feat: Integrate eclipse dash in release pipeline

[arnoweiss]

Eclipse Dash is a tool that automatically checks the dependency tree's licensing. The result is a DEPENDENCIES file that classifies each dependency as approved, restricted or rejected according to Eclipse guidelines. Having it in the build pipeline ensures continuous compliance - there's even tooling for this as reusable action.

https://github.com/eclipse-tractusx/sig-infra/tree/main/.github/actions/run-dash

[mjacoby]

The intention was that Eclipse Dash is part of the CI but there seems to be a misconfiguration preventing it (CI should run with maven profile ci).
However, this will be removed from regular CI build tasks in the future as Eclipse explicitly stated that Eclipse Dash should not be used for regular builds but only for releases.
Also, it is active in most repositories of this organization and it is cause problems because the CI pipeline fails because of regular HTTP 429 Too Many Requests errors which is very inconvenient.

This project is still in incubation phase and we are in the process of setting things up properly. Therefore, feedback is always welcome but please be understanding that things are neither perfect nor finished yet.

[arnoweiss]

Thanks for the feedback - I understand the chores of incubating an Eclipse project and the resulting need to prioritize.

The factory-x-contributions fork is required to integrate licence checks soonish - would fa3st be open for a contribution adding a github-workflow coving this? If no, we'll just integrate it downstream instead of consuming it from upstream.

[mjacoby]

We are planning to only run this in a CI pipeline before actual releases, i.e., not for PRs or simple commits on main branch for the aforementioned reasons.

Currently no workflow for releases exists and we needs to investigate how to set this up properly, so I am unsure if it makes sense to accept any contribution for this. The dash action you mentioned looks useful and we might integrate dash like this to keep the pom.xml clean.