`bumplock` does not validate license compliance — stale and missing entries accumulate in `NOTICE.TXT`

[mashhurs]

Summary

The bumplock process (which updates Gemfile.jruby-*.lock.release on active branches 8.19, 9.4, and 9.5) upgrades gem versions but never runs the license check. As a result, two classes of silent drift build up over time:

1. Missing entries — a newly pinned or upgraded gem has no license mapping in licenseMapping.csv and no corresponding *-NOTICE.txt file, causing the passport-control CI job to fail on the next unrelated PR.
2. Stale entries — when a gem is upgraded, the old version URL in tools/dependencies-report/src/main/resources/notices/<gem>-NOTICE.txt is never updated to match the new version, so NOTICE.TXT continues to reference the old tag.

Concrete examples found

Issue	Gem	Details
Missing license mapping + NOTICE	resolv 0.7.2	Pinned in #19483 on 8.19 but licenseMapping.csv had no resolv: entry and resolv-NOTICE.txt didn't exist. The passport-control job failed on build #4344.
Stale NOTICE URL	jrjackson 0.5.2	jrjackson-NOTICE.txt still pointed to https://github.com/guyboertje/jrjackson/blob/v0.4.6/README.md despite the gem being on 0.5.2.

Root cause

bumplock only updates the lockfile. It does not call bin/dependencies-report or ./gradlew generateLicenseReport afterwards, so neither missing nor stale license metadata is caught until the passport-control CI step runs on a future PR — often one that has nothing to do with the dependency change.

Proposed fix

Add a bin/dependencies-report --csv /tmp/report.csv step to the bumplock CI job (or as a post-step), identical to what ci/license_check.sh does. A failure would signal that either:

• a new licenseMapping.csv entry is needed, or
• a *-NOTICE.txt file needs to be created or updated.

This applies to the three active branches that have bumplock: 8.19, 9.4, and 9.5.

References

• bumplock lockfiles: Gemfile.jruby-3.4.lock.release
• License check script: ci/license_check.sh
• License mapping: tools/dependencies-report/src/main/resources/licenseMapping.csv
• NOTICE templates: tools/dependencies-report/src/main/resources/notices/

Recent fixes:

• 8.19: [8.19] Update dependency tree versions #19540
• 9.4: [9.4] Update dependency tree versions #19541
• 9.5: [9.5] Update dependency tree versions- #19540 #19544

[donoghuc]

I think we should add this (and other "correctness" checks and instead of triggering the check as a CI gate, instead it should be run on a schedule (or when a change to a lockfile/template/versions.yml is detected) and raise a PR to make the update.

Essentially no part of this should need to be hand edited.

[donoghuc]

regarding "correctness" i think that the source of truth could be the sbom we generate for artifact scans