[MNG-8009] BOM peculiarities with build ordering

[jira-importer]

Tamas Cservenak opened MNG-8009 and commented

Maven 3.9.6 and 4.0.0-alpha-11-SNAP (current master), Java 21.

After this commit: f1c53cb

Executing from top level command mvn spotless:apply does NOT work: plugin is not found!

If you checkout commit before that one, it works.

Diffing the debug output from two executions, the "good" one (before given commit) has this line:

Resolved plugin prefix spotless to com.diffplug.spotless:spotless-maven-plugin from POM org.apache.maven:maven-bom:pom:4.0.0-alpha-11-SNAPSHOT

Meaning, plugin is resolved from BOM??? And as given commit changes the BOM parent from maven-parent (that has spotless defined) to ASF parent (that does not have it), makes plugin not resolvable?

Despite root POM of Maven parent maven-parent defines it, and even top level POM redefines it?

---

Affects: 3.9.6, 4.0.0-alpha-10

Issue Links:

• MNG-8003 Maven BOM should have a cleaner parent
  ("is caused by")

• MNG-8191 [reactor build order] modules used in dependencyManagement-section with scope import should be ordered first

• MNG-8012 Warn on BOM import within same reactor

[jira-importer]

Michael Osipov commented

21 only?

[jira-importer]

Tamas Cservenak commented

Issue solved, and also there is explanation why this issue "spans across all maven versions"....

In short, BOM is able to introduce build ordering peculiarities. Just look at maven master how is ordered:

[INFO] --------------------------------------------------------------------------------------------------------------------------
[INFO] Reactor Summary for Apache Maven 4.0.0-alpha-11-SNAPSHOT:
[INFO] 
[INFO] Maven Dependencies BOM ............................................................................... SKIPPED
[INFO] Apache Maven ......................................................................................... SKIPPED
[INFO] Maven 4 API .......................................................................................... SKIPPED
[INFO] Maven 4 API :: Meta annotations ...................................................................... SKIPPED
...

Meaning BOM module is built first! All this due fact that TLP POM imports BOM.

Second, the CLI invocation mvn spotless:apply first builds model, and then "picks the first project" to resolve plugin, but alas, first one is BOM, that is "bare naked" (contains minimal stuff aimed at others to consume), and it does NOT contain any trace of spotless plugin.

I'd personally forbid BOM imports inside of reactor. They are meant for external consumption ONLY. Also, would reconsider how we choose POM to resolve CLI plugin from...

[jira-importer]

Tamas Cservenak commented

This issue on master is now fixed with commit 2084b0e

Simply put, import should not happen within reactor. Maven when invoking plugin goals from top level directory (like mvn spotless:apply, but any) will take "current" (first) project to resolve the plugin, but if "minimal" BOM is first, this is no go.

[jira-importer]

Tamas Cservenak commented

Despite fix on master, the invocation of mvn spotless:apply still fails on last module (BOM) as it has no knowledge about the plugin...

[gnodet]

The reactor ordering is now explicit: BOM imports declared in <dependencyManagement> are treated as reactor graph edges in ProjectSorter since #13040 (merged) / #13262 (maven-4.0.x) / #13263 (maven-3.10.x). The BOM module will always sort before its consumers in the reactor.

The original problem reported here was resolved differently at the time (Maven stopped self-importing maven-bom from the TLP). The residual risk — that a reactor BOM is evaluated in CONSUMER_DEPENDENCY mode without conditional profile activation — is now documented in an improved warning message (#13264).