feat: support jdk 8-13 during build

[sfat]

• Ready for review
• Follows CONTRIBUTING rules
• Reviewed by Snyk internal team

What are the relevant tickets?

#60

[CLAassistant]

All committers have signed the CLA.

[sfat]

@lili2311 , I need some help with this one. Does it have anything to do with the fact that I am not part of Snyk org or is something that is broken on my end?

[lili2311]

Checking

[lili2311]

Just looks flaky 🤔 Re-running and let's see

[lili2311]

These tests on cli plugins run without any snyk token, only npm token for releasing

[lili2311]

Different failure now, looks legit? Please take a look

[sfat]

I think I found the culprit:

  38 passing (10m)

And after 10 min (i.e. 600seconds) it will timeout ("test-system": "tap -Rspec --timeout=600 ./test/system/*.test.[tj]s")

I'm guessing since the stages now will take longer since it will do multiple jdks, the VM from travis is probably slower at running the tests in parallel.

I've increased it to 700. Not sure if this will fix it.

Let me know if this is something is not desired.

[sfat]

Another idea would be to disable the timeout. (i.e. replacing --timeout with --no-timeout).
Do you know if the timeout was put on purpose or what would be the issue if the tests do not have this flag set? Would potentially make the test stuck forever if something goes wrong?

[sfat]

I went ahead and created a separate branch on my fork and re-run with different things so I don't clutter this PR, but at the end I only have one problem and that is running against jdk13. (https://travis-ci.org/sfat/snyk-sbt-plugin/builds/570305508)
Seems that sbt is tied to a scala version.
And it seems that it would be needed to upgrade sbt to a version compatible with 2.12.9, which has support for jdk 13 (see: scala/bug#11608)
By default, sbt is tied to a particular scala version, but you can override the scala version like in their documentation https://www.scala-sbt.org/1.x/docs/Howto-Scala.html (disabling autoScalaLibrary).
Do we want to go ahead and upgrade sbt scala dependencies to be compatbile with jdk13 or what would be ideal to do in this case?

[miiila]

@sfat Is there a tool which would allow installation of different sbt version during particular job? Please have a look at https://github.com/snyk/snyk-gradle-plugin/blob/master/.travis.yml#L30

[sfat]

@miiila
I found from this tweet https://twitter.com/not_xuwei_k/status/1161384606924513281 that you can override the scala version for sbt using -Dsbt.scala.version=2.12.9.
Now the problem is some of these jobs are failing because

tderr: java.lang.NoClassDefFoundError: scala/Product$class   at sbt.Inspect$DependencyTreeMode$.<init>(Inspect.scala:13)   at sbt.Inspect$DependencyTreeMode$.<clinit>(Inspect.scala)   at sbt.Inspect$.<init>(Inspect.scala:16)

Not sure if it's a good idea to have all jobs run the same scala version.

I've also looked at changing the different sbt version, but still the latest is 1.2.8 which is bound to 2.12.7 scala version which does not have the fix for jdk13 issue as mentioned in my previous comment.

I also tried using sdkman to change the version, but it doesn't use the version from the commandline, but rather the version that is set in build.properties from each test project.
I saw that sdk list sbt shows there is a newer version, 1.3.0-RC1, which would result in the same issue as sbt 1.2.8

sbt
Copying runtime jar.
Getting org.scala-sbt sbt 1.3.0-RC1  (this may take some time)...
:: retrieving :: org.scala-sbt#boot-app
	confs: [default]
	81 artifacts copied, 0 already retrieved (37332kB/306ms)
Getting Scala 2.12.8 (for sbt)...
:: retrieving :: org.scala-sbt#boot-scala
	confs: [default]
	5 artifacts copied, 0 already retrieved (19768kB/78ms)

Which is not the version that scala fixed the jdk13 issue (2.12.9)
There is also 1.3.0-RC3, but it's still using 2.12.8. This last one is not available in sdkman.

I would say until there is a compatible sbt that comes with scala 2.12.9, we can't do much about jdk13.

The main problem is that you can set whatever version you like in build.sbt (i.e. scalaVersion). That has nothing to do with sbt. sbt comes baked in with it's own scala version for some design decision.

If I go with the sbt.scala.version route, the problem appears with sbt 0.13 projects which are not compatible with 2.12.X scala and it will give me the java.lang.NoClassDefFoundError: scala/Product$class issue.

I think having the version of sbt in each projects let's leverage testing different combination of sbt (0.13 vs 1.2.8) in the different projects.

I'm thinking if it's worth adding support for jdk13 for now until things get better supported in sbt/scala/sdkman?

Maybe if sbt will use the 2.12.9 version, that we could potentially add a new test that will validate that it's working properly, but until then it's seems overkill, IMHO, since the combination of sbt+jdk13 will be a headache to configure their projects in the first place.

What do you think? Would it be an option to ditch jdk13 for now?

[sfat]

regarding the current failing build, it seems it there was a hiccup from maven central repo, as it seems similar to this issue: deanwampler/programming-scala-book-code-examples#8.

[sfat]

Any update on how do you want me to proceed here?

[lili2311]

👋 Don't add java 13 for now, but leave a comment to mention that it is not supported at this moment. Sounds like what we have already is probably the easiest / best solution given what you found so let's keep the projects specifying their own scala version.

So the test matrix is only Node vs Java versions what do you think?

[sfat]

@lili2311 , got it.
Is README.md good place to mention the jdk13 not supported yet?
The current matrix looks okay or you want me to change something?

[sfat]

How does this sound as comment?

---

Compability

snyk-sbt-plugin has been tested against jdks 8-12.

jdk13 is not currently supported (See this comment for more details)

[lili2311]

Readme is great place for it :)

[lili2311]

The matrix looks good to me 👍

[lili2311]

🎉 🎉

[snyksec]

🎉 This PR is included in version 2.7.0 🎉

The release is available on:

• npm package (@latest dist-tag)
• GitHub release

Your semantic-release bot 📦🚀