Repository navigation
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request configures the CLIRR plugin within a profile in the Google Auth Library, replaces the unlicensed isorelax dependency with org.netbeans.external:isorelax across several POM files, pins the maven-surefire-plugin to version 3.5.3, and updates the libraries-bom version in samples. Feedback suggests also pinning the maven-failsafe-plugin to the same version (3.5.3) in both the root and dashboard POMs to avoid potential classpath or test runner conflicts.
org.netbeans.external:isorelax replaces isorelax:isorelax as a runtime dependency of com.google.cloud.tools:dependencies. No code in the java-cloud-bom tooling modules uses it directly, so .kokoro/dependencies.sh (dependency:analyze -DfailOnWarning=true) reports it as an unused declared dependency. Add it to ignoredUnusedDeclaredDependencies in the 5 analyzed modules.
hj690
added
the
kokoro:force-run
yoshi-kokoro
removed
the
kokoro:force-run
hj690
changed the title
| <groupId>com.google.cloud.tools</groupId> | ||
| <artifactId>dependencies</artifactId> | ||
| <version>1.5.15</version> | ||
| <!-- isorelax:isorelax:20030108 has no license metadata (b/568717591). Use the |
There was a problem hiding this comment.
com.google.cloud.tools:dependencies is from https://github.com/GoogleCloudPlatform/cloud-opensource-java/blob/master/dependencies/pom.xml which is also owned by us. Can we update isorelax there, make a new release and then update the version here? So that we don't have to exclude it in multiple different places?
There was a problem hiding this comment.
Thank you for the suggestion, I'll make a release and update here.
| </modules> | ||
|
|
||
| <build> | ||
| <pluginManagement> |
There was a problem hiding this comment.
java-shared-config already contains maven-surefire-plugin v3.5.2. It is the parent for pretty much all other modules, can we make java-cloud-pom extend from java-shared-config as well? So we have only one place for the plugin version.
There was a problem hiding this comment.
Good point, adding the parent makes sense.
One thing my agent found makes me hesitate, though: if we extend from google-cloud-shared-config, we also inherit its parent native-image-shared-config, whose release-sonatype profile is active by default and adds nexus-staging-maven-plugin to build/plugins. That contradicts the comment here: https://github.com/googleapis/google-cloud-java/blob/main/java-cloud-bom/pom.xml#L64
I think there are ways to fix this (for example, override the plugin at the root, or pass -P=-release-sonatype in the java-cloud-bom release command), so I wanted to check if that's expected before I make the change.
This branch has not been deployed
3 participants
Summary
This PR prepares
google-cloud-javaandjava-cloud-bomto build and release using only dependencies from the Airlock trusted Maven repository (maven-3p-trusted).Changes
isorelax:isorelax:20030108withorg.netbeans.external:isorelax:RELEASE310in 7 internal tooling POMs (java-cloud-bom/{dashboard,libraries-release-data,release-note-generation,tests,tests/validate-bom}andsdk-platform-java/java-shared-dependencies/{dependency-convergence-check,unmanaged-dependency-check}):isorelax:isorelax:20030108(transitively pulled bycom.google.cloud.tools:dependencies) has no license metadata in its POM or source repository.isorelax:isorelaxand replaces it withorg.netbeans.external:isorelax:RELEASE310(MIT license, identicalorg.iso_relaxJARV API, available inmaven-3p-trusted).clirr-maven-plugininto theclirr-compatibility-checkprofile ingoogle-auth-library-java/pom.xml:clirr-maven-pluginbinding in a JDK-activatedclirr-compatibility-checkprofile matchingjava-shared-config.-P=-clirr-compatibility-check) to skip resolvingplexus-components:1.1.4andclassworlds:1.1-alpha-2.maven-surefire-plugin:3.5.3injava-cloud-bom/pom.xmlandjava-cloud-bom/dashboard/pom.xml:maven-surefire-plugin:2.17and inherited2.22.2so thejava-cloud-bomrelease build stops pullingclassworlds:1.1,classworlds:1.1-alpha-2, andslf4j-api:1.5.6.<module>tests/dependency-convergence</module>from the defaultjava-cloud-bom/pom.xmlreactor:java-cloud-bomrelease reactor from resolving every newly published 1P artifact from the same-day release train before Airlock finishes importing them. CI (.kokoro/dashboard.sh) runsdependency-convergence-checkseparately.libraries-bomto26.90.0injava-samples/native-image-sample/pom.xmlandjava-spanner/samples/snippets/pom.xml:libraries-bomimports (26.80.0and26.84.0) that pullgoogle-cloud-bom:0.261.0and0.265.0with26.90.0(google-cloud-bom:0.271.0, available inmaven-3p-trusted).