apache / apache/paimon

[Bug] Check licensing silently passes because Maven 3.9 log lines are not parsed

Open
#9,604 1 comment 0 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
3.4k
Forks
1.4k
Avg merge
1d 11h
Merged PRs (30d)
396

Description

**Search before asking**
- [x] I searched in the [issues](https://github.com/apache/paimon/issues) and found nothing similar.

**Paimon version**
master @ ffe8e5127

**Compute Engine**
Engine-agnostic (build/CI)

**Minimal reproduce step**
Maven 3.9 logs mojos by goal prefix: `mvn -N dependency:tree` prints `--- dependency:3.7.0:tree (default-cli) @ paimon-parent ---`, not `maven-dependency-plugin:...`. Three regexes match the artifactId spelling only (`DeployParser.java:47`, `DependencyParser.java:41,45`), matching nothing. In production ([run 33834803761](https://github.com/apache/paimon/actions/runs/33834803761)): 75 `deploy:2.8.2:deploy` lines, zero `maven-deploy-plugin` lines, `Extracted 0 modules that were deployed`.

**What doesn't meet your expectations?**
Expected: a bundled dependency missing from NOTICE raises `Dependency %s is not listed.` (CRITICAL). Actual: empty `deployedModules` makes `NoticeFileChecker.run()` drop every module, so CRITICAL is unreachable and the job stays green.

**Anything else?**
Patching the three regexes and replaying that log locally turns 0 into 230 severe issues: 229 unlisted dependencies, plus `paimon-jindo`, which bundles shaded dependencies with no NOTICE file. So the fix alone makes `Check licensing` red. Flink fixed the same parsers in FLINK-40459 (apache/flink@e3a53a5), accepting either spelling. I can send it with Maven 3.9 tests, but please advise on merge order first: classifying 229 dependencies for NOTICE is a licensing call for committers/PMC, not mine.

**Are you willing to submit a PR?**
- [x] I'm willing to submit a PR!

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with DeployParser.java:47 and DependencyParser.java:41,45, then inspect how NoticeFileChecker.run() handles deployedModules. Replay the linked Maven 3.9 log and run the Maven 3.9 parser tests mentioned in the issue. Done means both artifactId spellings are parsed and the licensing check no longer silently drops all modules; NOTICE classification remains for committers or the PMC.

Written by the indexing model from the issue text.

Assessment

Tech stack
github-actions, java
Domain
build-system, ci-cd
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Active
Clarity
Mostly clear
Newbie friendliness
52/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.