Update Maven Enforcer, add Animal Sniffer and Test annotations #14

oleg-nenashev · 2017-08-08T09:21:32Z

The most of the configurations come from Plugin POM. In longer term we need to merge two POMs somehow (e.g. make this POM a parent for Plugin POM), but now I just moved the common Enforcer and Animal Sniffer checks

Downstream PRs:

@reviewbybees esp. @jglick since it enforces upper bounds in Jenkins core && may collide with jenkinsci/jenkins#2956

The most of the configurations come from Plugin POM. In longer term we need to merge two POMs somehow (e.g. make this POM a parent for Plugin POM), but now I just moved the common Enforcer and Animal Sniffer checks

ghost · 2017-08-08T09:26:06Z

This pull request originates from a CloudBees employee. At CloudBees, we require that all pull requests be reviewed by other CloudBees employees before we seek to have the change accepted. If you want to learn more about our process please see this explanation.

oleg-nenashev · 2017-08-08T10:12:40Z

Hmm... @olamy @aheritier Is is as designed In Apache? Meven Embedded 3.5.0 bundles Maven Core 3.3.1

+-org.jenkins-ci.main.maven:maven35-agent:1.12-SNAPSHOT
  +-org.apache.maven:maven-embedder:3.5.0
    +-org.apache.maven:maven-core:3.3.1

+-org.jenkins-ci.main.maven:maven35-agent:1.12-SNAPSHOT
  +-org.apache.maven:maven-embedder:3.5.0
    +-org.apache.maven:maven-compat:3.5.0
      +-org.apache.maven:maven-core:3.5.0

aheritier · 2017-08-08T10:58:43Z

Nope it's strange Le mar. 8 août 2017 à 12:12, Oleg Nenashev <notifications@github.com> a écrit :

Hmm... @olamy <https://github.com/olamy> @aheritier <https://github.com/aheritier> Is is as designed In Apache? Meven Embedded 3.5.0 bundles Maven Core 3.3.1 +-org.jenkins-ci.main.maven:maven35-agent:1.12-SNAPSHOT +-org.apache.maven:maven-embedder:3.5.0 +-org.apache.maven:maven-core:3.3.1 — You are receiving this because you were mentioned. Reply to this email directly, view it on GitHub <#14 (comment)>, or mute the thread <https://github.com/notifications/unsubscribe-auth/AAKqCEhSHMI6BY5g7CEL_kJ5iPP-Igz4ks5sWDSYgaJpZM4Owdz-> .

-- ----- Arnaud Héritier http://aheritier.net Mail/GTalk: aheritier AT gmail DOT com Twitter/Skype : aheritier

oleg-nenashev · 2017-08-08T11:28:05Z

@aheritier Yes, my guess, it's a bug in Apache Maven Embedder dependencies. In jenkinsci/maven-interceptors#12 I made the things working, but I will definitely raise a defect to the MEMBEDDER

jglick

May be OK but really it needs to be preintegrated with more downstream POMs to see how well it works.

jglick · 2017-08-08T19:33:57Z

pom.xml

+                    <!--  findbugs dep managed to provided and optional so is not shipped and missing annotations ok -->
+                    <exclude>com.google.code.findbugs:annotations</exclude>
+                  </excludes>
+                  <!-- To add exclusions in a Jenkins plugin, use:


component, generally not a Jenkins plugin

Agreed, will patch

jglick · 2017-08-08T19:34:33Z

pom.xml

+                -->
+                <requireReleaseDeps>
+                  <message>No Snapshots Allowed For Release Versions</message>
+                  <onlyWhenRelease>true</onlyWhenRelease>


Note that maven-release-plugin enforces this on its own anyway.

jglick · 2017-08-08T19:35:00Z

pom.xml

+
+                <!--  TODO: Disabled. Ideally it should be enforced for ANY library bundled into the Jenkins core,
+                      But right now there no good way to determine whether it is bundled or not.
+                      It should be done via profles somehow


I do not see any need for profiles for this.

What would be your proposal?

Any module, or intermediate parent POM, which requires bannedDependencies can add it on its own. Anyway

the list of excludes is unlikely to be sharable across classes of modules (it makes sense in plugin-pom)

a module POM cannot inherit a profile from its parent in a way that would be useful here (since you cannot activate it automatically; longstanding Maven limitation)

Just delete the commented-out block IMO.

