Skip to content

ci: extend dependency-review license exemptions for codegen module deps - #385

Merged
AndreasIgel merged 2 commits into
java-helpers:mainfrom
igel-devin-ai:devin/depreview-license-exemptions
Nov 1, 2026
Merged

AndreasIgel merged 2 commits into
java-helpers:mainfrom
igel-devin-ai:devin/depreview-license-exemptions

Conversation

@igel-devin-ai

@igel-devin-ai igel-devin-ai commented Nov 1, 2026 •

Copy link
Copy Markdown
Contributor

Summary

License changes needed for the new codegen module poms in #368:

  • Adds ECL-2.0 to allow-licenses — the Eclipse Public License variant Eclipse JDT ships under. roaster-jdt is reported as Apache-2.0 AND ECL-2.0 AND EPL-1.0; Apache-2.0 and EPL-1.0 are already allowed, so the missing ECL-2.0 was the only flag.
  • Adds purl exemptions for packages whose reported license identifiers can't be satisfied via allow-licenses, same pattern as the existing lombok/sonar exemptions — all build/test-time tooling that is executed, not distributed:
    • maven-javadoc-plugin, maven-site-plugin: multi-licensed incl. LicenseRef-scancode-public-domain
    • junit-jupiter-api/engine/params: EPL-2.0 misdetected as LicenseRef-bad-non-standard (like lombok); compile scope in codegen-testing because its public API asserts via JUnit

dependency-review runs upstream's workflow file for fork PRs, so this must land on main before #368's check can go green. Prerequisite for #368 / #349.

@AndreasIgel
AndreasIgel merged commit e75d414 into java-helpers:main Nov 1, 2026
5 checks passed
@sonarqubecloud

sonarqubecloud Bot commented Nov 1, 2026

Copy link
Copy Markdown

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants