Question

Your company ships proprietary software and must ensure that no open-source dependency introduces a copyleft license (such as GPL) into the codebase. You want to automatically block any Azure DevOps pipeline build that pulls in a dependency with a prohibited license, and you want the results centrally visible. Which approach best meets this requirement?

Accepted Answer

Integrate a software composition analysis (SCA) tool such as Mend (WhiteSource) or Snyk into the pipeline, configure a license policy that fails the build on prohibited licenses, and publish results as pipeline artifacts.

Answer

Enable GitHub Advanced Security secret scanning on the Azure Repos repository to detect license strings in source files.

Answer

Add a Dependabot configuration file to the repository to automatically open pull requests updating dependencies to newer license versions.

Answer

Store all approved licenses in Azure Key Vault and reference them as pipeline variables so the build only uses vaulted dependencies.