search

oss-review-toolkit / ort

A suite of tools to automate software compliance checks.
https://oss-review-toolkit.org
Apache License 2.0
1.59k stars 308 forks source link

Add Mill as supported package manager #4973

Open tsteenbe opened 2 years ago

tsteenbe commented 2 years ago

Add support for Mill packages (projects written in Java or SBT) to the ORT analyzer module.

Adding a Tool to ORT Analyzer Questions

  1. How can one detect whether a project is a Mill project?

Presence of build.sc or millw file in root of the project

  1. How can one detect declared license for a package?
  2. How can one get dependency tree including package names, versions?

Use Scala Module according to https://com-lihaoyi.github.io/mill/mill/Mill_Internals.html#_dependency_graph_first after a google search I found https://github.com/ajrnz/mill-dgraph which mill build tool plugin to visualize dependencies of a Mill project. Maybe we could re-use part of its dependency processor see https://github.com/ajrnz/mill-dgraph/blob/master/dgraph/src/DependencyProcessor.scala?

  1. How can one obtain the source for a dependency?
  2. Is it possible to determine how to separate code dependencies from build/test ones?
  3. What Mill projects should we use to test ORT support for Mill?
code-surfer commented 2 years ago

mill-dgraph is four years old and was updated for mill 0.2.0 which is ancient. I haven't checked whether dgraph still works.

Mill's own visualize might be more promising?

tsteenbe commented 2 years ago

I was not think of using mill-dgraph but rather use is as an potential example of Mill API to fech dependency information.

code-surfer commented 2 years ago

Well, I wondered whether one of the visualize output formats might be adequate for the ORT tool.