gnodet-bot commented on code in PR #26330: URL: https://github.com/apache/camel/pull/26330#discussion_r4060210349
########## .github/workflows/dep-check.yml: ########## @@ -0,0 +1,88 @@ +# +# Licensed to the Apache Software Foundation (ASF) under one or more +# contributor license agreements. See the NOTICE file distributed with +# this work for additional information regarding copyright ownership. +# The ASF licenses this file to You under the Apache License, Version 2.0 +# (the "License"); you may not use this file except in compliance with +# the License. You may obtain a copy of the License at +# +# http://www.apache.org/licenses/LICENSE-2.0 +# +# Unless required by applicable law or agreed to in writing, software +# distributed under the License is distributed on an "AS IS" BASIS, +# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +# See the License for the specific language governing permissions and +# limitations under the License. +# + +name: 'Dependency Analysis' + +on: + pull_request: + branches: + - main + paths-ignore: + - .claude-plugin/** + - .idea/** + - .github/** + - .oss-ai-helper-rules/** + - AGENTS.md + - README.md + - SECURITY.md + - Jenkinsfile + - Jenkinsfile.* + - NOTICE.txt + +concurrency: + group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }} + cancel-in-progress: true + +permissions: + contents: read + +jobs: + dep-check: + if: github.repository == 'apache/camel' + name: Dependency Analysis (non-blocking) + runs-on: ubuntu-latest + continue-on-error: true + steps: + - name: Checkout + uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 + with: + ref: ${{ github.event.pull_request.head.sha }} + fetch-depth: 1 + + - name: Set up JDK 21 + uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 + with: + distribution: 'temurin' + java-version: '21' + cache: 'maven' + + - name: Compile (test-compile for accurate test-scope analysis) + run: | + # camel-spring-xml is excluded: it unpacks SNAPSHOT source JARs (camel-api:sources, etc.) + # during process-resources, which are not available in a clean CI checkout without a + # prior mvn install. The XSD it generates is pre-committed, so skipping it here is safe. + # camel-test-spring-junit6 is excluded: it has a compile dependency on camel-spring-xml, + # which is not available in a clean checkout without a prior mvn install. + mvn test-compile -Pdep-check -Dlicense.skip -Dquickly \ + --pl '!components/camel-spring-parent/camel-spring-xml,!components/camel-test/camel-test-spring-junit6' \ + --no-transfer-progress --batch-mode -q + + - name: Run dependency analysis + run: | + mvn eu.maveniverse.maven.plugins:pilot-plugin:0.4.0:dependencies \ + -Pdep-check -Dlicense.skip \ Review Comment: 💡 **Nit — version hardcoded in three places:** `pilot-plugin:0.4.0` appears here in the workflow, in `pom.xml` `<pluginManagement>`, and in the `building.adoc` examples. When pilot releases a new version, all three need updating independently — the pluginManagement version does not propagate to this command because the fully-qualified form (`groupId:artifactId:version:goal`) bypasses pluginManagement resolution. Consider extracting to a root-pom property: ```suggestion mvn eu.maveniverse.maven.plugins:pilot-plugin:${pilot.version}:dependencies \ ``` with `<pilot.version>0.4.0</pilot.version>` in the root `pom.xml` properties — then the workflow could reference it via `-Dpilot.version` or use the profile-driven short form `pilot:dependencies` if a `<pluginGroups>` entry is added to the project's CI settings. Alternatively, accept the duplication as-is and add a comment pointing to the two sibling locations. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
