docs: update TRG 7-04 to unbind DEPENDENCIES file from the main branch

[ndr-brt]

Description

Modify TRG 7.04 to describe how the DEPENDENCIES file could be not checked in the git repository but uploaded on a static content.

As discussed in: https://github.com/orgs/eclipse-tractusx/projects/61/views/6?pane=issue&itemId=83404189

Please ensure to do as many of the following checks as possible, before asking for committer review:

• DEPENDENCIES are up-to-date. Dash license tool. Committers can open IP issues for restricted libs.
• Copyright and license header are present on all affected files

[tom-rm-meyer-ISST]

Overall it makes sense, thus LGTM.

I have one question:

If I understood your workflows correctly, you bundle the dependencies for the release. There also is a workflow for nightlies that doesn't. You don't provide nightlies anymore on maven central, don't you?

[ndr-brt]

If I understood your workflows correctly, you bundle the dependencies for the release. There also is a workflow for nightlies that doesn't. You don't provide nightlies anymore on maven central, don't you?

@tom-rm-meyer-ISST in the EDC context nightlies are not proper releases, we consider them as intermediate releases that can be used to test out new features/bugfixes but not meant to be used in production, that's why they're marked as SNAPSHOT, as they are snapshot, so we don't tag the commit, we don't publish them on maven central (only on osshr) and we don't bundle the dependencies file.

[tom-rm-meyer-ISST]

If I understood your workflows correctly, you bundle the dependencies for the release. There also is a workflow for nightlies that doesn't. You don't provide nightlies anymore on maven central, don't you?

@tom-rm-meyer-ISST in the EDC context nightlies are not proper releases, we consider them as intermediate releases that can be used to test out new features/bugfixes but not meant to be used in production, that's why they're marked as SNAPSHOT, as they are snapshot, so we don't tag the commit, we don't publish them on maven central (only on osshr) and we don't bundle the dependencies file.

Alright, thanks for clarifying! Just as a sidenote: I think it would make sense to also bundle the file into that, too because it's some kind of distribution, even if not meant for production. I at least online was not able to find the snapshot via the osshr webpage and likely you'll only find it in your maven cache or similar - thus, maybe a cherry on the cream topic or me being too picky :)