From fb258258bcc31d936d011be49f30962c4fa20a51 Mon Sep 17 00:00:00 2001
From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com>
Date: Sun, 11 Oct 2026 20:39:30 +0000
Subject: [PATCH] ci: exempt build-time tool licenses in dependency-review gate

The license gate blocks routine Dependabot bumps of two build-time-only
tools:

- sonar-maven-plugin is LGPL-3.0 but lives in pluginManagement and only
  executes the SonarQube scanner on the build machine; like the already
  exempted sonarqube-scan-action, running an unmodified tool is not
  distribution, so LGPL imposes no obligations here.
- lombok is MIT-licensed but GitHub's licensee detects its LICENSE as
  LicenseRef-bad-non-standard (NOASSERTION); it is used only in the
  performance-test 'lombok' profile with provided scope and is never
  shipped.

Add both package URLs to allow-dependencies-licenses (version-less, as
with the existing exception).

Fixes java-helpers/simple-builders#339
---
 .github/workflows/dependency-review.yml | 24 ++++++++++++++++--------
 1 file changed, 16 insertions(+), 8 deletions(-)

diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml
index 06fac0c8..73e413df 100644
--- a/.github/workflows/dependency-review.yml
+++ b/.github/workflows/dependency-review.yml
@@ -68,11 +68,19 @@ jobs:
           # Fail closed with licenses derived from the project's full dependency tree,
           # replacing the deprecated deny-licenses option.
           allow-licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, EPL-1.0, EPL-2.0, CDDL-1.0, CDDL-1.1, ISC, Unlicense, CC0-1.0
-          # Per-dependency exception to the allowlist above: sonarqube-scan-action
-          # (used in fork-sonar.yml) is LGPL-3.0. The action only executes the
-          # scanner on the runner — use of an unmodified tool, not distribution
-          # or a derivative work — so LGPL obligations do not apply. The purl is
-          # deliberately version-less: dependency-review-action's matcher ignores
-          # the version anyway, and it is the usage as a CI action that makes the
-          # license unproblematic, independent of the pinned revision.
-          allow-dependencies-licenses: 'pkg:githubactions/SonarSource/sonarqube-scan-action'
+          # Per-dependency exceptions to the allowlist above. Each flagged
+          # package is executed as an unmodified tool on the runner or the
+          # build machine — not distributed, not a derivative work — so its
+          # license imposes no obligations on the published artifacts:
+          #   - sonarqube-scan-action (fork-sonar.yml): LGPL-3.0 CI action.
+          #   - sonar-maven-plugin (pluginManagement): LGPL-3.0 build plugin.
+          #   - lombok (performance-test 'lombok' profile, provided scope):
+          #     MIT-licensed, but GitHub's licensee reports its LICENSE as
+          #     LicenseRef-bad-non-standard (NOASSERTION) — a misdetection.
+          # The purls are deliberately version-less: the matcher ignores the
+          # version anyway, and it is the usage that makes the licenses
+          # unproblematic, independent of the pinned revision.
+          allow-dependencies-licenses: >-
+            pkg:githubactions/SonarSource/sonarqube-scan-action,
+            pkg:maven/org.sonarsource.scanner.maven/sonar-maven-plugin,
+            pkg:maven/org.projectlombok/lombok