Add support for authors in ORT package list generation (#1988)

* Add support for authors in ORT package list generation

This updates the ORT pipe to include the 'authors' field in the generated package list YAML. The authors are extracted from the package parties where the role is 'maintainer'.

Ref: #1987
Signed-off-by: Fabian Noll <Fabian.Noll@googlemail.com>

* Include 'author' role in ORT authors list and update test data

This extends the authors extraction to include parties with the 'author' role, in addition to 'maintainer'. It also updates the asgiref test data to match the expected output.

Ref: #1987
Signed-off-by: Fabian Noll <Fabian.Noll@googlemail.com>

---------

Signed-off-by: Fabian Noll <Fabian.Noll@googlemail.com>

Author: FabianRolfMatthiasNoll

scanpipe/pipes/ort.py

@@ -76,6 +76,7 @@ class Vcs:
 #     val concludedLicense: SpdxExpression? = null,
 #     val description: String? = null,
 #     val homepageUrl: String? = null,
+#     val authors: Set<String> = emptySet(),
 #     val isExcluded: Boolean = false,
 #     val isDynamicallyLinked: Boolean = false,
 #     val labels: Map<String, String> = emptyMap()
@@ -90,6 +91,7 @@ class Dependency:
     # concludedLicense: str = None
     description: str = None
     homepageUrl: str = None
+    authors: list = field(default_factory=set)
     # isExcluded: bool = False
     # isDynamicallyLinked: bool = False
     # labels: dict = field(default_factory=dict)
@@ -134,6 +136,12 @@ def to_ort_package_list_yml(project):
 
     dependencies = []
     for package in project.discoveredpackages.all():
+        authors = {
+            party.get("name").strip()
+            for party in package.parties
+            if party.get("role") in ("author", "maintainer") and party.get("name")
+        }
+
         dependency = Dependency(
             id=f"{project_type or package.type}::{package.name}:{package.version}",
             purl=package.purl,
@@ -142,6 +150,7 @@ def to_ort_package_list_yml(project):
             vcs=Vcs(url=package.vcs_url),
             description=package.description,
             homepageUrl=package.homepage_url,
+            authors=sorted(authors),
         )
         dependencies.append(dependency)
 

scanpipe/tests/data/asgiref/asgiref-3.3.0.package-list.yml

@@ -220,6 +220,8 @@ dependencies:
       This repository is part of the Channels project. For the shepherd and maintenance team, please see the
       `main Channels readme <https://github.com/django/channels/blob/master/README.rst>`_.
     homepageUrl: https://github.com/django/asgiref/
+    authors:
+      - Django Software Foundation
   - id: pypi::asgiref:3.3.0
     purl: pkg:pypi/asgiref@3.3.0
     vcs:
@@ -435,3 +437,5 @@ dependencies:
       This repository is part of the Channels project. For the shepherd and maintenance team, please see the
       `main Channels readme <https://github.com/django/channels/blob/master/README.rst>`_.
     homepageUrl: https://github.com/django/asgiref/
+    authors:
+      - Django Software Foundation

scanpipe/tests/pipes/test_ort.py

@@ -65,6 +65,9 @@ def test_scanpipe_ort_pipes_to_ort_package_list_yml(self):
                     "declaredLicenses": ["GPL-2.0-only AND GPL-2.0-or-later"],
                     "description": "add and remove users and groups",
                     "homepageUrl": "https://packages.debian.org",
+                    "authors": [
+                        "Debian Adduser Developers <adduser@packages.debian.org>"
+                    ],
                 }
             ],
         }