gnodet-bot commented on code in PR #13094: URL: https://github.com/apache/maven/pull/13094#discussion_r4009761131
########## impl/maven-core/src/main/java/org/apache/maven/resolver/SpiWorkspaceReaderAdapter.java: ########## @@ -0,0 +1,188 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.maven.resolver; + +import java.io.File; +import java.nio.file.Path; +import java.util.List; +import java.util.Optional; + +import org.apache.maven.api.ArtifactCoordinates; +import org.apache.maven.api.Version; +import org.apache.maven.api.annotations.Nonnull; +import org.eclipse.aether.artifact.Artifact; +import org.eclipse.aether.repository.WorkspaceReader; +import org.eclipse.aether.repository.WorkspaceRepository; + +/** + * Bridge adapter that wraps an {@link org.apache.maven.api.spi.WorkspaceReader SPI WorkspaceReader} + * into a resolver {@link WorkspaceReader}. + * + * <p>This adapter translates between resolver {@link Artifact} and Maven API + * {@link org.apache.maven.api.Artifact} types, allowing SPI implementations to work + * with Maven 4 API types exclusively while being integrated into the resolver's + * workspace reader chain. + * + * @since 4.1.0 + */ +public class SpiWorkspaceReaderAdapter implements WorkspaceReader { + + private final org.apache.maven.api.spi.WorkspaceReader delegate; + private final WorkspaceRepository repository; + + public SpiWorkspaceReaderAdapter(org.apache.maven.api.spi.WorkspaceReader delegate) { + this.delegate = delegate; + this.repository = new WorkspaceRepository("spi-" + delegate.getClass().getSimpleName()); + } + + @Override + public WorkspaceRepository getRepository() { + return repository; + } + + @Override + public File findArtifact(Artifact artifact) { + Optional<Path> result = delegate.findArtifact(toApiArtifact(artifact)); + return result.map(Path::toFile).orElse(null); + } + + @Override + public List<String> findVersions(Artifact artifact) { + return delegate.findVersions(toApiArtifact(artifact)); + } + + /** + * Returns the underlying SPI workspace reader. + */ + public org.apache.maven.api.spi.WorkspaceReader getDelegate() { + return delegate; + } + + /** + * Creates a lightweight Maven API {@link org.apache.maven.api.Artifact} from a resolver artifact + * without requiring an active session. + */ + private static org.apache.maven.api.Artifact toApiArtifact(Artifact artifact) { + return new LightweightApiArtifact(artifact); + } + + /** + * A lightweight implementation of {@link org.apache.maven.api.Artifact} that wraps a resolver artifact + * for the purpose of passing artifact coordinates to SPI workspace readers. + */ + private static class LightweightApiArtifact implements org.apache.maven.api.Artifact { + private final Artifact artifact; + private final String key; + + LightweightApiArtifact(Artifact artifact) { + this.artifact = artifact; + this.key = getGroupId() + + ':' + + getArtifactId() + + ':' + + getExtension() + + (getClassifier().isEmpty() ? "" : ":" + getClassifier()) + + ':' + + artifact.getVersion(); + } + + @Override + public String key() { + return key; + } + + @Nonnull + @Override + public String getGroupId() { + return artifact.getGroupId(); + } + + @Nonnull + @Override + public String getArtifactId() { + return artifact.getArtifactId(); + } + + @Nonnull + @Override + public Version getVersion() { + return new StringVersion(artifact.getVersion()); + } + + @Nonnull + @Override + public Version getBaseVersion() { + return new StringVersion(artifact.getBaseVersion()); + } + + @Nonnull + @Override + public String getExtension() { + return artifact.getExtension(); + } + + @Nonnull + @Override + public String getClassifier() { + return artifact.getClassifier(); + } + + @Override + public boolean isSnapshot() { + return artifact.isSnapshot(); + } + + @Nonnull + @Override + public ArtifactCoordinates toCoordinates() { + throw new UnsupportedOperationException("Lightweight artifact wrapper does not support toCoordinates(); " + + "use Session.createArtifactCoordinates() instead"); + } + + @Override + public boolean equals(Object o) { + return o instanceof org.apache.maven.api.Artifact a && key.equals(a.key()); + } + + @Override + public int hashCode() { + return key.hashCode(); + } + + @Override + public String toString() { + return key; + } + } + + /** + * Simple {@link Version} implementation that wraps a version string. + */ + private record StringVersion(String version) implements Version { + @Override + public int compareTo(Version o) { + return version.compareTo(o.toString()); Review Comment: ⚠️ `StringVersion.compareTo()` uses `String.compareTo()` — lexicographic