feat: report packages with viral LICENSE files

[alestiago]

Description

Projects dependencies should always use non-viral LICENSEs. As a user of Very Good CLI I would like to have the ability to quickly know if my projects are using a viral LICENSE and report back.

Proposals

The following proposal are draft ideas and they are open to change.

Proposal 1: Update packages get

Upon very_good packages get, perform a check on the dependencies and ensure they have non-viral LICENSEs. Allow the user to include a list of desired licences via --licenses (or --approved-licenses). If the check is always performed allow the user to specify --no-license-check to avoid checking licenses. Alternatively only perform the check when given --licenses. I personally prefer the user to opt-out of the check.

Proposal 2: Introduce packages check (or packages analyze)

Create a new subcommand on packages to perform the check. Allow the user to include a list of desired licences via --licenses (or --approved-licenses). Future conditions to check the quality of a package can be introduced. Like for example, checking the pana score of those that are hosted in pub.dev, or ensuring they have test coverage. If so, --no-license-check could also be introduced.

In contrast with the first proposal, this covers those cases where the user might already have dependencies up to date and will only want to check the packages.

Further Context

• Display package license on version info api endpoint dart-lang/pub-dev#4717
• PANA's license detection

[alestiago]

This is now a support feature, see the documentation.