We could add another parent POM for in-Jenkins components. Everybody likes Russian dolls, right? :/

Created https://issues.jenkins-ci.org/browse/JENKINS-46237 for it in order to follow-up later

jglick

Some minor complaints. More broadly, this needs downstream PRs demonstrating the effect on the most important consumers: jenkinsci/jenkins/pom.xml, plugin-pom/pom.xml, and some representative plugin using plugin-pom. Presumably the direct downstream PRs should be able to delete a bunch of now-redundant configuration.

jglick · 2017-08-15T19:37:23Z

pom.xml

+      </dependency>
+    </dependencies>
+  </dependencyManagement>
+  <dependencies>


Never add any dependencies to a parent POM unless (like plugin-pom) it is designed solely for a specific packaging and class of module. A module using this parent may add the dependency if it wants it.

jglick · 2017-08-15T19:38:46Z

pom.xml

+      <groupId>org.codehaus.mojo</groupId>
+      <artifactId>animal-sniffer-annotations</artifactId>
+      <scope>provided</scope>
+      <optional>true</optional><!-- no need to have this at runtime -->


Is there a purpose in being both provided and optional? I see that plugin-pom does this but I wonder if it is a mistake. @stephenc would know best.

provided should be enough but I have a doubt. Maybe a hack used in others cases (maybe with the maven-hpi-plugin)

jglick · 2017-08-15T19:39:13Z

pom.xml

+    <dependency>
+      <groupId>org.jenkins-ci</groupId>
+      <artifactId>test-annotations</artifactId>
+      <version>${test-annotations.version}</version>


This would be a natural candidate for dependencyManagement.

No strong opinion. It seems to be useful to have it in all projects inheriting from this POM. In plugin POM we ship multiple deps in such way as well.

I agree with @jglick advice to never add a dep in such high level pom because you cannot remove them in children. This is a mandatory rule for compile deps. For deps and provided like here it could be an exception I think.

Note that plugin POM already adds a test dependency for Test Annotations: https://github.com/jenkinsci/plugin-pom/blob/master/pom.xml#L244-L247

I will move it to the dependency management for now

jglick · 2017-08-15T19:39:47Z

pom.xml

-                  <version>(,3.0),[3.0.4,)</version>
-                  <message>Build with Maven 3.0.4 or later. Maven 3.0 through 3.0.3 inclusive do not pass correct settings.xml to Maven Release Plugin.</message>
+                  <version>[3.1.0,)</version>
+                  <message>3.1.0 required at least.</message>


3.1.0 is pretty old; feel free to go older. (What do we actually test with?)

3.1.0 is pretty old; feel free to go older

Did you mean to write this?

By default the build on my machine runs with 3.3.3.
Requesting 3.3.9 or above could be reasonable.

yes let's start at 3.3.9 nowadays.

jglick · 2017-08-15T19:43:14Z

pom.xml

+
+                <!--  TODO: Disabled. Ideally it should be enforced for ANY library bundled into the Jenkins core,
+                      But right now there no good way to determine whether it is bundled or not.
+                      It should be done via profles somehow


Any module, or intermediate parent POM, which requires bannedDependencies can add it on its own. Anyway

the list of excludes is unlikely to be sharable across classes of modules (it makes sense in plugin-pom)

a module POM cannot inherit a profile from its parent in a way that would be useful here (since you cannot activate it automatically; longstanding Maven limitation)

Just delete the commented-out block IMO.

jglick · 2017-08-15T19:43:31Z

pom.xml

+          <dependency>
+            <groupId>org.codehaus.mojo</groupId>
+            <artifactId>extra-enforcer-rules</artifactId>
+            <version>1.0-beta-4</version>


BTW 1.0-beta-6 is available. But beta 4 has the critical NPE fix.

oleg-nenashev · 2017-08-16T07:24:39Z

jenkinsci/jenkins/pom.xml, plugin-pom/pom.xml, and some representative plugin using plugin-pom.

Plugin POM does not inherit from this POM. As I said in the PR description, it should be done at some point, but now these POMs are independent (which is weird)

aheritier

Few comments, but LGTM otherwise

aheritier · 2017-08-16T10:17:35Z

pom.xml

+      <groupId>org.codehaus.mojo</groupId>
+      <artifactId>animal-sniffer-annotations</artifactId>
+      <scope>provided</scope>
+      <optional>true</optional><!-- no need to have this at runtime -->


provided should be enough but I have a doubt. Maybe a hack used in others cases (maybe with the maven-hpi-plugin)

aheritier · 2017-08-16T10:19:21Z

pom.xml

+    <dependency>
+      <groupId>org.jenkins-ci</groupId>
+      <artifactId>test-annotations</artifactId>
+      <version>${test-annotations.version}</version>


I agree with @jglick advice to never add a dep in such high level pom because you cannot remove them in children. This is a mandatory rule for compile deps. For deps and provided like here it could be an exception I think.

aheritier · 2017-08-16T10:19:53Z

pom.xml

-                  <version>(,3.0),[3.0.4,)</version>
-                  <message>Build with Maven 3.0.4 or later. Maven 3.0 through 3.0.3 inclusive do not pass correct settings.xml to Maven Release Plugin.</message>
+                  <version>[3.1.0,)</version>
+                  <message>3.1.0 required at least.</message>


yes let's start at 3.3.9 nowadays.

