ascheman commented on issue #1430: URL: https://github.com/apache/tooling-trusted-releases/issues/1430#issuecomment-5055017844
@sbp As promised, a sweep across the apache/maven-* repos to quantify how much projects rely on project-specific RAT excludes. **Method:** fetched the root `pom.xml` of each non-archived `apache/maven-*` repo and extracted the `<excludes>` configured on `apache-rat-plugin` / `rat-maven-plugin`. **Results (90 repos with a readable root pom):** - **50 (56%)** declare project-specific RAT excludes in the root pom; 40 do not. - Among those 50: **median 3, max 25** excludes (`maven-surefire`), total **286**. - Largest: maven-surefire 25, maven-indexer 20, maven-scm 18, maven (core) 13, maven-mvnd 12, maven-site 12, maven-archetype/assembly-plugin/ear-plugin 11, maven-shade-plugin 10. **Caveats — treat this as a lower bound:** - Root pom only, so multi-module projects with module-level excludes are undercounted. - Inheritance isn't resolved: the ~9 `maven-parent` default excludes are added on top for every inheriting project, so the real *effective* exclude set is larger than these project-local counts. **Takeaway:** project-specific RAT excludes are common (over half the repos) and non-trivial in size, and they already live in the poms — so deriving them (per RAT-554 sharing config between the Maven plugin and the CLI) clearly beats hand-maintaining them a second time per project. Raw per-repo counts available if useful. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
