Skip to content

Commit afae40e

Browse files
hj690hj690
authored
chroe(deps): replace dependencies without license for Airlock onboarding (#14692)
### Summary This PR prepares `google-cloud-java` and `java-cloud-bom` to build and release using only dependencies from the Airlock trusted Maven repository (`maven-3p-trusted`). ### Changes 1. **Bump `com.google.cloud.tools:dependencies` and `dependencies-parent` to `1.5.16` in 7 internal tooling POMs** (`java-cloud-bom/{dashboard,libraries-release-data,release-note-generation,tests,tests/validate-bom}` and `sdk-platform-java/java-shared-dependencies/{dependency-convergence-check,unmanaged-dependency-check}`): - Version `1.5.16` ([GoogleCloudPlatform/cloud-opensource-java#2472](GoogleCloudPlatform/cloud-opensource-java#2472)) replaces `isorelax:isorelax:20030108` with `org.netbeans.external:isorelax:RELEASE310` (MIT license, available in `maven-3p-trusted`) and upgrades `maven-surefire-plugin` to `3.5.4` in `dependencies-parent`. 2. **Move `clirr-maven-plugin` into the `clirr-compatibility-check` profile in `google-auth-library-java/pom.xml`:** - Wraps the `clirr-maven-plugin` binding in a JDK-activated `clirr-compatibility-check` profile matching `java-shared-config`. - Keeps CLIRR enabled by default in CI while allowing release scripts (`-P=-clirr-compatibility-check`) to skip resolving `plexus-components:1.1.4` and `classworlds:1.1-alpha-2`. 3. **Pin `maven-surefire-plugin:3.5.3` in `java-cloud-bom/pom.xml`:** - Replaces unpinned `maven-surefire-plugin:2.17` in the standalone `java-cloud-bom-root` POM so the `java-cloud-bom` release build stops pulling `classworlds:1.1` and `classworlds:1.1-alpha-2`. 4. **Remove `<module>tests/dependency-convergence</module>` from the default `java-cloud-bom/pom.xml` reactor:** - Prevents the `java-cloud-bom` release reactor from resolving every newly published 1P artifact from the same-day release train before Airlock finishes importing them. CI (`.kokoro/dashboard.sh`) runs `dependency-convergence-check` separately. 5. **Bump `libraries-bom` to `26.90.0` in `java-samples/native-image-sample/pom.xml` and `java-spanner/samples/snippets/pom.xml`:** - Replaces older `libraries-bom` imports (`26.80.0` and `26.84.0`) that pull `google-cloud-bom:0.261.0` and `0.265.0` with `26.90.0` (`google-cloud-bom:0.271.0`, available in `maven-3p-trusted`).
1 parent 9ca7e9e commit afae40e

14 files changed

Lines changed: 104 additions & 29 deletions

File tree

‎google-auth-library-java/pom.xml‎

Lines changed: 30 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -398,22 +398,6 @@
398398
</execution>
399399
</executions>
400400
</plugin>
401-
<plugin>
402-
<groupId>org.codehaus.mojo</groupId>
403-
<artifactId>clirr-maven-plugin</artifactId>
404-
<configuration>
405-
<ignoredDifferencesFile>clirr-ignored-differences.xml
406-
</ignoredDifferencesFile>
407-
<logResults>true</logResults>
408-
</configuration>
409-
<executions>
410-
<execution>
411-
<goals>
412-
<goal>check</goal>
413-
</goals>
414-
</execution>
415-
</executions>
416-
</plugin>
417401
<plugin>
418402
<groupId>org.apache.maven.plugins</groupId>
419403
<artifactId>maven-resources-plugin</artifactId>
@@ -437,6 +421,36 @@
437421
</build>
438422

439423
<profiles>
424+
<profile>
425+
<!-- CLIRR in a profile with the same id as java-shared-config, so the release scripts
426+
(-P=-clirr-compatibility-check) do not resolve clirr-maven-plugin 2.8. Its dependency
427+
tree (plexus-components 1.1.4, classworlds 1.1-alpha-2, ...) is not in Airlock
428+
(b/568717591). The JDK activation keeps CLIRR on by default for CI. -->
429+
<id>clirr-compatibility-check</id>
430+
<activation>
431+
<jdk>[1.8,)</jdk>
432+
</activation>
433+
<build>
434+
<plugins>
435+
<plugin>
436+
<groupId>org.codehaus.mojo</groupId>
437+
<artifactId>clirr-maven-plugin</artifactId>
438+
<configuration>
439+
<ignoredDifferencesFile>clirr-ignored-differences.xml
440+
</ignoredDifferencesFile>
441+
<logResults>true</logResults>
442+
</configuration>
443+
<executions>
444+
<execution>
445+
<goals>
446+
<goal>check</goal>
447+
</goals>
448+
</execution>
449+
</executions>
450+
</plugin>
451+
</plugins>
452+
</build>
453+
</profile>
440454
<profile>
441455
<id>slf4j2x-test</id>
442456
<!-- This profile is for logging test only, use instead of the default slf4j2x -->