oleg-nenashev · 2017-08-16T12:35:51Z

Deployed it as https://repo.jenkins-ci.org/snapshots/org/jenkins-ci/jenkins/1.38-SNAPSHOT/jenkins-1.38-20170816.123524-1

oleg-nenashev · 2017-08-16T13:37:05Z

@jglick @aheritier Created pull requests to Jenkins core and Remoting as a reference. The work on my machine (c).

jglick · 2017-08-17T20:42:57Z

Plugin POM does not inherit from this POM. As I said in the PR description, it should be done at some point, but now these POMs are independent

But should not the switch to have plugin-pom inherit from jenkins-pom be a goal of this work?

jglick

animal-sniffer-annotations should also be moved to dependencyManagement I think. Other than that this looks OK in and of itself (have not yet looked at the new downstreams).

oleg-nenashev · 2017-08-17T21:02:29Z

@jglick Done. I would rather vote for having common dependencies declared in Maven POM, but maybe I should google for "Thinking in Maven" first

oleg-nenashev · 2017-08-21T12:43:47Z

@reviewbybees done

oleg-nenashev · 2017-08-21T12:44:33Z

I am about landing and releasing it to unblock the Maven plugin patches. Will do it on the evening if there is no -1s

aheritier

🐝

jglick · 2017-09-07T20:52:32Z

pom.xml

-                  <version>(,3.0),[3.0.4,)</version>
-                  <message>Build with Maven 3.0.4 or later. Maven 3.0 through 3.0.3 inclusive do not pass correct settings.xml to Maven Release Plugin.</message>
+                  <version>[3.3.9,)</version>
+                  <message>3.3.9 is required at least.</message>


BTW was there any specific reason for this bump, or just to be on the safe side?

See the discission in #14 (comment) . No specific reason for this version

oleg-nenashev added 2 commits August 8, 2017 11:17

Update Maven Enforcer, add Animal Sniffer and Test annotations

47fcc36

The most of the configurations come from Plugin POM. In longer term we need to merge two POMs somehow (e.g. make this POM a parent for Plugin POM), but now I just moved the common Enforcer and Animal Sniffer checks

POM: Also require Upper bounds

988ab98

This was referenced Aug 8, 2017

Let's try to keep our building tools up-to-date Why ? Because ... #13

Closed

POM Facelift, Upper bounds cleanup jenkinsci/maven-interceptors#12

Merged

oleg-nenashev requested a review from jglick August 8, 2017 16:28

jglick reviewed Aug 8, 2017

View reviewed changes

oleg-nenashev mentioned this pull request Aug 15, 2017

[JENKINS-46053, JENKINS-45271, JENKINS-46210, JENKINS-46148] - Update HttpClient libraries and Fix Parent POM jenkinsci/maven-plugin#102

Merged

6 tasks

jglick requested changes Aug 15, 2017

View reviewed changes

aheritier reviewed Aug 16, 2017

View reviewed changes

Address comments from @jglick and @aheritier

e0e3902

This was referenced Aug 16, 2017

Update POM to Jenkins Parent POM 1.38 jenkinsci/remoting#188

Merged

Update to Jenkins Parent POM 1.38 jenkinsci/jenkins#2985

Merged

jglick requested changes Aug 17, 2017

View reviewed changes

Do not add dependency on annotations anymore

ee63236

jglick approved these changes Aug 21, 2017

View reviewed changes

aheritier approved these changes Aug 21, 2017

View reviewed changes

oleg-nenashev merged commit 1e85177 into jenkinsci:master Aug 21, 2017

jglick reviewed Sep 7, 2017

View reviewed changes

Update Maven Enforcer, add Animal Sniffer and Test annotations #14

Update Maven Enforcer, add Animal Sniffer and Test annotations #14

Conversation

oleg-nenashev commented Aug 8, 2017 • edited Loading

ghost commented Aug 8, 2017

oleg-nenashev commented Aug 8, 2017 • edited Loading

aheritier commented Aug 8, 2017 via email

oleg-nenashev commented Aug 8, 2017

jglick left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

jglick left a comment • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

oleg-nenashev commented Aug 16, 2017

aheritier left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

oleg-nenashev commented Aug 16, 2017

oleg-nenashev commented Aug 16, 2017

jglick commented Aug 17, 2017

jglick left a comment

Choose a reason for hiding this comment

oleg-nenashev commented Aug 17, 2017

oleg-nenashev commented Aug 21, 2017

oleg-nenashev commented Aug 21, 2017

aheritier left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

oleg-nenashev commented Aug 8, 2017 •

edited

Loading

oleg-nenashev commented Aug 8, 2017 •

edited

Loading

jglick left a comment •

edited

Loading