/license-checker check --format=text
 ```
 ✓  phpunit/phpunit [BSD-3-Clause]
 ✓  symfony/console [MIT]
-✓  vimeo/psalm [MIT]
 ```
 
 By default, results are printed as human-readable text.
-Use --format=json for structured machine-readable output.
+Use `--format=json` for structured machine-readable output.
+
+## Migrating from 2.x
+
+Version 3.x introduces a new structured configuration format. Here's what changed:
+
+### Configuration file format
+The old format was a plain YAML list in `.allowed-licenses`:
+```yaml
+# OLD format (.allowed-licenses) — no longer supported
+- MIT
+- BSD-3-Clause
+```
+
+The new format uses a structured YAML file (`.license-checker.yml`) with an explicit `allowed` or `denied` key:
+```yaml
+# NEW format (.license-checker.yml)
+allowed:
+  - MIT
+  - BSD-3-Clause
+```
+
+### Automatic migration
+Use the `migrate-config` command to convert your old configuration:
+```
+vendor/bin/license-checker migrate-config
+```
+
+This reads `.allowed-licenses` and writes `.license-checker.yml` with the `allowed:` key.
+
+To also remove the old file:
+```
+vendor/bin/license-checker migrate-config --remove-old
+```
+
+### Renamed commands
+| 2.x | 3.x |
+|-----|-----|
+| `allowed` | `list-config` |
+
+### Other breaking changes
+- Minimum PHP version is now 8.4 (was 8.3)
+- Minimum Symfony version is now 7.4 (was 4.0)

README.md

@@ -4,14 +4,15 @@
 use LicenseChecker\Commands\CheckLicenses;
 use LicenseChecker\Commands\CountUsedLicenses;
 use LicenseChecker\Commands\GenerateConfig;
-use LicenseChecker\Commands\ListAllowedLicenses;
+use LicenseChecker\Commands\ListConfiguredLicenses;
 use LicenseChecker\Commands\ListUsedLicenses;
+use LicenseChecker\Commands\MigrateConfig;
 use LicenseChecker\Commands\Output\TableRenderer;
 use LicenseChecker\Composer\DependencyTree;
 use LicenseChecker\Composer\DependencyTreeRetriever;
 use LicenseChecker\Composer\UsedLicensesParser;
 use LicenseChecker\Composer\UsedLicensesRetriever;
-use LicenseChecker\Configuration\AllowedLicensesParser;
+use LicenseChecker\Configuration\LicenseConfigurationParser;
 use Symfony\Component\Console\Application;
 
 $potentialAutoLoaderFiles = [
@@ -25,14 +26,15 @@ foreach ($potentialAutoLoaderFiles as $potentialAutoLoaderFile) {
     }
 }
 
-$application = new Application('License Checker', '2.0');
+$application = new Application('License Checker', '3.0');
 
-$allowedLicensesParser = new AllowedLicensesParser((string) getcwd());
+$workingDirectory = (string) getcwd();
+$configParser = new LicenseConfigurationParser($workingDirectory);
 $usedLicensesParser = new UsedLicensesParser(new UsedLicensesRetriever());
 
 $checkLicenses = new CheckLicenses(
     $usedLicensesParser,
-    $allowedLicensesParser,
+    $configParser,
     new DependencyTree(
         new DependencyTreeRetriever(),
         $usedLicensesParser
@@ -42,8 +44,9 @@ $checkLicenses = new CheckLicenses(
 
 $application->addCommand($checkLicenses);
 $application->addCommand(new ListUsedLicenses($usedLicensesParser));
-$application->addCommand(new ListAllowedLicenses($allowedLicensesParser));
-$application->addCommand(new GenerateConfig($allowedLicensesParser, $usedLicensesParser));
+$application->addCommand(new ListConfiguredLicenses($configParser));
+$application->addCommand(new GenerateConfig($configParser, $usedLicensesParser));
 $application->addCommand(new CountUsedLicenses($usedLicensesParser));
+$application->addCommand(new MigrateConfig($configParser, $workingDirectory));
 
