Repository navigation
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request configures the CLIRR plugin within a profile in the Google Auth Library, replaces the unlicensed isorelax dependency with org.netbeans.external:isorelax across several POM files, pins the maven-surefire-plugin to version 3.5.3, and updates the libraries-bom version in samples. Feedback suggests also pinning the maven-failsafe-plugin to the same version (3.5.3) in both the root and dashboard POMs to avoid potential classpath or test runner conflicts.
org.netbeans.external:isorelax replaces isorelax:isorelax as a runtime dependency of com.google.cloud.tools:dependencies. No code in the java-cloud-bom tooling modules uses it directly, so .kokoro/dependencies.sh (dependency:analyze -DfailOnWarning=true) reports it as an unused declared dependency. Add it to ignoredUnusedDeclaredDependencies in the 5 analyzed modules.
hj690
added
the
kokoro:force-run
yoshi-kokoro
removed
the
kokoro:force-run
hj690
changed the title
| <groupId>com.google.cloud.tools</groupId> | ||
| <artifactId>dependencies</artifactId> | ||
| <version>1.5.15</version> | ||
| <!-- isorelax:isorelax:20030108 has no license metadata (b/568717591). Use the |
There was a problem hiding this comment.
com.google.cloud.tools:dependencies is from https://github.com/GoogleCloudPlatform/cloud-opensource-java/blob/master/dependencies/pom.xml which is also owned by us. Can we update isorelax there, make a new release and then update the version here? So that we don't have to exclude it in multiple different places?
There was a problem hiding this comment.
Thank you for the suggestion, I'll make a release and update here.
There was a problem hiding this comment.
OK, I've released a new version of com.google.cloud.tools:dependencies and updated here to use the new version dba880a
…local isorelax workarounds
hj690
added
the
kokoro:force-run
yoshi-kokoro
removed
the
kokoro:force-run
…gedDependencyCheck
hj690
added
the
kokoro:force-run
yoshi-kokoro
removed
the
kokoro:force-run
This branch has not been deployed
3 participants
Summary
This PR prepares
google-cloud-javaandjava-cloud-bomto build and release using only dependencies from the Airlock trusted Maven repository (maven-3p-trusted).Changes
com.google.cloud.tools:dependenciesanddependencies-parentto1.5.16in 7 internal tooling POMs (java-cloud-bom/{dashboard,libraries-release-data,release-note-generation,tests,tests/validate-bom}andsdk-platform-java/java-shared-dependencies/{dependency-convergence-check,unmanaged-dependency-check}):1.5.16(GoogleCloudPlatform/cloud-opensource-java#2472) replacesisorelax:isorelax:20030108withorg.netbeans.external:isorelax:RELEASE310(MIT license, available inmaven-3p-trusted) and upgradesmaven-surefire-pluginto3.5.4independencies-parent.clirr-maven-plugininto theclirr-compatibility-checkprofile ingoogle-auth-library-java/pom.xml:clirr-maven-pluginbinding in a JDK-activatedclirr-compatibility-checkprofile matchingjava-shared-config.-P=-clirr-compatibility-check) to skip resolvingplexus-components:1.1.4andclassworlds:1.1-alpha-2.maven-surefire-plugin:3.5.3injava-cloud-bom/pom.xml:maven-surefire-plugin:2.17in the standalonejava-cloud-bom-rootPOM so thejava-cloud-bomrelease build stops pullingclassworlds:1.1andclassworlds:1.1-alpha-2.<module>tests/dependency-convergence</module>from the defaultjava-cloud-bom/pom.xmlreactor:java-cloud-bomrelease reactor from resolving every newly published 1P artifact from the same-day release train before Airlock finishes importing them. CI (.kokoro/dashboard.sh) runsdependency-convergence-checkseparately.libraries-bomto26.90.0injava-samples/native-image-sample/pom.xmlandjava-spanner/samples/snippets/pom.xml:libraries-bomimports (26.80.0and26.84.0) that pullgoogle-cloud-bom:0.261.0and0.265.0with26.90.0(google-cloud-bom:0.271.0, available inmaven-3p-trusted).