maven-refactor-dependencies

GitHub Copilot Skill that audits and refactors Maven dependency version management — removing duplicated management and proposing BOM/property usage.

What this skill does

This is a GitHub Copilot Skill. Copilot agents in VS Code discover it via .github/skills/maven-refactor-dependencies/SKILL.md and follow the instructions there.

Instead of grepping pom.xml, it uses OpenRewrite's resolved Maven model plus the effective POM. OpenRewrite already resolves imported BOMs, the parent POM, and the origin of every managed version, so the result is an architectural audit rather than a text search. It reports:

• <version> tags that are redundant because a BOM/parent already manages them,
• repeated literal versions that should become a shared version property,
• unused version properties,
• duplicated version properties (same value, two names),
• intentional BOM overrides (kept, but flagged for review).

It then chains OpenRewrite to clean up the mechanical cases (RemoveRedundantDependencyVersions, RemoveDuplicateDependencies).

Structure

maven-refactor-dependencies/
└── .github/
    └── skills/
        └── maven-refactor-dependencies/
            ├── SKILL.md                              # Instructions the agent reads
            ├── scripts/
            │   └── maven-refactor-dependencies.sh    # Entry point the skill runs
            └── templates/
                └── output-template.md                # Required shape of the report

What a run produces

It is multi-module aware (analyses the whole reactor). Every run writes a self-contained, timestamped directory inside the target project:

maven-refactor-dependencies/<YYYYmmdd-HHMMSS>/
├── report.md             # the audit (data-driven, all modules)
├── effective-pom.xml     # resolved model (BOMs, parent, mgmt, properties)
├── poms/                 # declared pom.xml of every module (pre-cleanup)
├── dependency-tree.txt   # resolved dependency graph
├── rewrite.yml           # the OpenRewrite recipe that was run
├── rewrite-dryrun.log    # OpenRewrite dry-run output
├── rewrite.patch         # applied (or, with --dry-run, proposed) cleanup diff
├── datatables/           # OpenRewrite data tables, if produced
└── rewrite-run.log       # the apply run (absent with --dry-run)

report.md is generated from the captured models with xmllint (XPath, not grep) — pure bash, no Python; the other artifacts are produced regardless.

Running locally

# Report + apply the cleanups (default; mutates pom.xml)
sh ./.github/skills/maven-refactor-dependencies/scripts/maven-refactor-dependencies.sh /path/to/maven-project

# Report only — do not mutate the pom(s)
sh ./.github/skills/maven-refactor-dependencies/scripts/maven-refactor-dependencies.sh /path/to/maven-project --dry-run

Requires mvn and a JDK on PATH (plus xmllint for the rich report.md). The OpenRewrite plugin is invoked directly (org.openrewrite.maven:rewrite-maven-plugin) — no changes to the target project's build are needed. Pin the plugin with --plugin-version for reproducible runs.

Invoking from Copilot

Open Copilot Chat in VS Code and reference the skill by name, or use a trigger phrase such as "audit my Maven dependencies" or "remove versions managed by the BOM".