[Bug] Check licensing silently passes because Maven 3.9 log lines are not parsed
- Dominant language
- Java
- Stars
- 3.4k
- Forks
- 1.4k
- Avg merge
- 1d 11h
- Merged PRs (30d)
- 396
Description
**Search before asking**
- [x] I searched in the [issues](https://github.com/apache/paimon/issues) and found nothing similar.
**Paimon version**
master @ ffe8e5127
**Compute Engine**
Engine-agnostic (build/CI)
**Minimal reproduce step**
Maven 3.9 logs mojos by goal prefix: `mvn -N dependency:tree` prints `--- dependency:3.7.0:tree (default-cli) @ paimon-parent ---`, not `maven-dependency-plugin:...`. Three regexes match the artifactId spelling only (`DeployParser.java:47`, `DependencyParser.java:41,45`), matching nothing. In production ([run 33834803761](https://github.com/apache/paimon/actions/runs/33834803761)): 75 `deploy:2.8.2:deploy` lines, zero `maven-deploy-plugin` lines, `Extracted 0 modules that were deployed`.
**What doesn't meet your expectations?**
Expected: a bundled dependency missing from NOTICE raises `Dependency %s is not listed.` (CRITICAL). Actual: empty `deployedModules` makes `NoticeFileChecker.run()` drop every module, so CRITICAL is unreachable and the job stays green.
**Anything else?**
Patching the three regexes and replaying that log locally turns 0 into 230 severe issues: 229 unlisted dependencies, plus `paimon-jindo`, which bundles shaded dependencies with no NOTICE file. So the fix alone makes `Check licensing` red. Flink fixed the same parsers in FLINK-40459 (apache/flink@e3a53a5), accepting either spelling. I can send it with Maven 3.9 tests, but please advise on merge order first: classifying 229 dependencies for NOTICE is a licensing call for committers/PMC, not mine.
**Are you willing to submit a PR?**
- [x] I'm willing to submit a PR!
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with DeployParser.java:47 and DependencyParser.java:41,45, then inspect how NoticeFileChecker.run() handles deployedModules. Replay the linked Maven 3.9 log and run the Maven 3.9 parser tests mentioned in the issue. Done means both artifactId spellings are parsed and the licensing check no longer silently drops all modules; NOTICE classification remains for committers or the PMC.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- github-actions, java
- Domain
- build-system, ci-cd
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Active
- Clarity
- Mostly clear
- Newbie friendliness
- 52/100