dennisdoomen / packageguard / 40126531601

82%

Build Type

push

github

Committed by web-flow

Commit Message

Run without a configuration file instead of failing (#310)

* Run without a configuration file instead of failing

When PackageGuard finds no configuration file, it now uses a default
policy that only allows the permissive licenses known to the license
classifier (MIT, Apache-2.0, BSD, ISC and similar). It logs one warning
per run that points to 'packageguard init'.

Before this change, a .NET project without a config failed with "Either a
allowlist or a denylist must be specified", and an npm project silently
allowed every package.

PackageGuard no longer loads a config.json from the working directory
when --config-path is left out. Any unrelated file with that name used to
be read as the policy, which brought back the same failure.

The analyze and explain commands now share one method that picks between
the explicit --config-path and the discovered configuration files.

Closes #299

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

* Fail when an explicit --config-path does not exist

An explicit --config-path to a missing file used to load an empty policy
without any message. The analyze and explain commands now reject it
during option validation, with an error that names the file, so a typo
in the path can't go unnoticed. Leaving the option out still uses the
discovered configuration files, or the default policy.

Errors in the command-line options, like this one, now print only their
message instead of a stack trace.

Also mention the default policy on the init docs page.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 5.5 <noreply@anthropic.com>

Coverage Stats

2608 of 3518 branches covered (74.13%)

Branch coverage included in aggregate %.

39 of 53 new or added lines in 8 files covered. (73.58%)

4 existing lines in 2 files now uncovered.

8224 of 9826 relevant lines covered (83.7%)

1920.55 hits per line