Should we include test dependencies into the licence check?

[tom-rm-meyer-ISST]

As you can see in this closed PR, we faced the issue that there are two different types of licence check:

• the licence check with the mvn plugin (mvn org.eclipse.dash:license-tool-plugin:license-check -Ddash.project=automotive.tractusx -Ddash.summary=DEPENDENCIES)
• the licence check using the jar and mvn (first create list of dependencies, then use the dashtool)

Our workflow is to use the dashtool mvn plugin, whenever we change dependencies. Then we have the workflow so that we ensure the check during pull requesting.
The failing workflow is pretty new to me. As a workaround, we now included the test dependencies.

It's likely due to different scopes: the mvn plugin uses compile, the workflow also includes test dependencies. See this Issue.

Describe the solution you'd like
If test dependencies are in scope of the license check, then we need to clarify how to use the maven plugin.
If test dependencies are NOT in scope of the license check, then the sig-infra team would need to set the scope to compile in the template (parameter in mvn dependency:list -DskipTests -Dmaven.javadoc.skip=true -DappendOutput=true -DoutputFile=maven.dependencies ?).

Reproduce
Based on this branch, it's reproduceable. Here some excerpts of the differences and further information.

versions in use:

• dashtool jar v 1.0.2
• plugin both 0.0.1-SNAPSHOT, 1.0.3-SNAPSHOT

licence plugin

cd backend
mvn org.eclipse.dash:license-tool-plugin:license-check -Ddash.project=automotive.tractusx -Ddash.summary=../DEPENDENCIES_BACKEND
[INFO] Scanning for projects...
[INFO] 
[INFO] --------------< org.eclipse.tractusx.puris:puris-backend >--------------
[INFO] Building puris-backend 0.0.1
[INFO]   from pom.xml
[INFO] --------------------------------[ jar ]---------------------------------
[INFO] 
[INFO] --- license-tool:0.0.1-SNAPSHOT:license-check (default-cli) @ puris-backend ---
[INFO] Querying Eclipse Foundation for license data for 74 items.
[INFO] Found 62 items.
[INFO] Querying ClearlyDefined for license data for 12 items.
[INFO] Found 12 items.
[INFO] Vetted license information was found for all content. No further investigation is required.
[INFO] Summary file was written to: /home/tommeyer/coding/PURIS-Demonstrator-DEV/puris/DEPENDENCIES_BACKEND
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  5.622 s
[INFO] Finished at: 2023-08-18T03:02:14-07:00
[INFO] ------------------------------------------------------------------------

Dashtool (github workflow)

cd backend
mvn dependency:list -DskipTests -Dmaven.javadoc.skip=true -DappendOutput=true -DoutputFile=maven.dependencies
[INFO] Scanning for projects...
[INFO] 
[INFO] --------------< org.eclipse.tractusx.puris:puris-backend >--------------
[INFO] Building puris-backend 0.0.1
[INFO]   from pom.xml
[INFO] --------------------------------[ jar ]---------------------------------
[INFO] 
[INFO] --- dependency:3.3.0:list (default-cli) @ puris-backend ---
[INFO] ------------------------------------------------------------------------
[INFO] BUILD SUCCESS
[INFO] ------------------------------------------------------------------------
[INFO] Total time:  1.418 s
[INFO] Finished at: 2023-08-18T03:09:32-07:00
[INFO] ------------------------------------------------------------------------
tommeyer@ubuntu:~/coding/PURIS-Demonstrator-DEV/puris/backend$ cd ..
tommeyer@ubuntu:~/coding/PURIS-Demonstrator-DEV/puris$ eclipseDashTool ./backend/maven.dependencies -summary DEPENDENCIES_BACKEND -project automotive.tractusx || true
[main] INFO Querying Eclipse Foundation for license data for 112 items.
[main] INFO Found 87 items.
[main] INFO Querying ClearlyDefined for license data for 25 items.
[main] INFO Found 25 items.
[main] INFO Vetted license information was found for all content. No further investigation is required.

[SebastianBezold]

HI @tom-rm-meyer-ISST,

thanks for opening this discussion. We actually had this come up in some of our meetings, but did not come to a conclusion.

As a fact, test dependencies DO NEED TO BE INCLUDED.

We also heard, that there are different outcomes when comparing the Maven plugin with the standalone Dahs .jar.
I seems like you are also aware of the GitHub issue in the Dash repo.

So in my opinion, we should find a reliable way to use Dash, that includes test dependencies. Whether it is to stick with only the Maven plugin or the standalone .jar, or find the proper input parameters for both variant to produce the same results

[tom-rm-meyer-ISST]

Thanks for clarification!

Using the maven plugin, the following command worked for me:

mvn org.eclipse.dash:license-tool-plugin:license-check -Dproject=automotive.tractusx -DincludeScope=test -Dsummary=DEPENDENCIES

I walked through the code to check the parameters. Here I found the respective property/parameter.

Other way around, using maven one could also update the pom.xml to use the configuration by default:

      <plugin>
        <groupId>org.eclipse.dash</groupId>
        <artifactId>license-tool-plugin</artifactId>
        <version>0.0.1-SNAPSHOT</version>
        <configuration>
          <projectId>automotive.tractusx</projectId>
          <summary>DEPENDENCIES</summary>
          <includeScope>test</includeScope>
        </configuration>
        <executions>
          <execution>
            <id>license-check</id>
            <goals>
              <goal>license-check</goal>
            </goals>
          </execution>
        </executions>
      </plugin>

And then run the check using following command:

mvn org.eclipse.dash:license-tool-plugin:license-check

[SebastianBezold]

Oh nice the option to manifest includeScope=test in the pom.xml could be a good option to share via mailing list. What do you think?

[tom-rm-meyer-ISST]

Nice idea, I could do that. Therefore I would at least summarize this discussion here.

Do we need further documentation in e.g. confluence or somewhere else? If not, we likely could close the discussion.

[SebastianBezold]

Documentation would be nice, but definitely not Confluence :P. I guess either the Release Guideline handling 3rd party dependency IP Checks (TRG 7.04) can be improved, or we find a good spot somewhere else in the Developer Hub that will be a good place

[tom-rm-meyer-ISST]

Created a PR accordingly and requested your review.

[tom-rm-meyer-ISST]

TLDR; Yes, test dependencies should be included in the Dependencies files. We added updated the TRG 7.04 with a respective example for maven in this PR