Document how to ignore certain dependencies

[sbernard31]

I imagine a use case where you are using license-tool-plugin and want your project failed if dependencies are not checked.

Now imagine that you add a new dependency which is not trusted, you need to create a CQ (or take any action like this).
But waiting it is approved, I understand that the project are allowed to use the component anyway (as soon as it does not release it, so just for development phase)

So we need parameter to skip waiting for approval dependencies.
(Maybe pretty much same feature than how to handle work-with : #13)

There is maybe a difference because work-with should always skip the dependency check
but waiting for approval should failed on release.

[waynebeaton]

There is. But it's not documented. I'll fix that.

You can exclude specific groups, artifacts, scopes, classifiers, etc.

e.g.,

$ mvn -DexcludeGroupIds=org.eclipse org.eclipse.dash:license-tool-plugin:license-check -Ddash.summary=DEPENDENCIES

It uses built-in Maven features, so groupids are actually excluded using a startsWith comparison, so excluding org.eclipse will exclude groups like org.eclipse.leshan. Excluded artifactIds work on exact match (I've been tinkering with a wildcard match, but am quickly starting to understand why the build-in features don't support this).

I've only just started tinkering with a solution for this myself. Getting the documentation updated will be a good start. There's related discussion on #13.

[sbernard31]

I don't know if filter should be done at maven layer (I mean filtering artifacts) or at dash-licenses layer (I mean filtering by content ID) or both.

I asked this because if one day we use Dash Licenses Maven Plugin not only for maven dependencies (see #111) we could rather want to filter at ContentID level. 🤔

[sbernard31]

Reading #13 (comment), I understand the benefits to filter by artifacts too.

So maybe we need both.

(Uups I should maybe add this kind of comment at #13 instead of here)

[waynebeaton]

I don't know if filter should be done at maven layer (I mean filtering artifacts) or at dash-licenses layer (I mean filtering by content ID) or both.

I asked this because if one day we use Dash Licenses Maven Plugin not only for maven dependencies (see #111) we could rather want to filter at ContentID level. thinking

If you're using the CLI, you can filter out content before delivering it to the tool.

$ cat dependencies.txt | grep -v "org\.blah\.blah" | java -jar license-tool.jar -

[sbernard31]

Thx for the tips. 🙏

(Just in case of possible misunderstanding , the issue is relative to the maven plugin)