We currently have a separate build for the third party license check. We could integrate it into our main build. That way, if we change any dependencies, the build for merge request will fail, and we can update the dependencies file before merging to develop.
As I experienced in #476 (closed), we do forgot to update the DEPENDENCIES.txt file every now and then. The changes in this issue would mean that we can't forget anymore, as the build would then fail, preventing that we can merge to develop.
Is there a reason not to activate this check? In my experience, running the check takes little time. Fixing failing dependencies in the develop branch is quite a hassle (Create Issue, create branch, update DEPENDENCIES.txt, commit, create Merge Request, wait for build to pass, merge).
The only reason I can think of, is that we don't necessarily have to check this for a release. It is more a continuous thing. So, if a dependency suddenly no longer is supported, and this is a false positive, the build will fail. This is fine for develop. But then we also can't release. However, that is probably super rare. So, the benefits outweigh the downsides, I think. So, just a matter of doing it then, I think.
One issue I've noticed is that we get a lot of warnings. They were always there, but I ignored them. If we make it part of the build, the 1481 warnings are a bit annoying. I've reported the issue to the Dash license tool: https://github.com/eclipse/dash-licenses/issues/199
I'll remove this from milestone %v1.0, as it is unlikely the Dash license check tool gets fixed any time soon, as the request has been open for a long time, and the fix that was done earlier led to all kinds of side-effects.