Repository navigation
ci: exempt build-time tool licenses in dependency-review gate - #340
Merged
AndreasIgel merged 1 commit intoOct 11, 2026
Conversation
The license gate blocks routine Dependabot bumps of two build-time-only tools: - sonar-maven-plugin is LGPL-3.0 but lives in pluginManagement and only executes the SonarQube scanner on the build machine; like the already exempted sonarqube-scan-action, running an unmodified tool is not distribution, so LGPL imposes no obligations here. - lombok is MIT-licensed but GitHub's licensee detects its LICENSE as LicenseRef-bad-non-standard (NOASSERTION); it is used only in the performance-test 'lombok' profile with provided scope and is never shipped. Add both package URLs to allow-dependencies-licenses (version-less, as with the existing exception). Fixes java-helpers#339
Codecov Report✅ All modified and coverable lines are covered by tests. 📢 Thoughts on this report? Let us know! |
|
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Problem
The
dependency-reviewgate fails on routine Dependabot bumps of two build-time-only tools — e.g. #335:pom.xml » org.sonarsource.scanner.maven:sonar-maven-plugin— LGPL-3.0 (its real license)performance-test/pom.xml » org.projectlombok:lombok— LicenseRef-bad-non-standardChange
Adds both package URLs to
allow-dependencies-licenses, the same mechanism already used forsonarqube-scan-action, and extends the comment to cover all three exceptions:sonar-maven-plugin— LGPL-3.0, but declared inpluginManagementand only executes the scanner on the build machine; running an unmodified tool is not distribution, so LGPL imposes no obligations on the published artifacts.lombok— MIT-licensed; the flag is a GitHub licensee misdetection (the repo's LICENSE resolves toNOASSERTION/ "Other"). Used only in theperformance-testlombokprofile (providedscope, annotation-processor path), never shipped.The purls stay version-less, matching the existing exception — the matcher ignores versions and the usage is what makes the licenses unproblematic.
Note:
allow-dependencies-licensesis scoped to the package, not the declaring module — the action cannot express "lombok allowed only inperformance-test". That is equivalent here since lombok only exists in that profile.Fixes #339