You are viewing a plain text version of this content. The canonical link for it is here.
Posted to commits@camel.apache.org by "gnodet (via GitHub)" <gi...@apache.org> on 2026/09/11 11:09:08 UTC
[PR] CAMEL-22967: Add dep-check profile for maven-dependency-plugin:analyze [camel]
gnodet opened a new pull request, #26330:
URL: https://github.com/apache/camel/pull/26330
## Summary
Adds an opt-in `-Pdep-check` Maven profile that wires `maven-dependency-plugin:analyze-only` into the `verify` phase. The plugin was already declared in `pluginManagement` at v3.11.0 but had no execution configured.
Closes [CAMEL-22967](https://issues.apache.org/jira/browse/CAMEL-22967).
## What it does
- **Profile `dep-check`** in root `pom.xml`: runs `dependency:analyze-only` on every module during `verify`. Non-blocking by default (`failOnWarning=false`); callers can escalate with `-DfailOnWarning=true`.
- **Ignored noise**: known intentional compile-scope runtime deps (`log4j-slf4j2-impl`, `log4j-core`) are suppressed so results focus on real problems.
- **GitHub Actions workflow** `dep-check.yml`: non-blocking PR check (`continue-on-error: true`) that runs the profile and uploads output as a build artifact for inspection.
## Usage
```shell
# Report mode (default) — never fails the build
mvn verify -Pdep-check -DskipTests
# Enforcement mode — fails if any used-undeclared or unused-declared dep found
mvn verify -Pdep-check -DskipTests -DfailOnWarning=true
```
## Validation
Smoke-tested against `camel-api` (clean) and `camel-jetty` (finds real issues from the JIRA description):
```
[INFO] --- dependency:3.11.0:analyze-only (dep-analyze) @ camel-api ---
[INFO] No dependency problems found
```
The profile surfaces the same findings described in the JIRA (used-undeclared, unused-declared) — confirming it works correctly.
---
_Hermes Agent (Claude Sonnet 4.6) on behalf of Guillaume Nodet_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-22967: Add dep-check profile for maven-dependency-plugin:analyze [camel]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on PR #26330:
URL: https://github.com/apache/camel/pull/26330#issuecomment-5660840727
@oscerd Good point — added a "Checking dependency hygiene" section to `docs/main/modules/contributing/pages/building.adoc` in 388f374. It covers the profile, how to run it (full reactor or single module), and the CI integration. The user-manual `building.adoc` is just a redirect to the contributing page, so no mirror to update.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-22967: Add dep-check profile using pilot:dependencies [camel]
Posted by "gnodet-bot (via GitHub)" <gi...@apache.org>.
gnodet-bot commented on code in PR #26330:
URL: https://github.com/apache/camel/pull/26330#discussion_r4060292008
##########
.github/workflows/dep-check.yml:
##########
@@ -0,0 +1,94 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: 'Dependency Analysis'
+
+on:
+ pull_request:
+ branches:
+ - main
+ paths-ignore:
+ - .claude-plugin/**
+ - .idea/**
+ - .github/**
+ - .oss-ai-helper-rules/**
+ - AGENTS.md
+ - README.md
+ - SECURITY.md
+ - Jenkinsfile
+ - Jenkinsfile.*
+ - NOTICE.txt
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+ cancel-in-progress: true
+
+permissions:
+ contents: read
+
+jobs:
+ dep-check:
+ if: github.repository == 'apache/camel'
+ name: Dependency Analysis (non-blocking)
+ runs-on: ubuntu-latest
+ continue-on-error: true
+ steps:
+ - name: Checkout
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ ref: ${{ github.event.pull_request.head.sha }}
+ fetch-depth: 1
+
+ - name: Set up JDK 21
+ uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+ with:
+ distribution: 'temurin'
+ java-version: '21'
+ cache: 'maven'
+
+ - name: Compile (test-compile for accurate test-scope analysis)
+ run: |
+ # camel-spring-xml is excluded: it unpacks SNAPSHOT source JARs (camel-api:sources, etc.)
+ # during process-resources, which are not available in a clean CI checkout without a
+ # prior mvn install. The XSD it generates is pre-committed, so skipping it here is safe.
+ # camel-test-spring-junit6 is excluded: it has a compile dependency on camel-spring-xml,
+ # which is not available in a clean checkout without a prior mvn install.
+ # camel-spring-main is excluded: it has a test dependency on camel-test-spring-junit6,
+ # which is excluded above and therefore not available in a clean checkout.
+ # camel-maven-plugin, catalog/camel-allcomponents, coverage are excluded: they have a
+ # compile dependency on camel-spring-main, which is excluded above.
+ # camel-hazelcast, camel-mail, camel-consul, camel-zookeeper are excluded: they have a
+ # test dependency on camel-spring-main, which is not resolvable in a clean checkout.
