Fix evaluator license violations with both license choices and path excludes

[Copilot]

The ORT evaluator was incorrectly reporting license violations when a package had multiple license findings with both license choices and path excludes configured. This was due to the wrong order of operations in the evaluator logic.

Problem

The evaluator's licenseRule function was processing licenses in this order:

1. Filter by license view
2. Apply license choices
3. Check for exclusions (via isExcluded() matcher)

This is the reverse of how reporters handle the same scenario correctly.

Root Cause

Consider a package with:

• Finding 1: MIT OR GPL-2.0-only in LICENSE (non-excluded)
• Finding 2: GPL-2.0-only in excluded/some-file.txt (path excluded)
• License choice: MIT OR GPL-2.0-only -> MIT

Before this fix: The evaluator would apply the choice first, then check exclusions, leading to GPL-2.0-only being considered for rule evaluation even though it should be filtered out by path excludes.

After this fix: The evaluator filters excluded licenses first, then applies choices, resulting in only MIT being evaluated - matching the reporter behavior.

Solution

Modified the licenseRule function in PackageRule.kt to call .filterExcluded() before .applyChoices():

resolvedLicenseInfo.filter(licenseView, filterSources = true)
    .filterExcluded() // Filter excluded licenses before applying choices
    .applyChoices(ruleSet.ortResult.getPackageLicenseChoices(pkg.metadata.id), licenseView)
    .applyChoices(ruleSet.ortResult.getRepositoryLicenseChoices(), licenseView)

This matches the working pattern in EvaluatedModelMapper.kt where reporters correctly do:

input.licenseInfoResolver.resolveLicenseInfo(pkg.id).filterExcluded().effectiveLicense(...)

Impact

• Evaluator and reporters now have consistent behavior
• Prevents false license violations when using both path excludes and license choices
• No impact on existing functionality when only one mechanism is used
• Maintains backward compatibility

Fixes #10867.

Warning

Firewall rules blocked me from connecting to one or more addresses (expand for details)

I tried to connect to the following addresses, but was blocked by firewall rules:

• repo.eclipse.org
  • Triggering command: /usr/lib/jvm/temurin-21-jdk-amd64/bin/java --add-opens=java.base/java.lang=ALL-UNNAMED --add-opens=java.base/java.lang.invoke=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.api=ALL-UNNAMED --add-exports=jdk.compiler/com.sun.tools.javac.util=ALL-UNNAMED --add-opens=java.base/java.util=ALL-UNNAMED --add-opens=java.prefs/java.util.prefs=ALL-UNNAMED --add-opens=java.base/java.nio.charset=ALL-UNNAMED --add-opens=java.base/java.net=ALL-UNNAMED --add-opens=java.base/java.util.concurrent=ALL-UNNAMED --add-opens=java.base/java.util.concurrent.atomic=ALL-UNNAMED --add-opens=java.xml/javax.xml.namespace=ALL-UNNAMED --add-opens=java.base/java.time=ALL-UNNAMED -XX:MaxMetaspaceSize=1g -Xmx2g -Dfile.encoding=UTF-8 -Duser.country -Duser.language=en -Duser.variant -cp /home/REDACTED/.gradle/wrapper/dists/gradle-9.1.0-bin/9agqghryom9wkf8r80qlhnts3/gradle-9.1.0/lib/gradle-daemon-main-9.1.0.jar -javaagent:/home/REDACTED/.gradle/wrapper/dists/gradle-9.1.0-bin/9agqghryom9wkf8r80qlhnts3/gradle-9.1.0/lib/agents/gradle-instrumentation-agent-9.1.0.jar org.gradle.launcher.daemon.bootstrap.GradleDaemon 9.1.0 (dns block)

If you need me to access, download, or install something from one of these locations, you can either:

• Configure Actions setup steps to set up my environment, which run before the firewall is enabled
• Add the appropriate URLs or hosts to the custom allowlist in this repository's Copilot coding agent settings (admins only)

---

💬 Share your feedback on Copilot coding agent for the chance to win a $200 gift card! Click here to start the survey.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 57.53%. Comparing base (0e9bc55) to head (54a21ba).

Additional details and impacted files

@@            Coverage Diff            @@
##               main   #10873   +/-   ##
=========================================
  Coverage     57.53%   57.53%           
- Complexity     1698     1700    +2     
=========================================
  Files           346      346           
  Lines         12823    12823           
  Branches       1212     1212           
=========================================
  Hits           7378     7378           
  Misses         4978     4978           
  Partials        467      467           

Flag	Coverage Δ
funTest-docker	71.03% <ø> (ø)
funTest-non-docker	33.01% <ø> (+0.14%)	⬆️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.