Artifactory与Gradle：如何通过Gradle插件执行许可证检查

Great question! Let’s break down what you can do with the Gradle Artifactory plugin for license checks, and how to set up email alerts for violations.

1. Does the Gradle Artifactory Plugin handle license checking on its own? #

Yes, the plugin does include built-in license scanning capabilities—it’s not just for viewing license details after the fact. You can configure rules to block builds with restricted licenses, flag risky ones as warnings, and generate detailed reports.

Here’s a sample configuration to add to your build.gradle file to enable and customize license checks:

artifactory {
    // Your existing publish/resolve config here...

    licenses {
        // Enable license scanning during builds
        enabled = true

        // Define license rules (block, warn, or allow specific licenses)
        rules {
            // Block builds that include GPLv3-licensed dependencies
            rule {
                licenseKey = "GPL-3.0"
                action = "BLOCK"
            }
            // Flag LGPL 2.1 dependencies as warnings
            rule {
                licenseKey = "LGPL-2.1"
                action = "WARN"
            }
        }

        // Generate a local license report for debugging
        report {
            enabled = true
            outputDir = file("$buildDir/reports/licenses")
        }
    }
}

When you run your build (e.g., ./gradlew build artifactoryPublish), the plugin will scan all dependencies against these rules. If a rule is triggered (like a blocked license), the build will fail immediately.

2. How to set up email alerts for license violations? #

The Gradle Artifactory plugin itself can’t send email alerts directly—it’s focused on build integration and artifact management, not notification workflows. You have two reliable options to set up alerts:

Option 1: Use Artifactory’s built-in alert system #

Artifactory has native alerting that triggers when license violations are detected, regardless of how the artifact was pushed (Gradle, Maven, CI, etc.). Here’s how to configure it:

• Log into your Artifactory web UI
• Go to Admin > Alerts
• Click New Alert
• Set the trigger condition to License Violation
• Configure the alert details (name, description)
• Add your target email addresses in the Recipients section
• Save the alert

Now any license violation (from Gradle builds or other sources) will send an email to your specified addresses.

Option 2: Integrate with your CI/CD tool #

If you’re using a CI tool like Jenkins, GitLab CI, or GitHub Actions, you can add steps to check the license report generated by the Gradle plugin and send alerts on failures.

For example, a Jenkins Pipeline snippet to send an email when a license violation blocks the build:

stage('Build & Validate Licenses') {
    steps {
        sh './gradlew build artifactoryPublish'
    }
    post {
        // Publish the license report for visibility
        always {
            publishHTML(target: [
                reportDir: 'build/reports/licenses',
                reportFiles: 'index.html',
                reportName: 'Dependency License Report'
            ])
        }
        // Send alert email if build fails due to license issues
        failure {
            emailext(
                to: 'team-alerts@yourcompany.com',
                subject: 'URGENT: Build Failed - License Violation Detected',
                body: 'Please review the license report in Jenkins to resolve the issue.'
            )
        }
    }
}

Final Notes #

The Gradle Artifactory plugin handles the heavy lifting of license scanning and enforcement, but email alerts require either Artifactory’s native system or your CI tool. Combining both gives you the best visibility: Artifactory monitors all artifacts in the repository, while CI alerts you immediately when a build fails due to license rules.

内容的提问来源于stack exchange，提问作者David North