[MNG-8312] Generate the BOM automatically (#1797)

Generate both skinny and fat BOMs BOM automatically
Add support for import a BOM w/ classifier in Model 4.1.0+
---------

Co-authored-by: Tamas Cservenak <tamas@cservenak.net>
This commit is contained in:
Guillaume Nodet 2024-10-17 17:07:55 +02:00 committed by GitHub
parent 989f798c9f
commit d5c8280658
No known key found for this signature in database
GPG Key ID: B5690EEEBB952194
4 changed files with 53 additions and 213 deletions

View File

@ -220,6 +220,46 @@ under the License.
</execution>
</executions>
</plugin>
<plugin>
<groupId>eu.maveniverse.maven.plugins</groupId>
<artifactId>bom-builder3</artifactId>
<version>1.0.1</version>
<executions>
<execution>
<id>skinny-bom</id>
<goals>
<goal>build-bom</goal>
</goals>
<configuration>
<bomGroupId>org.apache.maven</bomGroupId>
<bomArtifactId>maven-bom</bomArtifactId>
<bomVersion>${project.version}</bomVersion>
<bomClassifier>skinny</bomClassifier>
<bomName>Maven Dependencies Skinny BOM</bomName>
<bomDescription>Bill Of Materials for Apache Maven - Maven JARS only</bomDescription>
<outputFilename>maven-skinny-bom.xml</outputFilename>
<attach>true</attach>
</configuration>
</execution>
<execution>
<id>fat-bom</id>
<goals>
<goal>build-bom</goal>
</goals>
<configuration>
<bomGroupId>org.apache.maven</bomGroupId>
<bomArtifactId>maven-bom</bomArtifactId>
<bomVersion>${project.version}</bomVersion>
<bomClassifier>fat</bomClassifier>
<bomName>Maven Dependencies Fat BOM</bomName>
<bomDescription>Bill Of Materials for Apache Maven - All dependencies</bomDescription>
<outputFilename>maven-fat-bom.xml</outputFilename>
<useDependencies>true</useDependencies>
<attach>true</attach>
</configuration>
</execution>
</executions>
</plugin>
</plugins>
</build>

View File

@ -471,7 +471,13 @@ public class DefaultModelValidator implements ModelValidator {
}
validate20RawDependencies(
problems, m.getDependencies(), "dependencies.dependency.", EMPTY, validationLevel, request);
problems,
m.getDependencies(),
"dependencies.dependency.",
EMPTY,
isModelVersion41OrMore,
validationLevel,
request);
validate20RawDependenciesSelfReferencing(
problems, m, m.getDependencies(), "dependencies.dependency", request);
@ -482,6 +488,7 @@ public class DefaultModelValidator implements ModelValidator {
m.getDependencyManagement().getDependencies(),
"dependencyManagement.dependencies.dependency.",
EMPTY,
isModelVersion41OrMore,
validationLevel,
request);
}
@ -539,6 +546,7 @@ public class DefaultModelValidator implements ModelValidator {
profile.getDependencies(),
prefix,
"dependencies.dependency.",
isModelVersion41OrMore,
validationLevel,
request);
@ -548,6 +556,7 @@ public class DefaultModelValidator implements ModelValidator {
profile.getDependencyManagement().getDependencies(),
prefix,
"dependencyManagement.dependencies.dependency.",
isModelVersion41OrMore,
validationLevel,
request);
}
@ -982,6 +991,7 @@ public class DefaultModelValidator implements ModelValidator {
List<Dependency> dependencies,
String prefix,
String prefix2,
boolean is41OrBeyond,
int validationLevel,
ModelBuilderRequest request) {
Severity errOn30 = getSeverity(validationLevel, ModelValidator.VALIDATION_LEVEL_MAVEN_3_0);
@ -1002,7 +1012,8 @@ public class DefaultModelValidator implements ModelValidator {
key,
"must be 'pom' to import the managed dependencies.",
dependency);
} else if (dependency.getClassifier() != null
} else if (!is41OrBeyond
&& dependency.getClassifier() != null
&& !dependency.getClassifier().isEmpty()) {
addViolation(
problems,

