enforcing lock file sync

[balajiyalam2]

Contributes to eclipse-score/score#2628

[github-actions]

License Check Results

🚀 The license check job ran with the Bazel command:

bazel run //:license-check

Status: ⚠️ Needs Review

Click to expand output

[License Check Output]
Extracting Bazel installation...
Starting local Bazel server (8.3.0) and connecting to it...
INFO: Invocation ID: c7ff36bf-5faf-4803-bb56-2ed6c1bcc4e5
Computing main repo mapping: 
Computing main repo mapping: 
Computing main repo mapping: 
Computing main repo mapping: 
Computing main repo mapping: 
Computing main repo mapping: 
Loading: 
Loading: 5 packages loaded
Loading: 5 packages loaded
    currently loading: 
Loading: 5 packages loaded
    currently loading: 
Analyzing: target //:license-check (6 packages loaded, 0 targets configured)
Analyzing: target //:license-check (6 packages loaded, 0 targets configured)

Analyzing: target //:license-check (47 packages loaded, 10 targets configured)

Analyzing: target //:license-check (96 packages loaded, 10 targets configured)

Analyzing: target //:license-check (98 packages loaded, 10 targets configured)

Analyzing: target //:license-check (158 packages loaded, 2685 targets configured)

Analyzing: target //:license-check (173 packages loaded, 7912 targets configured)

Analyzing: target //:license-check (181 packages loaded, 8264 targets configured)

Analyzing: target //:license-check (181 packages loaded, 8264 targets configured)

Analyzing: target //:license-check (184 packages loaded, 10271 targets configured)

Analyzing: target //:license-check (184 packages loaded, 10271 targets configured)

INFO: Analyzed target //:license-check (185 packages loaded, 11850 targets configured).
[8 / 13] [Prepa] Expanding template license.check.license_check
INFO: From Generating Dash formatted dependency file ...:
INFO: Successfully converted 2 packages from Cargo.lock to bazel-out/k8-fastbuild/bin/formatted.txt
INFO: Found 1 target...
Target //:license.check.license_check up-to-date:
  bazel-bin/license.check.license_check
  bazel-bin/license.check.license_check.jar
INFO: Elapsed time: 201.301s, Critical Path: 0.34s
INFO: 13 processes: 4 disk cache hit, 9 internal.
INFO: Build completed successfully, 13 total actions
INFO: Running command line: bazel-bin/license.check.license_check ./formatted.txt <args omitted>
usage: org.eclipse.dash.licenses.cli.Main [-batch <int>] [-cd <url>]
       [-confidence <int>] [-ef <url>] [-excludeSources <sources>] [-help] [-lic
       <url>] [-project <shortname>] [-repo <url>] [-review] [-summary <file>]
       [-timeout <seconds>] [-token <token>]

[github-actions]

The created documentation from the pull request is available at: docu-html

[NEOatNHNG]

The lock file is huge and a likely candidate for merge conflicts. Do we really need to commit this to the repo? How do we keep it up-to-date? Can dependabot update it? Is there some common discussion / decision / issue that we can point to, why we do this?

For me it makes more sense to have the modules free from lockfiles and do the lockfile stuff in the reference integration repo in order to have some fixed overhead and not a lot of overhead per module.