Multiple Releases when getting by externalID lead to empty Optional

[neubs-bsi]

Summary of the Bug

Due to the restructuring of the setting of the component name it has occured, that there are multiple releases with the same external IDs.

Currently this leads to an empty optional being returned and the release to be skipped.

This could lead to missing curated information either when enriching the antenna run or when trying to update release information in the updater.

Steps to reproduce

• Run example project with activated SW360 workflow steps on instance that has two releases with same external id.
• See a warning output that describes that multiple releases have been found.

Acceptance Criteria

• A decision is made how to handle multiple releases
• Decision is implemented

Definition of Done

• Acceptance criteria fulfilled
• A test case is created to reproduce the bug
• A PR is created, the CI infrastructure reports green, the bug test case proves that bug is fixed
• The PR is reviewed and approved
• No TODOs left in the code unless explained in the ticket, if something else is still open, this is summarized in a comment in the issue
• Documentation is updated

[oheger-bosch]

The API of the SW360 client library has changed in the meantime. It no longer returns an empty Optional if there are multiple releases with the same external ID, but throws an exception in this case. This makes it at least possible to detect this error condition.

Nevertheless, the underlying problem still exists; releases with duplicate IDs cannot be handled correctly by the Antenna compliance tool; the tool logs a warning and then skips to the next release. I do not think that it is possible to do something different on that level; there is simply no way for the tool to decide which release is the correct one. The user has to take action, e.g. to remove duplicates.

[sschuberth]

As discussed internally the first "stop-gap" should be measure to implement in SW360 directly that no component with an existing external ID can be created.

[neubs-bsi]

• create issue in SW360

[oheger-bosch]

Created eclipse-sw360/sw360#1000 to track this in SW360.