.ort.yml

# Copyright (C) 2023 The ORT Server Authors (See <https://github.com/eclipse-apoapsis/ort-server/blob/main/NOTICE>)
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     https://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
#
# SPDX-License-Identifier: Apache-2.0
# License-Filename: LICENSE

excludes:
  paths:
  - pattern: "buildSrc/**"
    reason: "BUILD_TOOL_OF"
    comment: >-
      The buildSrc directory contains build scripts for the Gradle build tool.
  - pattern: "**/src/test/**"
    reason: "TEST_OF"
    comment: >-
      Licenses contained in this directory are used for testing and do not apply to the ORT server.
  - pattern: "website/**"
    reason: "OTHER"
    comment: >-
      The website directory contains the ORT server's website and is not part of the server itself.
  scopes:
  - pattern: ".*[tT]est.*"
    reason: "TEST_DEPENDENCY_OF"
    comment: >-
      Packages for testing only.
  - pattern: "detekt.*"
    reason: "DEV_DEPENDENCY_OF"
    comment: >-
      Packages for static code analysis only.
  - pattern: "devDependencies"
    reason: "TEST_DEPENDENCY_OF"
    comment: >-
      Packages for development only.
  - pattern: "kotlin.*"
    reason: "BUILD_DEPENDENCY_OF"
    comment: >-
      Packages for Kotlin compiler only.
  - pattern: "metadataCompileClasspath"
    reason: "BUILD_DEPENDENCY_OF"
    comment: >-
      Packages for Kotlin compiler only.

curations:
  packages:
  - id: "Maven:org.ossreviewtoolkit.utils:spdx-utils:"
    curations:
      concluded_license: 'Apache-2.0'
      comment: |
        The SPDX utils contain a list of every known license. Conclude the license as this is an ORT internal
        dependency and we can be sure that the license is in fact Apache-2.0.

resolutions:
  issues:
  - message: "ERROR: Timeout after .+ seconds while scanning file 'rules/matrixseqexpl.json'."
    reason: SCANNER_ISSUE
    comment: "This file does not contain any license declarations."