fix(licenses): support Java license designations

[kristinapathak]

TL;DR

• Adds designated_license for reviewed choices among alternative Java dependency licenses.
• Generates the selected license in NOTICE and runtime inventory, while retaining the upstream alternatives.

Additional Details

• Validates a designation against the dependency's listed license aliases.
• Preserves a designation when metadata is refreshed for the same coordinate and version.
• Records four reviewed ICMS choices: EPL-2.0 for Jakarta Servlet and Apache-2.0 for the other three dependencies.

For Reviewer

• Review the metadata validation and generated inventory fields in tools/bazel/java/generate_notice.py.

For QA

• No manual QA needed. This is build-time license metadata generation.

Testing and Documentation

• python3 -m unittest generate_notice_test.py
• bazel --output_user_root=/private/tmp/nvcf-license-elections-bazel-cache test --repo_contents_cache=/private/tmp/nvcf-bazel-repo-cache //tools/bazel/java:generate_notice_test --test_output=errors
• Compared ICMS NOTICE directly with the generator output after recording the selections.
• Updated license-compliance.md with the metadata contract.

Issues

Closes #635

Checklist

• I am familiar with the Contributing Guidelines.
• I have signed off my commits for Developer Certificate of Origin (DCO) compliance.
• New or existing tests cover the implementation.
• The documentation is up to date with these changes.

Github commit:
fix(licenses): support Java license designations

Record reviewed ICMS dependency license choices and generate NOTICE and runtime
inventory entries that retain the upstream alternatives for audit.

Summary by CodeRabbit

• Documentation

  • Added guidance for specifying reviewed SPDX licenses for Java dependencies with alternative licenses.

• Compliance

  • NOTICE files and dependency inventories now display designated licenses separately while preserving upstream license information.
  • Added validation to ensure designated licenses match supported upstream alternatives.
  • Designated license metadata is retained for the same dependency version.
  • Updated license attributions and dependency license inventory entries.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 2b7c9778-91d6-4815-bc4a-35ab1fe83c0a

📥 Commits

Reviewing files that changed from the base of the PR and between 1641999 and 0af1b36.

📒 Files selected for processing (1)

• dependencies.md

---

📝 Walkthrough

Walkthrough

Java dependency metadata now supports validated designated_license values. NOTICE and runtime inventory generation use the designation while retaining declared licenses. Metadata updates preserve the designation for the same dependency version.

Changes

Designated Java license support

Layer / File(s)	Summary
Validate designations and generate license outputs tools/bazel/java/generate_notice.py, tools/bazel/java/generate_notice_test.py	Validates designated licenses against upstream licenses. NOTICE and inventory output use normalized designations while retaining declared licenses. Tests cover valid and invalid values.
Preserve metadata and reuse aliases tools/bazel/java/generate_notice.py, tools/bazel/java/generate_notice_test.py	Metadata updates preserve existing designations. CLI generation loads license aliases once and reuses them. Tests cover preservation and invalid updates.
Document and apply designation rules license-compliance.md, src/control-plane-services/instance-cluster-management/notice_metadata.json, src/control-plane-services/instance-cluster-management/NOTICE	Documentation describes designation rules. Metadata and NOTICE entries add designated licenses for four dependencies.
Regenerate dependency license inventory dependencies.md	The inventory adds three dependencies under Apache-2.0 and removes obsolete combined-license sections.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Suggested reviewers: famousdirector, balajinvda, harshm98

Sequence Diagram(s)

sequenceDiagram
  participant CLI
  participant Metadata
  participant generated_notice
  participant NOTICE
  participant RuntimeInventory
  CLI->>Metadata: load designated license metadata
  CLI->>generated_notice: pass resolved metadata and aliases
  generated_notice->>NOTICE: format designated and upstream licenses
  generated_notice->>RuntimeInventory: record designated and declared licenses

Loading

🚥 Pre-merge checks | ✅ 4 | ❌ 1

❌ Failed checks (1 warning)

Check name	Status	Explanation	Resolution
Title check	⚠️ Warning	The title uses valid Conventional Commits syntax, but this changeset adds feature support and should use feat instead of fix.	Change the title to feat(licenses): support Java license designations.

✅ Passed checks (4 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Linked Issues check	✅ Passed	The changes implement designated license metadata, validate selections, generate selected licenses, retain upstream options, and preserve metadata for matching versions [#635].
Out of Scope Changes check	✅ Passed	The documentation, tests, metadata, NOTICE files, and dependency inventory directly support the designated Java license objectives [#635].
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✨ Finishing Touches 💡 1

🛠️ Fix failing CI checks 💡

• Create stacked PR
• Commit on current branch

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch kpathak/license-elections

---

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 1

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@tools/bazel/java/generate_notice.py`:
- Around line 591-594: Update the metadata refresh flow around the artifact
update logic and main so aliases are loaded before update_metadata, the updated
entry’s preserved designated_license is validated against the refreshed licenses
before it is returned or written, and an invalid designation is rejected or
cleared before generated metadata is persisted. Add coverage for refreshed POM
licenses that no longer include the existing designation.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Enterprise

Run ID: 42ded261-a7ea-4319-9093-b04ce690c253

📥 Commits

Reviewing files that changed from the base of the PR and between cc922d5 and 95da67f.

📒 Files selected for processing (3)

• license-compliance.md
• tools/bazel/java/generate_notice.py
• tools/bazel/java/generate_notice_test.py

[sanjay-saxena]

LGTM!

[balajinvda]

🎉 This PR is included in version nvcf-instance-cluster-management-v0.1.0 🎉

The release is available on GitHub release

Your semantic-release bot 📦🚀