feat(spring): Automatically curate Spring Boot VCS paths

Use the GitHub API to look up Spring Boot project paths. These paths do
not follow a clear pattern and vary depending on the version.

Signed-off-by: Sebastian Schuberth <[email protected]>

Author: sschuberth

plugins/package-curation-providers/spring/build.gradle.kts

@@ -26,4 +26,10 @@ dependencies {
     api(projects.plugins.packageCurationProviders.packageCurationProviderApi)
 
     ksp(projects.plugins.packageCurationProviders.packageCurationProviderApi)
+
+    implementation(projects.model)
+    implementation(projects.utils.commonUtils)
+    implementation(projects.utils.ortUtils)
+
+    implementation(libs.kotlinx.serialization.json)
 }

plugins/package-curation-providers/spring/src/main/kotlin/SpringPackageCurationProvider.kt

@@ -22,6 +22,7 @@ package org.ossreviewtoolkit.plugins.packagecurationproviders.spring
 import org.ossreviewtoolkit.model.Package
 import org.ossreviewtoolkit.model.PackageCuration
 import org.ossreviewtoolkit.model.PackageCurationData
+import org.ossreviewtoolkit.model.VcsInfoCurationData
 import org.ossreviewtoolkit.plugins.api.OrtPlugin
 import org.ossreviewtoolkit.plugins.api.PluginDescriptor
 import org.ossreviewtoolkit.plugins.packagecurationproviders.api.PackageCurationProvider
@@ -38,6 +39,16 @@ import org.ossreviewtoolkit.plugins.packagecurationproviders.api.PackageCuration
 open class SpringPackageCurationProvider(
     override val descriptor: PluginDescriptor = SpringPackageCurationProviderFactory.descriptor
 ) : PackageCurationProvider {
+    val springBootProjectPaths = mutableMapOf<String, Map<String, String>>()
+
+    fun getSpringBootProjectPath(subProjectName: String, projectVersion: String): String {
+        val paths = springBootProjectPaths.getOrPut(projectVersion) {
+            getSpringProjectPaths("spring-boot", projectVersion)
+        }
+
+        return paths.getValue(subProjectName)
+    }
+
     override fun getCurationsFor(packages: Collection<Package>): Set<PackageCuration> {
         val springPackages = packages.filter {
             it.id.type == "Maven" && it.id.namespace.startsWith("org.springframework")
@@ -62,6 +73,14 @@ open class SpringPackageCurationProvider(
                 data = data.copy(isMetadataOnly = isMetadataOnly)
             }
 
+            if (pkg.vcsProcessed.url == "https://github.com/spring-projects/spring-boot.git") {
+                runCatching {
+                    getSpringBootProjectPath(pkg.id.name, pkg.id.version)
+                }.onSuccess { path ->
+                    data = data.copy(vcs = VcsInfoCurationData(path = path))
+                }
+            }
+
             if (data != PackageCurationData()) {
                 PackageCuration(pkg.id, data)
             } else {

plugins/package-curation-providers/spring/src/main/kotlin/Utils.kt

@@ -0,0 +1,55 @@
+/*
+ * Copyright (C) 2025 The ORT Project Authors (see <https://github.com/oss-review-toolkit/ort/blob/main/NOTICE>)
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     https://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ *
+ * SPDX-License-Identifier: Apache-2.0
+ * License-Filename: LICENSE
+ */
+
+package org.ossreviewtoolkit.plugins.packagecurationproviders.spring
+
+import kotlinx.serialization.json.Json
+import kotlinx.serialization.json.jsonArray
+import kotlinx.serialization.json.jsonObject
+import kotlinx.serialization.json.jsonPrimitive
+
+import org.ossreviewtoolkit.utils.common.withoutSuffix
+import org.ossreviewtoolkit.utils.ort.downloadText
+import org.ossreviewtoolkit.utils.ort.okHttpClient
+
+internal fun getGitHubTree(owner: String, repo: String, revision: String): List<String> {
+    val json = okHttpClient
+        .downloadText("https://api.github.com/repos/$owner/$repo/git/trees/$revision?recursive=1")
+        .getOrThrow()
+
+    return Json.parseToJsonElement(json).jsonObject.getValue("tree").jsonArray.map {
+        it.jsonObject.getValue("path").jsonPrimitive.content
+    }
+}
+
+internal fun getSpringProjectPaths(projectName: String, projectVersion: String): Map<String, String> {
+    val paths = getGitHubTree("spring-projects", projectName, "v$projectVersion")
+
+    val projectPaths = paths.mapNotNull { path ->
+        path.withoutSuffix("/build.gradle")?.takeIf { it.startsWith(projectName) }
+    }
+
+    val projectPathsByName = projectPaths.associateBy { it.substringAfterLast('/') }
+
+    check(projectPathsByName.size == projectPaths.size) {
+        "Ambiguous mapping of project names to project paths."
+    }
+
+    return projectPathsByName
+}

plugins/package-curation-providers/spring/src/test/kotlin/SpringPackageCurationProviderTest.kt

@@ -26,6 +26,8 @@ import org.ossreviewtoolkit.model.Identifier
 import org.ossreviewtoolkit.model.Package
 import org.ossreviewtoolkit.model.PackageCuration
 import org.ossreviewtoolkit.model.PackageCurationData
+import org.ossreviewtoolkit.model.VcsInfo
+import org.ossreviewtoolkit.model.VcsInfoCurationData
 
 class SpringPackageCurationProviderTest : StringSpec({
     val provider = SpringPackageCurationProvider()
@@ -41,4 +43,21 @@ class SpringPackageCurationProviderTest : StringSpec({
             )
         )
     }
+
+    "Get the correct paths for Spring Boot projects" {
+        val id = Identifier("Maven:org.springframework.boot:spring-boot-antlib:3.5.4")
+        val pkg = Package.EMPTY.copy(
+            id = id,
+            vcsProcessed = VcsInfo.EMPTY.copy(url = "https://github.com/spring-projects/spring-boot.git")
+        )
+
+        provider.getCurationsFor(setOf(pkg)) shouldContainExactly setOf(
+            PackageCuration(
+                id = id,
+                data = PackageCurationData(
+                    vcs = VcsInfoCurationData(path = "spring-boot-project/spring-boot-tools/spring-boot-antlib")
+                )
+            )
+        )
+    }
 })