Re: [PR] fix(build): publish dependency-reduced POMs for shaded bundles [hudi]

["voonhous (via GitHub)" <gi...@apache.org>]

voonhous commented on code in PR #19433:
URL: https://github.com/apache/hudi/pull/19433#discussion_r3694767115


##########
packaging/hudi-aws-bundle/pom.xml:
##########
@@ -117,7 +117,7 @@
                                     <shadedPattern>org.apache.hudi.aws.org.apache.httpcomponents.</shadedPattern>
                                 </relocation>
                             </relocations>
-                            <createDependencyReducedPom>false</createDependencyReducedPom>
+                            <createDependencyReducedPom>true</createDependencyReducedPom>

Review Comment:
   **Decision: keep `promoteTransitiveDependencies=true` on these seven.** Not blocking on aligning the other nine.
   
   The three options are not symmetric:
   
   | POM state | what a consumer resolves |
   | --- | --- |
   | today (`createDependencyReducedPom=false`) | full closure, including unrelocated copies of what the jar already absorbed |
   | reduced, promotion **off** | direct deps minus absorbed -> **loses real runtime deps** |
   | reduced, promotion **on** (this PR) | full closure minus absorbed |
   
   Only the third preserves the runtime contract, so this is not really "house style vs correctness". The nine get away with promotion-off because the Spark/Flink bundles land on a classpath that already supplies everything; these seven land on Hive/Presto/MR classpaths that do not ship `orc-core`, `rocksdbjni`, `jetty-server` or dropwizard metrics. Leaving the nine alone here is the right scope.
   
   **Verified on a clean build of `ed3ccf5` vs `633d142`:**
   
   - all seven emit a reduced POM (74 / 80 / 82 / 105 / 112 / 190 / 74 deps)
   - cross-checked every entry against each bundle's effective artifactSet (own includes plus the inherited root includes): **zero overlap**, nothing that is inside a jar is still declared
   - every promoted entry carries an explicit `<version>`, `<parent>` is retained, no test/optional/classifier artifacts leaked in
   - `hudi-presto-bundle`, `hudi-hadoop-mr-bundle` and `hudi-datahub-sync-bundle` jar listings are **identical** to master, and presto keeps its 109 `org/apache/hudi/hadoop/**` entries
   
   **Action for this PR (description only):** add a line to Impact noting that promotion flattens the graph, so those 80-190 artifacts become depth-1 for consumers with pinned versions and baked-in exclusions, and therefore win mediation against the consumer's own deeper transitives. That differs from both today's behaviour and the other nine.
   
   **Follow-up, not here:** align the nine, or record an explicit decision that they stay as they are.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@hudi.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org