Ignore dev and umbrella dependencies.

[gergo-papp]

Overview

I'm using kudos to generate a notices file that contains all the copyright and license requirements when distributing software to clients. We normally have several applications in the same mix project (having one top-level applications and other umbrella dependencies). We also have some local-only or dev dependencies that we use for testing (kudos is also one of these).

Problem

• kudos doesn't work well with umbrella projects, because it cannot figure out most of the dependency informations (e.g. there is no checksum or license type for these projects)
• since usually only production dependencies are relevant it should be possible to filter out dev-only dependencies

Implementation

• Only run on top-level app (set @recursive to false). This means that we are only examining the top-level mix file. This is enough every dependency is already listed here and at least we don't end up with duplicates
• Ignore umbrella dependencies or dependencies that are dependencies of umbrella deps
• Ignore dev-only dependencies

Future dev

Ideally we would add --dev, --umbrella or similar CLI options

[dschniepp]

Thanks for the PR. The points you mention make sense and I would be open to put it in the lib.

One point regarding @recursive, if I remember correctly we needed this for checking the dependencies of the dependencies. But if I understand you correctly these are now already part of the top-level?

[gergo-papp]

Thanks for the PR. The points you mention make sense and I would be open to put it in the lib.

One point regarding @recursive, if I remember correctly we needed this for checking the dependencies of the dependencies. But if I understand you correctly these are now already part of the top-level?

Yes, that’s correct. At least that’s what I’ve seen locally. We definitely need a test case to validate this but it should work

I’m already using these changes in my forked repo - I’ll try to upstream once I get it into a clean state

[dschniepp]

@gergo-papp any updates on this PR?

[gergo-papp]

@gergo-papp any updates on this PR?

Should be ready! I've been running this in "production" on several repos for the last year and it all seems fine. Not sure if we can add some actual tests...

Also: With this change running mix kudos.generate inside this repo will only show the report for decimal which is the only prod dependency - which makes sense, because you are not distributing any other dependencies

[dschniepp]

Thanks for updating the PR

[dschniepp]

Thank you very much :)