licence_audit

A CLI for the locked dependencies in a Gleam project. It reports Hex package licences, previews or enforces a licence policy, creates CycloneDX SBOMs and third-party notices, and checks for known vulnerabilities through OSV.dev.

Install

Download a self-contained archive for your platform from the releases, extract it, and put licence_audit on your PATH. These executables include the Erlang runtime; you do not need to install Erlang/OTP. Prefer them for CI.

With mise:

mise use -g github:tylerbutler/licence_audit@latest

To pin a version, replace latest with an exact release tag (vX.Y.Z). Choose a tag from a published release. Omit -g for a project-local install.

The release also provides escript archives and a bare escript. The escript requires Erlang/OTP 28 or newer for all commands. Windows ARM64 archives are not published.

On OTP 27, the VM can fail to load the escript with corrupt atom table and exit 127, before any command runs. This unsupported-runtime failure is outside the CLI exit-code contract.

For source builds, see DEV.md.

Documentation

The website is the canonical user documentation. It contains installation and setup guidance, generated CLI usage and flag tables, and command behavior:

• Quick start
• GitHub Actions
• Licence policy and checks
• Create a policy
• SBOMs
• Third-party notices
• Vulnerability reports
• Configuration discovery
• Compatibility policy

Use licence_audit --help or licence_audit <command> --help for the CLI options in your installed version. -h is an alias for --help. --version is available only at the root.

Contributing and security

See DEV.md for development commands and SECURITY.md for supported versions and private vulnerability reporting.