Composer licence Id checking to broad

[northern]

My package is currently marked as a "broken state" because one branch, that might or might not be abandoned in the future, has a Composer licence Id issue.

Reading composer.json of northern/common (feature-filter-helper)
Importing branch feature-filter-helper (dev-feature-filter-helper)
Skipped branch feature-filter-helper, Invalid package information:
License "gpl" is not a valid SPDX license identifier, see https://spdx.org/licenses/ if you use an open license.
If the software is closed-source, you may use "proprietary" as license.

To me it seems that Packagist's composer licence checking is doing this for all branches where I think that's not entirely fair. To me it seems reasonable to only do this sort of checking on master, or maybe even better, the "default" branch (GitHub; Repos Settings -> Branches -> Default Branch) instead of all branches in the repository. Development branches might have issues in them, including composer licence Id issues that will be fixed when merged in the future.

[pounard]

I have a similar problem, and even worse it does check for each tag when you manually click the update button -> packagist is spamming we from 3 to 5 or 6 email on each push in a project were I did fix the SPDX licence identifier: #883.

[AnrDaemon]

It should not be issuing warnings on //branches// other than project head, IMO.

[pounard]

@AnrDaemon probably, but why does I get so many mails with a project I fixed ?

[Jean85]

Probably because you have older branches still open that does not contain the fix?

[AnrDaemon]

Why should they? It's just old/dead branches, I'm not obliged to cleanup.

[pounard]

I agree with @AnrDaemon that's a real usability issue, some rather old projects might contain tons of outdated branches. I now that we all need to do some cleanup at some point, but we can't just be forced to do it.

[AnrDaemon]

A simple solution to arbitrate these checks would be to only check branches with explicit aliases set in composer.json.

[stof]

@Seldaek AFAICT, composer has some unreleased changes which would help here

[Seldaek]

Pushed composer/composer@72476b6 which now only validates licenses for branches updated recently.