This is an automated email from the ASF dual-hosted git repository. pkarwasz pushed a commit to branch feat/setup-mimir in repository https://gitbox.apache.org/repos/asf/logging-parent.git
commit 190f2e19bb5ab8ca8000aa6214c1c285f4691731 Author: Piotr P. Karwasz <[email protected]> AuthorDate: Mon May 19 16:20:04 2025 +0200 Replace Maven Cache with Mimír This pull request replaces the use of the Maven local repository cache with [Mimír](https://maveniverse.eu/docs/mimir/), a specialized, immutable cache for remote Maven repositories. ### Description The Maven local repository serves multiple purposes: - Mirrors immutable releases from Maven Central - Caches snapshot artifacts - Acts as a local staging area for builds Because of these overlapping responsibilities, the local repository often becomes polluted with temporary artifacts, making it unreliable for consistent, reproducible builds. Additionally, it is not safe to share across workflows. One major issue caused by sharing the local Maven repository is the occurrence of false negatives in the `verify-reproducibility-reusable` check (see #388). ### Benefits of Using Mimír Mimír provides a cleaner and more reliable caching approach: - **Immutable by design**: Only caches artifacts from remote Maven repositories, which do not change. - **Workflow-friendly**: Enables a single shared cache across workflows without risk of contamination from snapshots or local artifacts. This change improves build reproducibility, reduces cache-related issues, and simplifies cache management. --- .github/workflows/build-reusable.yaml | 30 +++++++++++++++++++++- .github/workflows/codeql-analysis-reusable.yaml | 30 +++++++++++++++++++++- .github/workflows/deploy-release-reusable.yaml | 30 +++++++++++++++++++++- .github/workflows/deploy-site-reusable.yaml | 30 +++++++++++++++++++++- .github/workflows/deploy-snapshot-reusable.yaml | 30 +++++++++++++++++++++- .github/workflows/merge-dependabot-reusable.yaml | 30 +++++++++++++++++++++- .../workflows/verify-reproducibility-reusable.yaml | 30 +++++++++++++++++++++- .gitignore | 1 + pom.xml | 17 ++++++++++++ 9 files changed, 221 insertions(+), 7 deletions(-) diff --git a/.github/workflows/build-reusable.yaml b/.github/workflows/build-reusable.yaml index cc42178..b9a138b 100644 --- a/.github/workflows/build-reusable.yaml +++ b/.github/workflows/build-reusable.yaml @@ -89,7 +89,35 @@ jobs: with: distribution: zulu java-version: ${{ inputs.java-version }} - cache: maven + + # + # Sets up Mimír (https://maveniverse.eu/docs/mimir/) to cache artifacts from remote repositories + # + # Unlike the local Maven repository, Mimír cannot be used to stage locally generated artifacts or snapshots. + # Therefore, it can be reused between builds, even on different architectures. + # Since the size of the cache increases in time, as we download new dependency versions, we reset the cache + # once a month. + # + # WARNING: Currently it is not possible to reuse GitHub workflow steps, therefore, these two steps must be + # copied to multiple workflows. + # All copies should be synchronized with the original: build-reusable.yaml + # + - name: Set up Mimír configuration + shell: bash + run: | + # Compute the key cache + echo MIMIR_KEY="mimir-cache-$(date +'%Y-%m')" >> $GITHUB_ENV + # Mimir currently does not support relative paths, so we need to compute the absolute path of `mimir`. + echo MAVEN_OPTS="-Dmimir.daemon.passOnBasedir=true -Dmimir.basedir=$GITHUB_WORKSPACE/.mimir" >> $GITHUB_ENV + + - name: Set up Mimír cache + uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # 4.2.3 + with: + # Mimir contains an exact copy of part of Maven Central. + # Therefore, we only need to clean it from time to time to remove old versions. + key: ${{ env.MIMIR_KEY }} + path: .mimir/local + enableCrossOsArchive: true - name: Set up Develocity if: inputs.develocity-enabled diff --git a/.github/workflows/codeql-analysis-reusable.yaml b/.github/workflows/codeql-analysis-reusable.yaml index 2317b25..c58dc49 100644 --- a/.github/workflows/codeql-analysis-reusable.yaml +++ b/.github/workflows/codeql-analysis-reusable.yaml @@ -53,7 +53,35 @@ jobs: with: distribution: zulu java-version: ${{ inputs.java-version }} - cache: maven + + # + # Sets up Mimír (https://maveniverse.eu/docs/mimir/) to cache artifacts from remote repositories + # + # Unlike the local Maven repository, Mimír cannot be used to stage locally generated artifacts or snapshots. + # Therefore, it can be reused between builds, even on different architectures. + # Since the size of the cache increases in time, as we download new dependency versions, we reset the cache + # once a month. + # + # WARNING: Currently it is not possible to reuse GitHub workflow steps, therefore, these two steps must be + # copied to multiple workflows. + # All copies should be synchronized with the original: build-reusable.yaml + # + - name: Set up Mimír configuration + shell: bash + run: | + # Compute the key cache + echo MIMIR_KEY="mimir-cache-$(date +'%Y-%m')" >> $GITHUB_ENV + # Mimir currently does not support relative paths, so we need to compute the absolute path of `mimir`. + echo MAVEN_OPTS="-Dmimir.daemon.passOnBasedir=true -Dmimir.basedir=$GITHUB_WORKSPACE/.mimir" >> $GITHUB_ENV + + - name: Set up Mimír cache + uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # 4.2.3 + with: + # Mimir contains an exact copy of part of Maven Central. + # Therefore, we only need to clean it from time to time to remove old versions. + key: ${{ env.MIMIR_KEY }} + path: .mimir/local + enableCrossOsArchive: true - name: Build with Maven shell: bash diff --git a/.github/workflows/deploy-release-reusable.yaml b/.github/workflows/deploy-release-reusable.yaml index 98215e9..c677821 100644 --- a/.github/workflows/deploy-release-reusable.yaml +++ b/.github/workflows/deploy-release-reusable.yaml @@ -68,12 +68,40 @@ jobs: with: distribution: zulu java-version: ${{ inputs.java-version }} - cache: maven server-id: apache.releases.https server-username: NEXUS_USERNAME server-password: NEXUS_PASSWORD gpg-private-key: ${{ secrets.GPG_SECRET_KEY }} + # + # Sets up Mimír (https://maveniverse.eu/docs/mimir/) to cache artifacts from remote repositories + # + # Unlike the local Maven repository, Mimír cannot be used to stage locally generated artifacts or snapshots. + # Therefore, it can be reused between builds, even on different architectures. + # Since the size of the cache increases in time, as we download new dependency versions, we reset the cache + # once a month. + # + # WARNING: Currently it is not possible to reuse GitHub workflow steps, therefore, these two steps must be + # copied to multiple workflows. + # All copies should be synchronized with the original: build-reusable.yaml + # + - name: Set up Mimír configuration + shell: bash + run: | + # Compute the key cache + echo MIMIR_KEY="mimir-cache-$(date +'%Y-%m')" >> $GITHUB_ENV + # Mimir currently does not support relative paths, so we need to compute the absolute path of `mimir`. + echo MAVEN_OPTS="-Dmimir.daemon.passOnBasedir=true -Dmimir.basedir=$GITHUB_WORKSPACE/.mimir" >> $GITHUB_ENV + + - name: Set up Mimír cache + uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # 4.2.3 + with: + # Mimir contains an exact copy of part of Maven Central. + # Therefore, we only need to clean it from time to time to remove old versions. + key: ${{ env.MIMIR_KEY }} + path: .mimir/local + enableCrossOsArchive: true + - name: Set up Git user shell: bash run: | diff --git a/.github/workflows/deploy-site-reusable.yaml b/.github/workflows/deploy-site-reusable.yaml index 2464864..6a727ab 100644 --- a/.github/workflows/deploy-site-reusable.yaml +++ b/.github/workflows/deploy-site-reusable.yaml @@ -61,9 +61,37 @@ jobs: with: distribution: zulu java-version: ${{ inputs.java-version }} - cache: maven gpg-private-key: ${{ secrets.GPG_SECRET_KEY }} + # + # Sets up Mimír (https://maveniverse.eu/docs/mimir/) to cache artifacts from remote repositories + # + # Unlike the local Maven repository, Mimír cannot be used to stage locally generated artifacts or snapshots. + # Therefore, it can be reused between builds, even on different architectures. + # Since the size of the cache