scanner: Add Nomos plugin

[Prakash-Mishra-9ghz]

This pull request introduces a new external scanner plugin for integrating FOSSology's Nomos license scanner into the OSS Review Toolkit (ORT).

🔹 What's implemented

• Nomos is implemented as an ExternalScanner.
• Supports command-line execution of Nomos and parses its output.
• Converts results into ORT's ScanResult model.

🔹 File breakdown

• Nomossa.kt: Main scanner class implementing the Scanner interface.
• NomossaConfig.kt: Loads configuration for invoking Nomos CLI.
• NomossaResultParser.kt: Parses Nomos output to extract license info.
• NomossaResultExtension.kt: Converts parsed data into ScanResult.
• build.gradle.kts: Sets up plugin dependencies and build configuration.

This plugin allows users to plug FOSSology’s Nomos agent into ORT workflows to enhance license detection coverage and flexibility.

[sschuberth]

Commit message title: According to conventional commits, the title should start with feat(scanner):.

[github-advanced-security]

detekt found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 57.41%. Comparing base (b2428f8) to head (25b9df9).
⚠️ Report is 621 commits behind head on main.

Additional details and impacted files

@@ Coverage Diff @@ ## main #10631 +/- ## ========================================= Coverage 57.41% 57.41% - Complexity 1705 1707 +2  ========================================= Files 346 346 Lines 12875 12875 Branches 1228 1228 ========================================= Hits 7392 7392 Misses 5005 5005 Partials 478 478 

Flag	Coverage Δ
funTest-no-external-tools	31.02% <ø> (+0.09%)	⬆️
test-ubuntu-24.04	42.40% <ø> (ø)

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
• 📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

[sschuberth]

detekt found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

@Prakash-Mishra-9ghz, please have a look at these issues and make all automated checks pass before we start with the actual code review.

[Prakash-Mishra-9ghz]

detekt found more than 20 potential problems in the proposed changes. Check the Files changed tab for more details.

@Prakash-Mishra-9ghz, please have a look at these issues and make all automated checks pass before we start with the actual code review.

Resolved all Detekt issues

Addressed.

[sschuberth]

@Prakash-Mishra-9ghz we have a policy to fix any issues identified during review / by automated checks in the actual commit that introduces the issue as long as the PR is still under review.

As your PR originally only had a single commit, this means to just amend that original commit with any updates. So please squash the two commits that you have now into just one again.

[Prakash-Mishra-9ghz]

@sschuberth I added the following copyright header: Copyright (C) 2025 Prakash Mishra. The CI failed due to this not being in the NOTICE file. Should I add myself there, or just remove the header?

[sschuberth]

The CI failed due to this not being in the NOTICE file. Should I add myself there, or just remove the header?

You should add yourself to the NOTICE file (grouped by year, then sorted alphabetically) and keep the generic Copyright header in the source file.

[Prakash-Mishra-9ghz]

hi @sschuberth could you help me to figure out the funtest-docker, test(unbuntu and windows) fail.
I think it might be due to missing tests or some configuration issue, but I’m not exactly sure.
Could you help me understand what’s going wrong?

[sschuberth]

hi @sschuberth could you help me to figure out the funtest-docker, test(unbuntu and windows) fail.

Those are temporary failures due to foojayio/discoapi#124, which had been fixed, but now is back again... we simply need to wait for that external service to recover. Just rebase your PR onto latest main in a few hours to check.

[sschuberth]

Just rebase your PR onto latest main in a few hours to check.

Will you do that rebase, @Prakash-Mishra-9ghz?

[Prakash-Mishra-9ghz]

@sschuberth Currently working on the Docker implementation for the plugin.

[Prakash-Mishra-9ghz]

@sschuberth CI is failing due to an sbt-assembly version mismatch—could you confirm if it is related to PR?

[sschuberth]

@sschuberth CI is failing due to an sbt-assembly version mismatch—could you confirm if it is related to PR?

No, it should not be related, I've retriggered the test.

[sschuberth]

Please see my comment over here: This implementation lacks functional tests that make use of the scanner to prove that the implementation is working.

[sschuberth]

I see that https://github.com/fossology/fossology/releases/tag/4.6.0-rc1 by now includes the FOSSology-nomossa binary so this implementation could be easily tested.

@Prakash-Mishra-9ghz, are you planning to continue working on this, or should we take over your work?

[Prakash-Mishra-9ghz]

@sschuberth I was also waiting for the release, so i will be continuing my work.

[Prakash-Mishra-9ghz]

Hi @sschuberth, I saw the funTest-external-tools failure but can’t tell which part is caused by my changes. Could you guide me?

[sschuberth]

Hi @sschuberth, I saw the funTest-external-tools failure but can’t tell which part is caused by my changes. Could you guide me?

The failure(s) is / are unrelated to your changes. Please rebase onto latest main to catch up with some test updates, and to resolve the conflict in the NOTICE file. But even after the rebase you may see failure due to current problems with the public VulnerableCode instance.

[sschuberth]

@Prakash-Mishra-9ghz, can you update me on the status of detecting copyright statements via Nomos? Is the CLI even capable of detecting copyright statements, or can it only detect license headers?

[Prakash-Mishra-9ghz]

@Prakash-Mishra-9ghz, can you update me on the status of detecting copyright statements via Nomos? Is the CLI even capable of detecting copyright statements, or can it only detect license headers?

Hi @sschuberth , apologies for the delayed update, the Nomos CLI is primarily designed to detect license texts rather than standalone copyright statements.