Dependency-review license gate blocks routine tool bumps — add package exceptions #339

Problem

PR #335 (Dependabot bump of sonar-maven-plugin, commons-lang3, lombok) fails the dependency-review check with two license violations:

• pom.xml » org.sonarsource.scanner.maven:sonar-maven-plugin@5.8.0.7211 — License: LGPL-3.0
• performance-test/pom.xml » org.projectlombok:lombok@1.18.48 — License: LicenseRef-bad-non-standard

Neither license is in allow-licenses, so every Dependabot PR touching these packages fails the gate.

Why it matters

Both are false positives for the gate's intent (blocking incompatible licenses in distributed artifacts):

• sonar-maven-plugin is genuinely LGPL-3.0, but it is a build-time Maven plugin declared in pluginManagement — it executes the scanner locally and is never distributed. Same situation as sonarqube-scan-action, which is already exempted via allow-dependencies-licenses.
• Lombok is MIT-licensed; LicenseRef-bad-non-standard is a GitHub licensee misdetection (the lombok repository's LICENSE is detected as NOASSERTION / "Other"). It is used only in the lombok profile of performance-test (provided scope, annotation-processor path) for benchmarking — also never shipped.

Affected files

• .github/workflows/dependency-review.yml

Proposed remediation

Extend allow-dependencies-licenses with the two package URLs:

• pkg:maven/org.sonarsource.scanner.maven/sonar-maven-plugin
• pkg:maven/org.projectlombok/lombok

Version-less purls, consistent with the existing sonarqube-scan-action exception (the matcher ignores versions anyway).

Note: the exemption is scoped to the package, not to a module — dependency-review-action cannot express "allowed only in performance-test". That is equivalent here since lombok only exists in that profile.