[Bug] Check licensing silently passes because Maven 3.9 log lines are not parsed

[thswlsqls]

Search before asking

• I searched in the issues and found nothing similar.

Paimon version
master @ ffe8e51

Compute Engine
Engine-agnostic (build/CI)

Minimal reproduce step
Maven 3.9 logs mojos by goal prefix: mvn -N dependency:tree prints --- dependency:3.7.0:tree (default-cli) @ paimon-parent ---, not maven-dependency-plugin:.... Three regexes match the artifactId spelling only (DeployParser.java:47, DependencyParser.java:41,45), matching nothing. In production (run 33834803761): 75 deploy:2.8.2:deploy lines, zero maven-deploy-plugin lines, Extracted 0 modules that were deployed.

What doesn't meet your expectations?
Expected: a bundled dependency missing from NOTICE raises Dependency %s is not listed. (CRITICAL). Actual: empty deployedModules makes NoticeFileChecker.run() drop every module, so CRITICAL is unreachable and the job stays green.

Anything else?
Patching the three regexes and replaying that log locally turns 0 into 230 severe issues: 229 unlisted dependencies, plus paimon-jindo, which bundles shaded dependencies with no NOTICE file. So the fix alone makes Check licensing red. Flink fixed the same parsers in FLINK-40459 (apache/flink@e3a53a5), accepting either spelling. I can send it with Maven 3.9 tests, but please advise on merge order first: classifying 229 dependencies for NOTICE is a licensing call for committers/PMC, not mine.

Are you willing to submit a PR?

• I'm willing to submit a PR!

[thswlsqls]

Three corrections to the report above, plus one caveat I should have included.

1. Plugin version in the repro line. Paimon resolves maven-dependency-plugin 3.1.1, so at the repo root with Maven 3.9.16 the actual line is

[INFO] --- dependency:3.1.1:tree (default-cli) @ paimon-parent ---

not 3.7.0. That version came from a bare scratch pom I used to isolate the logging change, and I should not have carried it into a line labelled @ paimon-parent. The goal-prefix behaviour itself is unchanged: no maven-dependency-plugin string is emitted either way.

Also worth stating precisely: dependency:tree is not on the broken path. NoticeFileChecker.run() consumes ShadeParser, DependencyParser.parseDependencyCopyOutput and DeployParser.parseDeployOutput. Run 33834803761 contains 75 deploy:2.8.2:deploy, 6 dependency:3.1.1:copy and 8 dependency:3.1.1:unpack lines, and zero dependency:*:tree lines.

2. Line numbers. DeployParser.java:47 is right; the DependencyParser ones are off by three. On ffe8e51 the regexes are at DependencyParser.java:44 (copy) and :48 (tree).

3. A fourth regex I missed. ScalaSuffixChecker.java:50 carries the same artifactId-only pattern:

Pattern.compile(".* --- maven-dependency-plugin.* @ (.*) ---.*");

Flink fixed this one in the same commit (apache/flink@e3a53a5). No Paimon CI job invokes ScalaSuffixChecker today, so nothing is silently broken by it, but it belongs in the same fix to keep the tree consistent.

Caveat on the 229. A subset may be checker false positives, where a shade <filters> block strips an artifact's classes while the Including ... log line survives. So 229 is an upper bound until the jars themselves are measured. The parser bug and the missing paimon-jindo NOTICE are unaffected.