Skip deprecated licenses in ImportSoftwareLicenses

* Add `deprecated` attribute to SPDX::License
* Skip deprecated licenses in ImportSoftwareLicensesWorker

ee/app/workers/import_software_licenses_worker.rb

@@ -8,6 +8,8 @@ class ImportSoftwareLicensesWorker
 
   def perform
     catalogue.each do |spdx_license|
+      next if spdx_license.deprecated
+
       if licenses[spdx_license.name]
         licenses_with(spdx_license.name)
           .update_all(spdx_identifier: spdx_license.id)

ee/lib/gitlab/spdx/catalogue.rb

@@ -32,7 +32,11 @@ module Gitlab
       end
 
       def map_from(license_hash)
-        ::Gitlab::SPDX::License.new(id: license_hash[:licenseId], name: license_hash[:name])
+        ::Gitlab::SPDX::License.new(
+          id: license_hash[:licenseId],
+          name: license_hash[:name],
+          deprecated: license_hash[:isDeprecatedLicenseId]
+        )
       end
     end
   end

ee/lib/gitlab/spdx/license.rb

@@ -2,6 +2,6 @@
 
 module Gitlab
   module SPDX
-    License = Struct.new(:id, :name, keyword_init: true)
+    License = Struct.new(:id, :name, :deprecated, keyword_init: true)
   end
 end

ee/spec/factories/spdx_license.rb

@@ -4,6 +4,7 @@ FactoryBot.define do
   factory :spdx_license, class: '::Gitlab::SPDX::License' do
     id { |n| "License-#{n}" }
     name { |n| "License #{n}" }
+    deprecated { false }
 
     trait :apache_1 do
       id { 'Apache-1.0' }
@@ -19,5 +20,16 @@ FactoryBot.define do
       id { 'MIT' }
       name { 'MIT License' }
     end
+
+    trait :deprecated_gpl_v1 do
+      id { 'GPL-1.0' }
+      name { 'GNU General Public License v1.0 only' }
+      deprecated { true }
+    end
+
+    trait :gpl_v1 do
+      id { 'GPL-1.0-only' }
+      name { 'GNU General Public License v1.0 only' }
+    end
   end
 end

ee/spec/lib/gitlab/spdx/catalogue_spec.rb

@@ -19,6 +19,16 @@ RSpec.describe Gitlab::SPDX::Catalogue do
     it { expect(subject.map(&:id)).to match_array(catalogue_hash[:licenses].map { |x| x[:licenseId] }) }
     it { expect(subject.map(&:name)).to match_array(catalogue_hash[:licenses].map { |x| x[:name] }) }
 
+    specify do
+      deprecrated_gpl = subject.find { |license| license.id == 'GPL-1.0' }
+      expect(deprecrated_gpl.deprecated).to be_truthy
+    end
+
+    specify do
+      gpl = subject.find { |license| license.id == 'GPL-1.0-only' }
+      expect(gpl.deprecated).to be_falsey
+    end
+
     context "when some of the licenses are missing an identifier" do
       let(:catalogue_hash) do
         {

ee/spec/workers/import_software_licenses_worker_spec.rb

@@ -8,15 +8,15 @@ describe ImportSoftwareLicensesWorker do
   let(:spdx_bsd_license) { build(:spdx_license, :bsd) }
   let(:spdx_mit_license) { build(:spdx_license, :mit) }
 
-  before do
-    allow(Gitlab::SPDX::Catalogue).to receive(:latest).and_return(catalogue)
-    allow(catalogue).to receive(:each)
-      .and_yield(spdx_apache_license)
-      .and_yield(spdx_bsd_license)
-      .and_yield(spdx_mit_license)
-  end
-
   describe '#perform' do
+    before do
+      allow(Gitlab::SPDX::Catalogue).to receive(:latest).and_return(catalogue)
+      allow(catalogue).to receive(:each)
+        .and_yield(spdx_apache_license)
+        .and_yield(spdx_bsd_license)
+        .and_yield(spdx_mit_license)
+    end
+
     let!(:apache) { create(:software_license, name: spdx_apache_license.name, spdx_identifier: nil) }
     let!(:mit) { create(:software_license, name: spdx_mit_license.name, spdx_identifier: spdx_mit_license.id) }
 
@@ -49,5 +49,21 @@ describe ImportSoftwareLicensesWorker do
       it { expect(apache.reload.spdx_identifier).to eql(spdx_apache_license.id) }
       it { expect(SoftwareLicense.pluck(:spdx_identifier)).to contain_exactly(spdx_apache_license.id, spdx_mit_license.id, spdx_bsd_license.id) }
     end
+
+    context 'when a license is deprecated' do
+      let!(:gpl) { create(:software_license, name: 'GNU General Public License v1.0 only', spdx_identifier: 'GPL-1.0') }
+      let(:spdx_old_gpl_license) { build(:spdx_license, :deprecated_gpl_v1) }
+      let(:spdx_new_gpl_license) { build(:spdx_license, :gpl_v1) }
+
+      before do
+        allow(catalogue).to receive(:each)
+          .and_yield(spdx_new_gpl_license)
+          .and_yield(spdx_old_gpl_license)
+
+        subject.perform
+      end
+
+      it { expect(gpl.reload.spdx_identifier).to eql('GPL-1.0-only') }
+    end
   end
 end