 $application->run();

bin/license-checker

@@ -8,26 +8,27 @@
 use LicenseChecker\Commands\Output\TableRenderer;
 use LicenseChecker\Composer\DependencyTree;
 use LicenseChecker\Composer\UsedLicensesParser;
-use LicenseChecker\Configuration\AllowedLicensesParser;
+use LicenseChecker\Configuration\InvalidConfiguration;
+use LicenseChecker\Configuration\LicenseConfigurationParser;
+use LicenseChecker\Output\OutputFormat;
+use LicenseChecker\Output\OutputFormatterFactory;
 use Symfony\Component\Console\Command\Command;
 use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Input\InputOption;
 use Symfony\Component\Console\Output\OutputInterface;
 use Symfony\Component\Console\Style\SymfonyStyle;
 use Symfony\Component\Process\Exception\ProcessFailedException;
 use Symfony\Component\Yaml\Exception\ParseException;
-use LicenseChecker\Output\OutputFormatterFactory;
-use LicenseChecker\Output\OutputFormat;
 
 final class CheckLicenses extends Command
 {
     private const string NAME = 'check';
 
     public function __construct(
         private readonly UsedLicensesParser $usedLicensesParser,
-        private readonly AllowedLicensesParser $allowedLicensesParser,
+        private readonly LicenseConfigurationParser $configParser,
         private readonly DependencyTree $dependencyTree,
-        private readonly TableRenderer $tableRenderer
+        private readonly TableRenderer $tableRenderer,
     ) {
         parent::__construct(self::NAME);
     }
@@ -66,13 +67,13 @@ protected function execute(InputInterface $input, OutputInterface $output): int
         try {
             /** @var string|null $fileName */
             $fileName = is_string($input->getOption('filename')) ? $input->getOption('filename') : null;
-            $allowedLicenses = $this->allowedLicensesParser->getAllowedLicenses($fileName);
-        } catch (ParseException $e) {
+            $config = $this->configParser->parse($fileName);
+        } catch (ParseException | InvalidConfiguration $e) {
             $output->writeln($e->getMessage());
             return 1;
         }
 
-        $notAllowedLicenses = array_diff($usedLicenses, $allowedLicenses);
+        $notAllowedLicenses = $config->findViolations($usedLicenses);
         $dependencies = $this->dependencyTree->getDependencies((bool)$input->getOption('no-dev'));
 
         $dependencyChecks = [];

src/Commands/CheckLicenses.php

@@ -5,8 +5,9 @@
 namespace LicenseChecker\Commands;
 
 use LicenseChecker\Composer\UsedLicensesParser;
-use LicenseChecker\Configuration\AllowedLicensesParser;
 use LicenseChecker\Configuration\ConfigurationExists;
+use LicenseChecker\Configuration\LicenseConfiguration;
+use LicenseChecker\Configuration\LicenseConfigurationParser;
 use Symfony\Component\Console\Command\Command;
 use Symfony\Component\Console\Input\InputInterface;
 use Symfony\Component\Console\Input\InputOption;
@@ -19,15 +20,15 @@ final class GenerateConfig extends Command
     private const string NAME = 'generate-config';
 
     public function __construct(
-        private readonly AllowedLicensesParser $allowedLicensesParser,
-        private readonly UsedLicensesParser $usedLicensesParser
+        private readonly LicenseConfigurationParser $configParser,
+        private readonly UsedLicensesParser $usedLicensesParser,
     ) {
         parent::__construct(self::NAME);
     }
 
     protected function configure(): void
     {
-        $this->setDescription('Generates allowed licenses config based on used licenses');
+        $this->setDescription('Generates license configuration based on used licenses');
         $this->addOption('no-dev', null, InputOption::VALUE_NONE, 'Do not include dev dependencies');
         $this->addOption(
             'filename',
@@ -42,20 +43,18 @@ protected function execute(InputInterface $input, OutputInterface $output): int
         $io = new SymfonyStyle($input, $output);
 
         try {
-            $usedLicenses = $this->usedLicensesParser->parseLicenses((bool)$input->getOption('no-dev'));
+            $usedLicenses = $this->usedLicensesParser->parseLicenses((bool) $input->getOption('no-dev'));
         } catch (ProcessFailedException $e) {
             $io->error($e->getMessage());
             return 1;
         }
 
-        sort($usedLicenses);
-
         try {
             /** @var string|null $fileName */
             $fileName = is_string($input->getOption('filename')) ? $input->getOption('filename') : null;
-            $this->allowedLicensesParser->writeConfiguration($usedLicenses, $fileName);
+            $this->configParser->writeConfiguration(LicenseConfiguration::allowed($usedLicenses), $fileName);
             $io->success('Configuration file successfully written');
-        } catch (ConfigurationExists $e) {
+        } catch (ConfigurationExists) {
             $io->error('The configuration file already exists. Please remove it before generating a new one.');
             return 1;
         }