dennisdoomen / packageguard / 35264619275

82%

push

github

Skip the risk-report license URL check for well-known license URLs (#259)

The risk report's LicenseUrlRiskEnricher was sending a live HTTP
request to validate every package's license URL as a reachability
signal, even for canonical URLs like apache.org/licenses/LICENSE-2.0
that are already known-good. This caused unnecessary (and sometimes
flaky, e.g. connection resets) network calls during risk metadata
collection.

Extract the well-known license URL patterns (previously private to
WellKnownLicenseUrlFetcher) into a shared WellKnownLicenseUrls helper,
and have LicenseUrlRiskEnricher accept those URLs without probing them
over the network.

Co-authored-by: Claude Sonnet 5 <noreply@anthropic.com>

2137 of 2892 branches covered (73.89%)

Branch coverage included in aggregate %.

40 of 40 new or added lines in 3 files covered. (100.0%)

6745 of 7967 relevant lines covered (84.66%)

1732.06 hits per line