From b3665a4bbd09f53f1061c1a4afe182dad6a51812 Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Sun, 1 Nov 2026 14:37:48 +0000 Subject: [PATCH 1/2] ci: exempt build-time dependency licenses introduced by the codegen modules --- .github/workflows/dependency-review.yml | 17 ++++++++++++++++- 1 file changed, 16 insertions(+), 1 deletion(-) diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index 73e413df..c1f83520 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -77,10 +77,25 @@ jobs: # - lombok (performance-test 'lombok' profile, provided scope): # MIT-licensed, but GitHub's licensee reports its LICENSE as # LicenseRef-bad-non-standard (NOASSERTION) — a misdetection. + # - maven-javadoc-plugin, maven-site-plugin (build plugins used to + # publish javadoc/site jars): multi-licensed including + # LicenseRef-scancode-public-domain, which is not on the allowlist. + # - roaster-jdt (codegen-roaster): bundles Eclipse JDT, scancode + # reports Apache-2.0 AND ECL-2.0 AND EPL-1.0 — ECL-2.0 is not on + # the allowlist. + # - junit-jupiter-api/engine/params (codegen-testing, compile + # scope): EPL-2.0 licensed, but GitHub reports LicenseRef- + # bad-non-standard (NOASSERTION) — a misdetection like lombok. # The purls are deliberately version-less: the matcher ignores the # version anyway, and it is the usage that makes the licenses # unproblematic, independent of the pinned revision. allow-dependencies-licenses: >- pkg:githubactions/SonarSource/sonarqube-scan-action, pkg:maven/org.sonarsource.scanner.maven/sonar-maven-plugin, - pkg:maven/org.projectlombok/lombok + pkg:maven/org.projectlombok/lombok, + pkg:maven/org.apache.maven.plugins/maven-javadoc-plugin, + pkg:maven/org.apache.maven.plugins/maven-site-plugin, + pkg:maven/org.jboss.forge.roaster/roaster-jdt, + pkg:maven/org.junit.jupiter/junit-jupiter-api, + pkg:maven/org.junit.jupiter/junit-jupiter-engine, + pkg:maven/org.junit.jupiter/junit-jupiter-params From dbf6b96061d83c4c8f4e71eb129385f8c8d2b3ec Mon Sep 17 00:00:00 2001 From: Devin AI <158243242+devin-ai-integration[bot]@users.noreply.github.com> Date: Sun, 1 Nov 2026 15:15:25 +0000 Subject: [PATCH 2/2] ci: add ECL-2.0 to dependency-review allow-licenses, drop roaster-jdt purl --- .github/workflows/dependency-review.yml | 6 +----- 1 file changed, 1 insertion(+), 5 deletions(-) diff --git a/.github/workflows/dependency-review.yml b/.github/workflows/dependency-review.yml index c1f83520..3f876367 100644 --- a/.github/workflows/dependency-review.yml +++ b/.github/workflows/dependency-review.yml @@ -67,7 +67,7 @@ jobs: fail-on-severity: high # Fail closed with licenses derived from the project's full dependency tree, # replacing the deprecated deny-licenses option. - allow-licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, EPL-1.0, EPL-2.0, CDDL-1.0, CDDL-1.1, ISC, Unlicense, CC0-1.0 + allow-licenses: MIT, Apache-2.0, BSD-2-Clause, BSD-3-Clause, EPL-1.0, EPL-2.0, ECL-2.0, CDDL-1.0, CDDL-1.1, ISC, Unlicense, CC0-1.0 # Per-dependency exceptions to the allowlist above. Each flagged # package is executed as an unmodified tool on the runner or the # build machine — not distributed, not a derivative work — so its @@ -80,9 +80,6 @@ jobs: # - maven-javadoc-plugin, maven-site-plugin (build plugins used to # publish javadoc/site jars): multi-licensed including # LicenseRef-scancode-public-domain, which is not on the allowlist. - # - roaster-jdt (codegen-roaster): bundles Eclipse JDT, scancode - # reports Apache-2.0 AND ECL-2.0 AND EPL-1.0 — ECL-2.0 is not on - # the allowlist. # - junit-jupiter-api/engine/params (codegen-testing, compile # scope): EPL-2.0 licensed, but GitHub reports LicenseRef- # bad-non-standard (NOASSERTION) — a misdetection like lombok. @@ -95,7 +92,6 @@ jobs: pkg:maven/org.projectlombok/lombok, pkg:maven/org.apache.maven.plugins/maven-javadoc-plugin, pkg:maven/org.apache.maven.plugins/maven-site-plugin, - pkg:maven/org.jboss.forge.roaster/roaster-jdt, pkg:maven/org.junit.jupiter/junit-jupiter-api, pkg:maven/org.junit.jupiter/junit-jupiter-engine, pkg:maven/org.junit.jupiter/junit-jupiter-params