fix(reporter): Fix the creation of first level dependency relationships

As of [1] the SPDX document was changed to have separate entries for all
projects and sub-projects instead of a single artificial root project
containing all dependencies. While excluded packages are not included in
the package, the implementation [1] accidentally creates (dangling)
relationships to such excluded packages, see [2].

Fix the issue visible in [2] by the code change further up and an analog
issue not visible in the expected result diff with the code change some
lines further down.

Fixes #7487.

[1] b471544
[2] b471544#diff-6de35dd2aff1f92b7f5ea558d3f77e02d0d596dd4ce2a8199056cfb31b47fcabR181-R184

Signed-off-by: Frank Viernau <[email protected]>

Author: fviernau

plugins/reporters/spdx/src/funTest/assets/spdx-document-reporter-expected-output.spdx.json

@@ -240,10 +240,6 @@
     "spdxElementId" : "SPDXRef-Package-Maven-seventh-package-group-seventh-package-0.0.1",
     "relationshipType" : "GENERATED_FROM",
     "relatedSpdxElement" : "SPDXRef-Package-Maven-seventh-package-group-seventh-package-0.0.1-source-artifact"
-  }, {
-    "spdxElementId" : "SPDXRef-Project-Maven-first-project-group-first-project-name-0.0.1",
-    "relationshipType" : "DEPENDS_ON",
-    "relatedSpdxElement" : "SPDXRef-Package-Maven-fifth-package-group-fifth-package-0.0.1"
   }, {
     "spdxElementId" : "SPDXRef-Project-Maven-first-project-group-first-project-name-0.0.1",
     "relationshipType" : "DEPENDS_ON",

plugins/reporters/spdx/src/funTest/assets/spdx-document-reporter-expected-output.spdx.yml

@@ -241,9 +241,6 @@ relationships:
 - spdxElementId: "SPDXRef-Package-Maven-seventh-package-group-seventh-package-0.0.1"
   relationshipType: "GENERATED_FROM"
   relatedSpdxElement: "SPDXRef-Package-Maven-seventh-package-group-seventh-package-0.0.1-source-artifact"
-- spdxElementId: "SPDXRef-Project-Maven-first-project-group-first-project-name-0.0.1"
-  relationshipType: "DEPENDS_ON"
-  relatedSpdxElement: "SPDXRef-Package-Maven-fifth-package-group-fifth-package-0.0.1"
 - spdxElementId: "SPDXRef-Project-Maven-first-project-group-first-project-name-0.0.1"
   relationshipType: "DEPENDS_ON"
   relatedSpdxElement: "SPDXRef-Package-Maven-first-package-group-first-package-0.0.1"

plugins/reporters/spdx/src/main/kotlin/SpdxDocumentModelMapper.kt

@@ -72,7 +72,8 @@ internal object SpdxDocumentModelMapper : Logging {
 
             ortResult.getDependencies(
                 id = project.id,
-                maxLevel = 1
+                maxLevel = 1,
+                omitExcluded = true
             ).mapTo(relationships) { dependency ->
                 SpdxRelationship(
                     spdxElementId = spdxProjectPackage.spdxId,
@@ -96,7 +97,8 @@ internal object SpdxDocumentModelMapper : Logging {
 
             ortResult.getDependencies(
                 id = pkg.id,
-                maxLevel = 1
+                maxLevel = 1,
+                omitExcluded = true
             ).mapTo(relationships) { dependency ->
                 SpdxRelationship(
                     spdxElementId = binaryPackage.spdxId,