From d170cec151c9fcdc7b680b0af7ccf7347a420117 Mon Sep 17 00:00:00 2001
From: "Piotr P. Karwasz" <pkarwasz-github@apache.org>
Date: Thu, 23 Jul 2026 16:00:28 +0200
Subject: [PATCH] Align Apache RAT configuration with the ATR license check

Bump `apache-rat-plugin` to `0.18` (requires Java 17) and configure it to
mirror the RAT invocation of the ASF Trusted Releases platform, see
`atr/tasks/checks/rat.py` in `apache/tooling-trusted-releases`:

- The POM only contains the exclusions that ATR itself applies: the
  `MISC`, `HIDDEN_DIR` and `MAC` standard collections, the generated
  file patterns and the counter minimums.
- The SCM and IDE standard collections are applied by the new
  `apache-rat-std-excludes` profile, only when the build root contains
  no `.rat-excludes` file, matching ATR's behavior.
- When `.rat-excludes` is present, the new `apache-rat-excludes-file`
  profile passes it to RAT instead, like ATR does.
- Project-specific exclusions move from the POM, which ATR never reads,
  to a new `.rat-excludes` file at the build root.

Assisted-By: Claude Fable 5 <noreply@anthropic.com>
---
 .rat-excludes                                |   2 +
 pom.xml                                      | 102 ++++++++++++++++---
 src/changelog/.12.x.x/align-rat-with-atr.xml |  10 ++
 3 files changed, 102 insertions(+), 12 deletions(-)
 create mode 100644 .rat-excludes
 create mode 100644 src/changelog/.12.x.x/align-rat-with-atr.xml

diff --git a/.rat-excludes b/.rat-excludes
new file mode 100644
index 00000000..a3d4845e
--- /dev/null
+++ b/.rat-excludes
@@ -0,0 +1,2 @@
+.java-version
+src/changelog/**/*.xml
diff --git a/pom.xml b/pom.xml
index a5c9de68..16da9842 100644
--- a/pom.xml
+++ b/pom.xml
@@ -217,6 +217,8 @@
     <restrict-imports-enforcer-rule.version>3.0.0</restrict-imports-enforcer-rule.version>
     <spotbugs-maven-plugin.version>4.9.8.3</spotbugs-maven-plugin.version>
     <spotless-maven-plugin.version>3.4.0</spotless-maven-plugin.version>
+    <!-- RAT `0.18` requires Java 17; therefore `org.apache:apache` is stuck on RAT `0.16.1` -->
+    <version.apache-rat-plugin>0.18</version.apache-rat-plugin>
     <xml-maven-plugin.version>1.2.1</xml-maven-plugin.version>
 
     <!-- plugin dependencies versions -->
@@ -587,21 +589,31 @@
       <plugin>
         <groupId>org.apache.rat</groupId>
         <artifactId>apache-rat-plugin</artifactId>
+        <!-- Mirror the RAT invocation of the ASF Trusted Releases platform (ATR):
+             https://github.com/apache/tooling-trusted-releases/blob/main/atr/tasks/checks/rat.py -->
         <configuration>
           <consoleOutput>true</consoleOutput>
+          <inputExcludeStds>
+            <inputExcludeStd>MISC</inputExcludeStd>
+            <inputExcludeStd>HIDDEN_DIR</inputExcludeStd>
+            <inputExcludeStd>MAC</inputExcludeStd>
+          </inputExcludeStds>
+          <counterMins>
+            <counterMin>LICENSE_CATEGORIES:0</counterMin>
+            <counterMin>LICENSE_NAMES:0</counterMin>
+            <counterMin>STANDARDS:0</counterMin>
+          </counterMins>
           <excludes combine.children="append">
-            <exclude>.java-version</exclude>
-            <exclude>.mvn/jvm.config</exclude>
-            <exclude>**/*.txt</exclude>
-            <!-- The license header in changelog entry files causing Git to match irrelevant files.
-                 This is eventually causing merge conflicts.
-                 Hence, we avoid enforcing license headers there. -->
-            <exclude>src/changelog/**/*.xml</exclude>
-            <!-- License headers in GitHub templates pollute the prompt displayed to the user: -->
-            <exclude>.github/ISSUE_TEMPLATE/*.md</exclude>
-            <exclude>.github/pull_request_template.md</exclude>
-            <!-- `.logging-parent-bom-activator` activates the `bom` Maven profile: -->
-            <exclude>.logging-parent-bom-activator</exclude>
+            <!-- Generated files, always excluded by ATR (`GENERATED_FILE_SUFFIXES` in `atr/constants.py`): -->
+            <exclude>**/*.bundle.js</exclude>
+            <exclude>**/*.chunk.js</exclude>
+            <exclude>**/*.css.map</exclude>
+            <exclude>**/*.js.map</exclude>
+            <exclude>**/*.min.css</exclude>
+            <exclude>**/*.min.js</exclude>
+            <exclude>**/*.min.map</exclude>
+            <!-- ATR excludes the `.rat-excludes` file itself from the check: -->
+            <exclude>.rat-excludes</exclude>
           </excludes>
         </configuration>
         <executions>
@@ -934,6 +946,72 @@
 
