Release hardening - #307
Merged
Merged
Conversation
Both distributions shade ~180 third-party jars, 75 of which ship a NOTICE. Shade keeps only the last file it sees per exact name, so the community jar shipped Jackson's NOTICE alone and the server's shipped Commons Lang's, with the rest silently discarded - the attribution section 4(d) of the Apache License requires a redistribution to carry forward. ApacheNoticeResourceTransformer merges them: 73 of the 75 now appear, scala-library and scala-reflect being the exceptions, since they put theirs at the jar root out of the transformer's reach. Its organization defaults to the ASF, so set the project's own from the pom developers and the 2022 first commit. META-INF/LICENSE was likewise whichever copy shade processed last - Apache-2.0 text, so right by accident. ApacheLicense drops the dependencies' copies and IncludeResource states the repository's own LICENSE, making it deterministic.
Ignifyr publishes no Maven artifacts, so a release is a tag, the two fat jars and their images. Because those jars shade every dependency they redistribute it, which makes the shipped contents the thing worth checking rather than what the poms declare. Five invariants: nothing resolves to a -SNAPSHOT, both jars carry aggregated NOTICEs and the repository's own LICENSE, no copyleft-only library reaches the Apache-2.0 community distribution, ignifyr-terminology-tools and its hard-coded dev credentials stay out of both, and the tree is clean with the tag free. Multi-licensing makes a naive licence scan cry wolf - jakarta.* offers EPL or GPL-with-classpath-exception, rocksdbjni Apache or GPLv2 - so a dependency fails only when every licence it offers is strong copyleft, and poms that declare none are reported rather than failed. Bare the version checks warn, so CI can run it per commit; --release makes everything fatal.
Records what a release is, delegates pre-flight to the gates and tiers that already exist, and stops hard before anything is pushed or published. Notes the three known limitations: two dependencies put NOTICE outside META-INF where no transformer reaches it, dependencies that declare no licence are reported rather than failed, and the release profile is dead code pointed at the retired OSSRH.
…gate dependency:list resolves ignifyr-cli's sibling modules from the local repository, and CI only ever runs `verify` and `package`, neither of which puts them there. On a clean runner both listings came back empty, so the dependency and licence checks had nothing to read - reported by the empty-input guard rather than passing vacuously, which is what the guard exists for. Building with `install` makes the siblings resolvable. Verified by hiding io.ignifyr from the local repository and re-running: 182 poms read instead of 0.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
No description provided.