increases in time, as we download new dependency versions, we reset the cache + # once a month. + # + # WARNING: Currently it is not possible to reuse GitHub workflow steps, therefore, these two steps must be + # copied to multiple workflows. + # All copies should be synchronized with the original: build-reusable.yaml + # + - name: Set up Mimír configuration + shell: bash + run: | + # Compute the key cache + echo MIMIR_KEY="mimir-cache-$(date +'%Y-%m')" >> $GITHUB_ENV + # Mimir currently does not support relative paths, so we need to compute the absolute path of `mimir`. + echo MAVEN_OPTS="-Dmimir.daemon.passOnBasedir=true -Dmimir.basedir=$GITHUB_WORKSPACE/.mimir" >> $GITHUB_ENV + + - name: Set up Mimír cache + uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # 4.2.3 + with: + # Mimir contains an exact copy of part of Maven Central. + # Therefore, we only need to clean it from time to time to remove old versions. + key: ${{ env.MIMIR_KEY }} + path: .mimir/local + enableCrossOsArchive: true + - name: Build the project shell: bash if: inputs.install-required diff --git a/.github/workflows/deploy-snapshot-reusable.yaml b/.github/workflows/deploy-snapshot-reusable.yaml index c1b1c3d..c9dfafb 100644 --- a/.github/workflows/deploy-snapshot-reusable.yaml +++ b/.github/workflows/deploy-snapshot-reusable.yaml @@ -51,11 +51,39 @@ jobs: with: distribution: zulu java-version: ${{ inputs.java-version }} - cache: maven server-id: apache.snapshots.https server-username: NEXUS_USERNAME server-password: NEXUS_PASSWORD + # + # Sets up Mimír (https://maveniverse.eu/docs/mimir/) to cache artifacts from remote repositories + # + # Unlike the local Maven repository, Mimír cannot be used to stage locally generated artifacts or snapshots. + # Therefore, it can be reused between builds, even on different architectures. + # Since the size of the cache increases in time, as we download new dependency versions, we reset the cache + # once a month. + # + # WARNING: Currently it is not possible to reuse GitHub workflow steps, therefore, these two steps must be + # copied to multiple workflows. + # All copies should be synchronized with the original: build-reusable.yaml + # + - name: Set up Mimír configuration + shell: bash + run: | + # Compute the key cache + echo MIMIR_KEY="mimir-cache-$(date +'%Y-%m')" >> $GITHUB_ENV + # Mimir currently does not support relative paths, so we need to compute the absolute path of `mimir`. + echo MAVEN_OPTS="-Dmimir.daemon.passOnBasedir=true -Dmimir.basedir=$GITHUB_WORKSPACE/.mimir" >> $GITHUB_ENV + + - name: Set up Mimír cache + uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # 4.2.3 + with: + # Mimir contains an exact copy of part of Maven Central. + # Therefore, we only need to clean it from time to time to remove old versions. + key: ${{ env.MIMIR_KEY }} + path: .mimir/local + enableCrossOsArchive: true + - name: Export version id: version shell: bash diff --git a/.github/workflows/merge-dependabot-reusable.yaml b/.github/workflows/merge-dependabot-reusable.yaml index 7bf058a..92ce31d 100644 --- a/.github/workflows/merge-dependabot-reusable.yaml +++ b/.github/workflows/merge-dependabot-reusable.yaml @@ -78,12 +78,40 @@ jobs: with: distribution: zulu java-version: ${{ inputs.java-version }} - cache: maven server-id: apache.releases.https server-username: NEXUS_USERNAME server-password: NEXUS_PASSWORD gpg-private-key: ${{ secrets.GPG_SECRET_KEY }} + # + # Sets up Mimír (https://maveniverse.eu/docs/mimir/) to cache artifacts from remote repositories + # + # Unlike the local Maven repository, Mimír cannot be used to stage locally generated artifacts or snapshots. + # Therefore, it can be reused between builds, even on different architectures. + # Since the size of the cache increases in time, as we download new dependency versions, we reset the cache + # once a month. + # + # WARNING: Currently it is not possible to reuse GitHub workflow steps, therefore, these two steps must be + # copied to multiple workflows. + # All copies should be synchronized with the original: build-reusable.yaml + # + - name: Set up Mimír