   <profiles>
 
+    <!-- The two `apache-rat-*` profiles below mirror the behavior of the ATR license check:
+         - when the checked tree contains no `.rat-excludes` file,
+           ATR applies the SCM and IDE related standard exclusion collections;
+         - when a `.rat-excludes` file is present, ATR passes it via the `input-exclude-file` option instead.
+
+         The `.rat-excludes` file is looked up in the root directory of the multi-module build,
+         which corresponds to the root of the source archive checked by ATR.
+         See: https://github.com/apache/tooling-trusted-releases/blob/main/atr/tasks/checks/rat.py -->
+    <profile>
+
+      <id>apache-rat-std-excludes</id>
+
+      <activation>
+        <file>
+          <missing>${maven.multiModuleProjectDirectory}/.rat-excludes</missing>
+        </file>
+      </activation>
+
+      <build>
+        <plugins>
+
+          <plugin>
+            <groupId>org.apache.rat</groupId>
+            <artifactId>apache-rat-plugin</artifactId>
+            <configuration>
+              <inputExcludeStds combine.children="append">
+                <inputExcludeStd>MAVEN</inputExcludeStd>
+                <inputExcludeStd>ECLIPSE</inputExcludeStd>
+                <inputExcludeStd>IDEA</inputExcludeStd>
+                <inputExcludeStd>GIT</inputExcludeStd>
+                <inputExcludeStd>STANDARD_SCMS</inputExcludeStd>
+              </inputExcludeStds>
+            </configuration>
+          </plugin>
+
+        </plugins>
+      </build>
+
+    </profile>
+
+    <profile>
+
+      <id>apache-rat-excludes-file</id>
+
+      <activation>
+        <file>
+          <exists>${maven.multiModuleProjectDirectory}/.rat-excludes</exists>
+        </file>
+      </activation>
+
+      <build>
+        <plugins>
+
+          <plugin>
+            <groupId>org.apache.rat</groupId>
+            <artifactId>apache-rat-plugin</artifactId>
+            <configuration>
+              <inputExcludeFile>${maven.multiModuleProjectDirectory}/.rat-excludes</inputExcludeFile>
+            </configuration>
+          </plugin>
+
+        </plugins>
+      </build>
+
+    </profile>
+
     <!-- `bom` profile to generate BOMs -->
     <profile>
 
diff --git a/src/changelog/.12.x.x/align-rat-with-atr.xml b/src/changelog/.12.x.x/align-rat-with-atr.xml
new file mode 100644
index 00000000..a67c3eaf
--- /dev/null
+++ b/src/changelog/.12.x.x/align-rat-with-atr.xml
@@ -0,0 +1,10 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<entry xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+       xmlns="https://logging.apache.org/xml/ns"
+       xsi:schemaLocation="https://logging.apache.org/xml/ns https://logging.apache.org/xml/ns/log4j-changelog-0.xsd"
+       type="changed">
+  <description format="asciidoc">
+      Update Apache RAT to `0.18` and align its configuration with the license check of the ASF Trusted Releases platform (ATR).
+      Project-specific exclusions must now be placed in a `.rat-excludes` file in the root directory of the build.
+  </description>
+</entry>