Explicit --licenses=false enables license scanning

[Muszic]

Summary

--licenses is a hybrid Boolean/list flag, but explicitly setting it to false still enables license scanning.

The custom value accepts false as a Boolean value, while downstream code uses only cmd.IsSet("licenses") to populate ScannerActions.ScanLicensesSummary. Because IsSet records flag presence rather than its Boolean value, both --licenses=true and --licenses=false enable the feature.

Current main reproduced at 43026d7a28e5a8ad52c7b4ba3b62047fbf52ad31.

Minimal reproduction

go run ./cmd/osv-scanner scan source \
  --offline \
  --licenses=false \
  ./cmd/osv-scanner/scan/source/testdata/locks-many/package-lock.json

Actual result:

cannot retrieve licenses locally
exit status 127

Expected result:

--licenses=false should leave license scanning disabled, so it should not trigger the offline/license incompatibility.

Impact

This affects generated CI commands and wrapper scripts that emit explicit Boolean assignments. A configuration intended to disable license scanning can unexpectedly enable a network-backed scan or fail in offline mode.

Root cause

allowedLicencesFlag.Set handles false but does not preserve whether the value is enabled. GetCommonScannerActions then sets ScanLicensesSummary from cmd.IsSet("licenses").

The IsBoolFlag comment already states that the flag supports enable/disable values, so the current result is inconsistent with that contract.

Suggested fix

Track the enabled state in allowedLicencesFlag, use that state when building ScannerActions, and add focused tests for unset, implicit true, explicit true, explicit false, and allowlist values.

I searched existing issues and pull requests and did not find this behavior reported. If this approach looks valid, please assign the issue to @Muszic and I can submit the focused fix with regression tests.

[laishettikarthik-tech]

Hi @Muszic, I’d like to work on this issue if it’s still available.

The root cause and proposed fix are clear. I’ll implement the enabled-state tracking for allowedLicencesFlag, update GetCommonScannerActions to use the actual flag value, and add focused regression tests covering unset, implicit true, explicit true, explicit false, and allowlist values.

Thanks for the detailed reproduction and analysis!

[Muszic]

@laishettikarthik-tech i am going to work on this as the contribution guide says , A approver need to approve my plan here first , So i am waiting for the same and implement the solution as a Maintainer approves the solution and issue , Please go through the guide first

[another-rex]

Thanks for the report! I have assigned this to you.

[Muszic]

@another-rex I have raised the PR , please check and review , Thanks .