configuration + shell: bash + run: | + # Compute the key cache + echo MIMIR_KEY="mimir-cache-$(date +'%Y-%m')" >> $GITHUB_ENV + # Mimir currently does not support relative paths, so we need to compute the absolute path of `mimir`. + echo MAVEN_OPTS="-Dmimir.daemon.passOnBasedir=true -Dmimir.basedir=$GITHUB_WORKSPACE/.mimir" >> $GITHUB_ENV + + - name: Set up Mimír cache + uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # 4.2.3 + with: + # Mimir contains an exact copy of part of Maven Central. + # Therefore, we only need to clean it from time to time to remove old versions. + key: ${{ env.MIMIR_KEY }} + path: .mimir/local + enableCrossOsArchive: true + - name: Find the release version major shell: bash run: | diff --git a/.github/workflows/verify-reproducibility-reusable.yaml b/.github/workflows/verify-reproducibility-reusable.yaml index 33a4013..59cfb3f 100644 --- a/.github/workflows/verify-reproducibility-reusable.yaml +++ b/.github/workflows/verify-reproducibility-reusable.yaml @@ -61,7 +61,35 @@ jobs: with: distribution: zulu java-version: ${{ inputs.java-version }} - cache: maven + + # + # Sets up Mimír (https://maveniverse.eu/docs/mimir/) to cache artifacts from remote repositories + # + # Unlike the local Maven repository, Mimír cannot be used to stage locally generated artifacts or snapshots. + # Therefore, it can be reused between builds, even on different architectures. + # Since the size of the cache increases in time, as we download new dependency versions, we reset the cache + # once a month. + # + # WARNING: Currently it is not possible to reuse GitHub workflow steps, therefore, these two steps must be + # copied to multiple workflows. + # All copies should be synchronized with the original: build-reusable.yaml + # + - name: Set up Mimír configuration + shell: bash + run: | + # Compute the key cache + echo MIMIR_KEY="mimir-cache-$(date +'%Y-%m')" >> $GITHUB_ENV + # Mimir currently does not support relative paths, so we need to compute the absolute path of `mimir`. + echo MAVEN_OPTS="-Dmimir.daemon.passOnBasedir=true -Dmimir.basedir=$GITHUB_WORKSPACE/.mimir" >> $GITHUB_ENV + + - name: Set up Mimír cache + uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # 4.2.3 + with: + # Mimir contains an exact copy of part of Maven Central. + # Therefore, we only need to clean it from time to time to remove old versions. + key: ${{ env.MIMIR_KEY }} + path: .mimir/local + enableCrossOsArchive: true # `clean verify artifact:compare` is required to generate the build reproducibility report. # For details, see: https://maven.apache.org/guides/mini/guide-reproducible-builds.html#how-to-test-my-maven-build-reproducibility diff --git a/.gitignore b/.gitignore index 712b37b..b08e3ee 100644 --- a/.gitignore +++ b/.gitignore @@ -16,6 +16,7 @@ # Maven target/ .flattened-pom.xml +/.mimir/ /.mvn/extensions.xml /.mvn/wrapper/maven-wrapper.jar # IDEA diff --git a/pom.xml b/pom.xml index f8036c7..ab71e7d 100644 --- a/pom.xml +++ b/pom.xml @@ -227,6 +227,7 @@ <jacoco-maven-plugin.version>0.8.13</jacoco-maven-plugin.version> <log4j-changelog-maven-plugin.version>0.9.0</log4j-changelog-maven-plugin.version> <maven-artifact-plugin.version>3.6.0</maven-artifact-plugin.version> + <mimir.version>0.7.4</mimir.version> <restrict-imports-enforcer-rule.version>2.6.1</restrict-imports-enforcer-rule.version> <spotbugs-maven-plugin.version>4.9.3.0</spotbugs-maven-plugin.version> <spotless-maven-plugin.version>2.44.4</spotless-maven-plugin.version> @@ -362,6 +363,12 @@ <version>${maven-artifact-plugin.version}</version> </plugin> + <plugin> + <groupId>eu.maveniverse.maven.mimir</groupId> + <artifactId>extension</artifactId> + <version>${mimir.version}</version> + </plugin> + <plugin> <groupId>com.github.spotbugs</groupId> <artifactId>spotbugs-maven-plugin</artifactId> @@ -956,6 +963,16 @@ </executions> </plugin> + <!-- + ~ Use Mimir as Maven cache: + ~ See: https://maveniverse.eu/docs/mimir/ + --> + <plugin> + <groupId>eu.maveniverse.maven.mimir</groupId> + <artifactId>extension</artifactId> + <extensions>true</extensions> + </plugin> + </plugins> </build>
