name: 'Dependency Review'
on: [pull_request]

permissions:
  contents: read

jobs:
  dependency-review:
    runs-on: ubuntu-latest
    steps:
      - name: 'Checkout Repository'
        uses: actions/checkout@v4
      - name: 'Dependency Review'

## Create a `get_current_user` dependency { #create-a-get-current-user-dependency }

Let's create a dependency `get_current_user`.

Remember that dependencies can have sub-dependencies?

`get_current_user` will have a dependency with the same `oauth2_scheme` we created before.

        <dependencies>
          <dependency>
            <groupId>org.apache.maven.its.mng3906</groupId>
            <artifactId>c</artifactId>
            <version>0.1</version>
          </dependency>
          <dependency>
            <groupId>org.apache.maven.its.mng3906</groupId>
            <artifactId>a</artifactId>
            <version>0.2</version>
          </dependency>
          <dependency>

      </dependency>
      <dependency>
        <groupId>org.codehaus.plexus</groupId>
        <artifactId>plexus-utils</artifactId>
        <version>1.0.4</version>
      </dependency>
      <dependency>
        <groupId>org.apache.maven.wagon</groupId>
        <artifactId>wagon-provider-api</artifactId>
        <version>1.0-alpha-5</version>
      </dependency>
      <dependency>

     */
    String TEST_JAVA_SOURCE = "test-java-source";

    /**
     * Returns the dependency type id.
     * The id uniquely identifies this <i>dependency type</i>.
     *
     * @return the id of this type, never {@code null}.
     */
    @Nonnull
    @Override
    String id();

    /**
     * Returns the dependency type language.
     *
     * @return the language of this type, never {@code null}.

    @Nonnull
    private DependencyCoordinates toDependency(org.apache.maven.api.model.Dependency dependency) {
        return new DependencyCoordinates() {
            @Override
            public String getGroupId() {
                return dependency.getGroupId();
            }

            @Override
            public String getArtifactId() {
                return dependency.getArtifactId();
            }

import org.apache.maven.api.annotations.Nonnull;

/**
 * Indicates when the dependency will be used.
 * For example, it may be at compile time only, at runtime, or at test time.
 * For a given dependency, the scope is directly derived from the
 * {@link org.apache.maven.api.model.Dependency#getScope()} and will be used when using {@link PathScope}
 * and the {@link org.apache.maven.api.services.DependencyResolver}.

    }

    static class CycleInImportsResolver extends BaseModelResolver {
        @Override
        public ModelSource resolveModel(Dependency dependency) throws UnresolvableModelException {
            return switch (dependency.getManagementKey()) {
                case BASE1_ID -> new StringModelSource(BASE1);
                case BASE2_ID -> new StringModelSource(BASE2);
                default -> null;

    }

    @Test
    void mergeSameDependencies() {
        Dependency dependency = Dependency.newBuilder()
                .groupId("groupId")
                .artifactId("artifactId")
                .type("type")
                .build();

        Model target =
                Model.newBuilder().dependencies(Arrays.asList(dependency)).build();

        Model source =

            for (Dependency dependency : project.getModel().getDelegate().getDependencies()) {
                addEdge(
                        projectMap,
                        vertexMap,
                        project,
                        projectVertex,
                        dependency.getGroupId(),
                        dependency.getArtifactId(),