// ----------------------------------------------------------------------

        // List
        Dependency dependency = (Dependency) ReflectionValueExtractor.evaluate("project.dependencies[0]", project);

        assertNotNull(dependency);

        assertEquals("dep1", dependency.getArtifactId());

         * aftereffects and bogus error messages.
         */
        List<Dependency> dependencies = model.getDependencies();
        Map<String, Dependency> normalized = new LinkedHashMap<>(dependencies.size() * 2);

        for (Dependency dependency : dependencies) {
            normalized.put(dependency.getManagementKey(), dependency);
        }

        if (dependencies.size() != normalized.size()) {

  </scm>
  <dependencyManagement>
    <dependencies>
      <dependency>
        <groupId>maven-test</groupId>
        <artifactId>t05-b</artifactId>
        <version>1.0</version>
      </dependency>
      <dependency>
        <groupId>maven-test</groupId>
        <artifactId>t05-d</artifactId>
        <version>1.0</version>
      </dependency>
    </dependencies>
  </dependencyManagement>
  <dependencies>

    <dependencies>
      <dependency>
        <groupId>maven-test</groupId>
        <artifactId>t07-b</artifactId>
        <version>1.0</version>
      </dependency>
      <dependency>
        <groupId>maven-test</groupId>
        <artifactId>t07-d</artifactId>
        <version>1.0</version>
        <scope>test</scope>
        <optional>false</optional>
      </dependency>
    </dependencies>

We can do better...

## What makes a dependency { #what-makes-a-dependency }

Up to now you have seen dependencies declared as functions.

But that's not the only way to declare dependencies (although it would probably be the more common).

The key factor is that a dependency should be a "callable".

A "**callable**" in Python is anything that Python can "call" like a function.

  <dependencies>

    <dependency>
      <groupId>maven-test-compile</groupId>
      <artifactId>scope-default</artifactId>
      <version>1.0</version>
    </dependency>

    <dependency>
      <groupId>maven-test-compile</groupId>
      <artifactId>scope-test</artifactId>
      <version>1.0</version>
      <scope>test</scope>
    </dependency>

    <dependency>
      <groupId>maven-test-compile</groupId>

name: 'Dependency Review'
on: [pull_request]

permissions:
  contents: read

jobs:
  dependency-review:
    runs-on: ubuntu-latest
    steps:
      - name: 'Checkout Repository'
        uses: actions/checkout@v4
      - name: 'Dependency Review'

  <dependencyManagement>

    <dependencies>

      <dependency>
        <groupId>maven-test</groupId>
        <artifactId>t04-a</artifactId>
        <version>1.0</version>
      </dependency>

      <dependency>
        <groupId>maven-test</groupId>
        <artifactId>t04-b</artifactId>
        <version>1.0</version>
      </dependency>

    <dependency>
      <groupId>maven-test</groupId>

    private DependencyCoordinates toDependency(org.apache.maven.api.model.Dependency dependency) {
        return new DependencyCoordinates() {
            @Override
            public String getGroupId() {
                return dependency.getGroupId();
            }

            @Override
            public String getArtifactId() {
                return dependency.getArtifactId();
            }

            @Override

import org.apache.maven.api.annotations.Nonnull;

/**
 * Indicates when the dependency will be used.
 * For example, it may be at compile time only, at runtime, or at test time.
 * For a given dependency, the scope is directly derived from the
 * {@link org.apache.maven.api.model.Dependency#getScope()} and will be used when using {@link PathScope}
 * and the {@link org.apache.maven.api.services.DependencyResolver}.