View File

@ -1,209 +0,0 @@
<?xml version="1.0" encoding="UTF-8"?>
<!--
Licensed to the Apache Software Foundation (ASF) under one
or more contributor license agreements. See the NOTICE file
distributed with this work for additional information
regarding copyright ownership. The ASF licenses this file
to you under the Apache License, Version 2.0 (the
"License"); you may not use this file except in compliance
with the License. You may obtain a copy of the License at
http://www.apache.org/licenses/LICENSE-2.0
Unless required by applicable law or agreed to in writing,
software distributed under the License is distributed on an
"AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
KIND, either express or implied. See the License for the
specific language governing permissions and limitations
under the License.
-->
<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>
<parent>
<groupId>org.apache</groupId>
<artifactId>apache</artifactId>
<version>33</version>
<relativePath />
</parent>
<groupId>org.apache.maven</groupId>
<artifactId>maven-bom</artifactId>
<version>4.0.0-beta-5-SNAPSHOT</version>
<packaging>pom</packaging>
<name>Maven Dependencies BOM</name>
<description>Bill Of Materials for Apache Maven dependencies</description>
<url>https://maven.apache.org/ref/${project.version}/${project.artifactId}</url>
<scm>
<connection>scm:git:https://gitbox.apache.org/repos/asf/maven.git</connection>
<developerConnection>scm:git:https://gitbox.apache.org/repos/asf/maven.git</developerConnection>
<tag>maven-4.0.0-beta-3</tag>
<url>https://github.com/apache/maven/tree/${project.scm.tag}/${project.artifactId}</url>
</scm>
<issueManagement>
<system>jira</system>
<url>https://issues.apache.org/jira/browse/MNG</url>
</issueManagement>
<ciManagement>
<system>Jenkins</system>
<url>https://ci-maven.apache.org/job/Maven/job/maven-box/job/maven/</url>
</ciManagement>
<distributionManagement>
<site>
<id>apache.website</id>
<url>scm:svn:https://svn.apache.org/repos/asf/maven/website/components/${maven.site.path}</url>
</site>
<downloadUrl>https://maven.apache.org/download.html</downloadUrl>
</distributionManagement>
<properties>
<maven.site.path>ref/4-LATEST/${project.artifactId}</maven.site.path>
</properties>
<dependencyManagement>
<!-- Not included:
- apache-maven, as it delivers the binaries
- maven-compat, only used by apache-maven distributions to support older releases
- maven-slf4j-provider, only used by apache-maven distributions
- maven-wrapper, only used by apache-maven-wrapper distributions -->
<dependencies>
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-artifact</artifactId>
<version>${project.version}</version>
</dependency>
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-builder-support</artifactId>
<version>${project.version}</version>
</dependency>
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-core</artifactId>
<version>${project.version}</version>
</dependency>
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-embedder</artifactId>
<version>${project.version}</version>
</dependency>
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-model</artifactId>
<version>${project.version}</version>
</dependency>
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-api-core</artifactId>
<version>${project.version}</version>
</dependency>
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-api-meta</artifactId>
<version>${project.version}</version>
</dependency>
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-api-model</artifactId>
<version>${project.version}</version>
</dependency>
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-api-settings</artifactId>
<version>${project.version}</version>
</dependency>
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-api-spi</artifactId>
<version>${project.version}</version>
</dependency>
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-api-toolchain</artifactId>
<version>${project.version}</version>
</dependency>
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-api-plugin</artifactId>
<version>${project.version}</version>
</dependency>
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-api-xml</artifactId>
<version>${project.version}</version>
</dependency>
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-model-builder</artifactId>
<version>${project.version}</version>
</dependency>
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-plugin-api</artifactId>
<version>${project.version}</version>
</dependency>
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-repository-metadata</artifactId>
<version>${project.version}</version>
</dependency>
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-resolver-provider</artifactId>
<version>${project.version}</version>
</dependency>
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-settings</artifactId>
<version>${project.version}</version>
</dependency>
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-settings-builder</artifactId>
<version>${project.version}</version>
</dependency>
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-toolchain-model</artifactId>
<version>${project.version}</version>
</dependency>
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-toolchain-builder</artifactId>
<version>${project.version}</version>
</dependency>
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-logging</artifactId>
<version>${project.version}</version>
</dependency>
<dependency>
<groupId>org.apache.maven</groupId>
<artifactId>maven-xml-impl</artifactId>
<version>${project.version}</version>
</dependency>
</dependencies>
</dependencyManagement>
<build>
<plugins>
<plugin>
<artifactId>maven-site-plugin</artifactId>
<configuration>
<topSiteURL>${project.distributionManagement.site.url}/..</topSiteURL>
</configuration>
</plugin>
<plugin>
<groupId>org.apache.rat</groupId>
<artifactId>apache-rat-plugin</artifactId>
<executions>
<execution>
<id>rat-check</id>
<phase>none</phase>
</execution>
</executions>
</plugin>
</plugins>
</build>
</project>

View File

@ -23,7 +23,6 @@ under the License.
<parent>
<groupId>org.apache.maven</groupId>
<artifactId>maven-parent</artifactId>
<!-- when upgrading parent, also upgrade maven-bom's parent -->
<version>43</version>
<relativePath />
</parent>
@ -122,7 +121,6 @@ under the License.
<module>apache-maven</module>
<module>maven-toolchain-model</module>
<module>maven-toolchain-builder</module>
<module>maven-bom</module>
<module>maven-docgen</module>
</modules>