‎java-cloud-bom/dashboard/pom.xml‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -6,7 +6,7 @@
66
<parent>
77
<groupId>com.google.cloud.tools</groupId>
88
<artifactId>dependencies-parent</artifactId>
9-
<version>1.5.15</version>
9+
<version>1.5.16</version>
1010
<relativePath/>
1111
</parent>
1212
<artifactId>google-cloud-bom-dashboard</artifactId>
@@ -118,7 +118,7 @@
118118
<dependency>
119119
<groupId>com.google.cloud.tools</groupId>
120120
<artifactId>dependencies</artifactId>
121-
<version>1.5.15</version>
121+
<version>1.5.16</version>
122122
</dependency>
123123
<dependency>
124124
<groupId>com.google.code.findbugs</groupId>

‎java-cloud-bom/libraries-release-data/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@
1313
<dependency>
1414
<groupId>com.google.cloud.tools</groupId>
1515
<artifactId>dependencies</artifactId>
16-
<version>1.5.15</version>
16+
<version>1.5.16</version>
1717
<scope>compile</scope>
1818
</dependency>
1919
<dependency>

‎java-cloud-bom/pom.xml‎

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,11 +44,25 @@
4444
<module>release-note-generation</module>
4545
<module>libraries-release-data</module>
4646
<module>tests</module>
47-
<module>tests/dependency-convergence</module>
47+
<!-- tests/dependency-convergence is not in the reactor. It depends on every artifact of the
48+
latest libraries-bom, so a release resolves the whole release train it just published.
49+
Under Airlock-only resolution that fails until Airlock imports every new 1P artifact
50+
(b/568717591). CI runs it on its own: .kokoro/dashboard.sh (dependency-convergence-check). -->
4851
<module>tests/validate-bom</module>
4952
</modules>
5053

5154
<build>
55+
<pluginManagement>
56+
<plugins>
57+
<!-- Pin surefire. Without a pin, Maven uses its default binding (2.17 on Maven 3.9.12), which
58+
pulls classworlds:1.1 and classworlds:1.1-alpha-2. Those are not in Airlock (b/568717591). -->
59+
<plugin>
60+
<groupId>org.apache.maven.plugins</groupId>
61+
<artifactId>maven-surefire-plugin</artifactId>
62+
<version>3.5.3</version>
63+
</plugin>
64+
</plugins>
65+
</pluginManagement>
5266
<plugins>
5367
<plugin>
5468
<!-- This root pom.xml is not referenced by the BOMs and no need to

‎java-cloud-bom/release-note-generation/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -25,7 +25,7 @@
2525
<dependency>
2626
<groupId>com.google.cloud.tools</groupId>
2727
<artifactId>dependencies</artifactId>
28-
<version>1.5.15</version>
28+
<version>1.5.16</version>
2929
</dependency>
3030
<dependency>
3131
<groupId>junit</groupId>

‎java-cloud-bom/tests/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -54,7 +54,7 @@
5454
<dependency>
5555
<groupId>com.google.cloud.tools</groupId>
5656
<artifactId>dependencies</artifactId>
57-
<version>1.5.15</version>
57+
<version>1.5.16</version>
5858
<scope>test</scope>
5959
</dependency>
6060
<dependency>

‎java-cloud-bom/tests/validate-bom/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -58,7 +58,7 @@
5858
<dependency>
5959
<groupId>com.google.cloud.tools</groupId>
6060
<artifactId>dependencies</artifactId>
61-
<version>1.5.15</version>
61+
<version>1.5.16</version>
6262
</dependency>
6363
<dependency>
6464
<groupId>org.apache.maven.resolver</groupId>

‎java-samples/native-image-sample/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -18,7 +18,7 @@
1818
<dependency>
1919
<groupId>com.google.cloud</groupId>
2020
<artifactId>libraries-bom</artifactId>
21-
<version>26.86.0</version>
21+
<version>26.90.0</version>
2222
<type>pom</type>
2323
<scope>import</scope>
2424
</dependency>

‎java-spanner/samples/snippets/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,7 +34,7 @@
3434
<dependency>
3535
<groupId>com.google.cloud</groupId>
3636
<artifactId>libraries-bom</artifactId>
37-
<version>26.80.0</version>
37+
<version>26.90.0</version>
3838
<type>pom</type>
3939
<scope>import</scope>
4040
</dependency>

‎sdk-platform-java/java-shared-dependencies/dependency-convergence-check/pom.xml‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -37,7 +37,7 @@
3737
<dependency>
3838
<groupId>com.google.cloud.tools</groupId>
3939
<artifactId>dependencies</artifactId>
40-
<version>1.5.13</version>
40+
<version>1.5.16</version>
4141
<scope>test</scope>
4242
</dependency>
4343
<dependency>

0 commit comments

Comments
 (0)