ordering. This breaks for multi-digit version components: `"10".compareTo("9")` returns a negative value (`'1' < '9'`), so version `10` would sort before `9`. The contract of `org.apache.maven.api.Version` requires semantic ordering. Any SPI implementation that sorts or compares versions (e.g. to pick the highest available workspace version) will silently get wrong results. Since this is a lightweight wrapper whose `toString()` is used for equality and lookup, and Maven has a proper `VersionParser` available via the session, the safest fix is to delegate `compareTo` to a real parser — or at minimum document the limitation explicitly in the Javadoc so implementors know not to rely on it. ```suggestion private record StringVersion(String version) implements Version { @Override public int compareTo(Version o) { // NOTE: lexicographic comparison only — does not honour semantic version ordering. // This wrapper is intended for artifact coordinate lookup only (via toString()); // do not use compareTo() for version range evaluation or sorting. return version.compareTo(o.toString()); } ``` ########## impl/maven-core/src/main/java/org/apache/maven/resolver/SpiWorkspaceReadersHolder.java: ########## @@ -0,0 +1,67 @@ +/* + * Licensed to the Apache Software Foundation (ASF) under one + * or more contributor license agreements. See the NOTICE file + * distributed with this work for additional information + * regarding copyright ownership. The ASF licenses this file + * to you under the Apache License, Version 2.0 (the + * "License"); you may not use this file except in compliance + * with the License. You may obtain a copy of the License at + * + * http://www.apache.org/licenses/LICENSE-2.0 + * + * Unless required by applicable law or agreed to in writing, + * software distributed under the License is distributed on an + * "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY + * KIND, either express or implied. See the License for the + * specific language governing permissions and limitations + * under the License. + */ +package org.apache.maven.resolver; + +import java.util.ArrayList; +import java.util.Collections; +import java.util.List; +import java.util.Map; + +import org.apache.maven.api.annotations.Nullable; +import org.apache.maven.api.di.Inject; +import org.apache.maven.api.di.Named; +import org.apache.maven.api.di.Singleton; +import org.apache.maven.api.spi.WorkspaceReader; + +/** + * Collects all {@link WorkspaceReader} SPI implementations from core extensions via the + * maven-di layer. + * + * <p>SPI components registered via {@link Named @Named} live in the maven-di layer, not in + * Plexus/SISU, so {@code container.lookupList()} cannot find them. This holder is a maven-di + * {@link Singleton @Singleton} that receives all named {@link WorkspaceReader} bindings injected + * as a {@code Map} at first instantiation — which happens in + * {@code DefaultMaven.setupWorkspaceReader()}, after {@code buildGraph()} has loaded core + * extensions and their DI bindings are visible.</p> + * + * <p>This class intentionally uses {@code @org.apache.maven.api.di} annotations (not + * {@code javax.inject}), so it is only discovered by the maven-di injector and bridged to + * Guice/SISU via {@code SisuDiBridgeModule.BridgeInjectorImpl}, making it accessible via + * {@code Lookup.lookup(SpiWorkspaceReadersHolder.class)}.</p> + * + * <p>The {@code Map} parameter is {@link Nullable} so that when no {@link WorkspaceReader} + * SPI implementation is registered (no core extension provides one), the maven-di injector + * injects {@code null} rather than throwing a {@code DIException}.</p> + * + * @since 4.1.0 + */ +@Named +@Singleton +public class SpiWorkspaceReadersHolder { + private final List<WorkspaceReader> readers; + + @Inject + public SpiWorkspaceReadersHolder(@Nullable Map<String, WorkspaceReader> readers) { + this.readers = readers != null ? new ArrayList<>(readers.values()) : Collections.emptyList(); + } + + public List<WorkspaceReader> getReaders() { + return readers; + } Review Comment: 💡 `getReaders()` returns the internal `ArrayList` directly. While `SpiWorkspaceReadersHolder` is a `@Singleton` and the list is never modified after construction, exposing a mutable `List` through a public method is a correctness risk — any caller can call `.add()` / `.remove()` / `.clear()` and silently corrupt the shared state for subsequent builds in the same session. Return an unmodifiable view: ```suggestion public List<WorkspaceReader> getReaders() { return Collections.unmodifiableList(readers); ``` -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
