scancode reports no license detected for files in CI

By Kaveh Alemi·Latchkey

ScanCode produced results with no license detected for files either because you did not pass --license, or because the source has no detectable license text. A downstream policy step that requires a license then fails.

What this error means

The JSON output shows empty licenses / license_detections arrays for files you expected to be attributed, and a follow-on gate flags files as unlicensed.

"files": [
  { "path": "src/util.js", "license_detections": [], "detected_license_expression": null }
]

Common causes

The --license option was not enabled

ScanCode only detects licenses when license scanning is requested. Running just --copyright or --info yields no license detections.

The files genuinely lack license text

Source files with no header and no nearby LICENSE cannot be attributed, so ScanCode correctly reports nothing to detect.

How to fix it

Enable license scanning

1. Add --license (and often --copyright) to the scancode command.
2. Point the scan at the source tree that should carry license headers.
3. Re-run and confirm detected_license_expression is populated.

scancode --license --copyright --json-pp out.json ./src

Add missing license headers

For files that legitimately lack a license, add an SPDX header so ScanCode and downstream policy tools can attribute them.

// SPDX-License-Identifier: MIT
// Copyright 2026 Example Corp

How to prevent it

• Always pass --license when the goal is license attribution.
• Enforce SPDX headers in source so detection is deterministic.
• Separate "scan misconfigured" from "file truly unlicensed" in review.

Frequently asked questions

Related guides

References

• GitHub Actions documentation