depproof

Guide

Maven license check without building your project

You want every dependency’s license — the whole transitive tree, not just your direct pom.xml entries — and you want it in CI without running a full Maven build or committing a lockfile. Here’s how to do it in about five minutes.

Updated 18 Jul 2026 · by the depproof team

Why the usual Maven license plugins make you build

Most Maven license tooling — license-maven-plugin and friends — binds to a build lifecycle phase. To see the resolved license of a transitive dependency, the plugin needs Maven to resolve the project first, which in practice means a working build environment, the right JDK, network access to your repositories, and often a successful compile. That’s fine locally; it’s friction in CI, and it’s a non-starter when you only have the source, a mirror is down, or the build is flaky for reasons that have nothing to do with licenses.

The information you actually need — which licenses are in my dependency graph, direct and transitive — is fully determined by the POMs. You shouldn’t need to compile anything to get it.

The approach: resolve the tree, not the build

depproof reads your POMs and covers the complete Maven (and Gradle) transitive dependency tree, classifies each license (allowed, review, or forbidden), and emits a report plus a CycloneDX SBOM. No build step, no lockfile, no dependency-submission dance. It runs as a single container or a GitHub Action, on your own infrastructure.

Option 1 · GitHub Action

Drop this into a workflow. It resolves the tree, classifies every license in a report, and uploads the report and SBOM as build artifacts — no mvn install anywhere in the job. 

# .github/workflows/license-audit.yml
name: license-audit
on: [pull_request]

jobs:
  licenses:
    runs-on: ubuntu-latest
    steps:
      - uses: actions/checkout@v4
      - uses: depproof/depproof-action@v1
        with:
          fail-on: none  # report-only; license CI gating is on the roadmap

Note there is no build step in the job — checkout then depproof. The full transitive tree is resolved from your POMs, not from a compiled project.

Option 2 · Docker container (any CI, or local)

The same scanner ships as one public image. Ideal for GitLab CI, Jenkins, locked-down pipelines, or a quick check on your laptop. It runs and exits, leaving the report behind. 

# pull the scanner
docker pull ghcr.io/depproof/depproof:v0

# audit the current Maven project — no build, writes an HTML report locally
docker run --rm -v $PWD:/work -w /work ghcr.io/depproof/depproof:v0 \
  scan --discover --root /work --fail-on none --html --output-dir /work

Reading the license report

depproof classifies every license it finds as allowed, review, or forbidden — so a copyleft license anywhere in the transitive tree, including one pulled in three levels deep by a dependency you never chose, lands in the report’s forbidden bucket, and the CycloneDX SBOM carries the license for every component. Whether a given copyleft finding is actually a dealbreaker depends on how you use it — see is AGPL safe for commercial and SaaS use?

Today this is report-only for licenses — you review the forbidden findings. Automated CI gating on a license policy (allow/deny lists) is on the roadmap. To fail a build today, depproof gates on vulnerability severity with fail-on: critical | high | medium | low | none.

What you get out

  • A clear license for every dependency — direct and transitive, named consistently so you can set policy on it.
  • A self-contained HTML report — no external fonts, CDN, or JS. Safe to archive as compliance evidence.
  • A CycloneDX SBOM — the standard artifact for EU CRA obligations, US federal contract terms, and vendor risk reviews.
  • A pass/fail exit code — non-zero when policy fails, so it gates PRs like any other check.

What about Gradle?

Maven POMs are declarative data, so depproof resolves them fully from source with no build. Gradle is different: a build.gradle(.kts) is a program, so the only reliable way to know the exact graph is to let Gradle resolve it — Gradle projects are resolved after your build (the docs show the exact setup). The no-build story is strongest for Maven — which is exactly what this guide is about.

Related guides

Audit your licenses → Read the docs More guides

This guide shows the shape of the workflow; the action README is the source of truth for exact inputs and the current release. depproof is free for open source and teams under $1M revenue — see pricing.