+ mvn test-compile -Pdep-check -Dlicense.skip -Dquickly \
+ --pl '!components/camel-spring-parent/camel-spring-xml,!components/camel-test/camel-test-spring-junit6,!components/camel-spring-parent/camel-spring-main,!tooling/maven/camel-maven-plugin,!catalog/camel-allcomponents,!coverage,!components/camel-hazelcast,!components/camel-mail,!components/camel-consul,!components/camel-zookeeper' \
+ --no-transfer-progress --batch-mode -q
+
+ - name: Run dependency analysis
+ run: |
+ mvn eu.maveniverse.maven.plugins:pilot-plugin:0.4.0:dependencies \
+ -Pdep-check -Dlicense.skip \
+ --pl '!components/camel-spring-parent/camel-spring-xml,!components/camel-test/camel-test-spring-junit6,!components/camel-spring-parent/camel-spring-main,!tooling/maven/camel-maven-plugin,!catalog/camel-allcomponents,!coverage,!components/camel-hazelcast,!components/camel-mail,!components/camel-consul,!components/camel-zookeeper' \
+ --no-transfer-progress --batch-mode \
+ 2>&1 | tee dep-check-output.txt
+
+ - name: Upload dependency analysis report
Review Comment:
💡 **Nit (carry-over from previous review, still open) — version hardcoded in 3 locations:** `pilot-plugin:0.4.0` appears here in the workflow, in `pom.xml` `<pluginManagement>` (line 172 of the pom diff), and 4× in `building.adoc`. These must be updated independently on each pilot release since the fully-qualified `groupId:artifactId:version:goal` form bypasses pluginManagement resolution.
Consider extracting to a root-pom property (`<pilot.plugin.version>0.4.0</pilot.plugin.version>`) and referencing it as `-D` in the workflow, or at minimum add a comment pointing to the other two locations.
##########
.github/workflows/dep-check.yml:
##########
@@ -0,0 +1,94 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: 'Dependency Analysis'
+
+on:
+ pull_request:
+ branches:
+ - main
+ paths-ignore:
+ - .claude-plugin/**
+ - .idea/**
+ - .github/**
+ - .oss-ai-helper-rules/**
+ - AGENTS.md
+ - README.md
+ - SECURITY.md
+ - Jenkinsfile
+ - Jenkinsfile.*
+ - NOTICE.txt
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+ cancel-in-progress: true
+
+permissions:
+ contents: read
+
+jobs:
+ dep-check:
+ if: github.repository == 'apache/camel'
+ name: Dependency Analysis (non-blocking)
+ runs-on: ubuntu-latest
+ continue-on-error: true
+ steps:
+ - name: Checkout
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ ref: ${{ github.event.pull_request.head.sha }}
+ fetch-depth: 1
+
+ - name: Set up JDK 21
+ uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+ with:
+ distribution: 'temurin'
+ java-version: '21'
+ cache: 'maven'
+
+ - name: Compile (test-compile for accurate test-scope analysis)
+ run: |
+ # camel-spring-xml is excluded: it unpacks SNAPSHOT source JARs (camel-api:sources, etc.)
+ # during process-resources, which are not available in a clean CI checkout without a
+ # prior mvn install. The XSD it generates is pre-committed, so skipping it here is safe.
+ # camel-test-spring-junit6 is excluded: it has a compile dependency on camel-spring-xml,
+ # which is not available in a clean checkout without a prior mvn install.
+ # camel-spring-main is excluded: it has a test dependency on camel-test-spring-junit6,
+ # which is excluded above and therefore not available in a clean checkout.
+ # camel-maven-plugin, catalog/camel-allcomponents, coverage are excluded: they have a
+ # compile dependency on camel-spring-main, which is excluded above.
+ # camel-hazelcast, camel-mail, camel-consul, camel-zookeeper are excluded: they have a
+ # test dependency on camel-spring-main, which is not resolvable in a clean checkout.
+ mvn test-compile -Pdep-check -Dlicense.skip -Dquickly \
+ --pl '!components/camel-spring-parent/camel-spring-xml,!components/camel-test/camel-test-spring-junit6,!components/camel-spring-parent/camel-spring-main,!tooling/maven/camel-maven-plugin,!catalog/camel-allcomponents,!coverage,!components/camel-hazelcast,!components/camel-mail,!components/camel-consul,!components/camel-zookeeper' \
+ --no-transfer-progress --batch-mode -q
+
+ - name: Run dependency analysis
+ run: |
+ mvn eu.maveniverse.maven.plugins:pilot-plugin:0.4.0:dependencies \
+ -Pdep-check -Dlicense.skip \
+ --pl '!components/camel-spring-parent/camel-spring-xml,!components/camel-test/camel-test-spring-junit6,!components/camel-spring-parent/camel-spring-main,!tooling/maven/camel-maven-plugin,!catalog/camel-allcomponents,!coverage,!components/camel-hazelcast,!components/camel-mail,!components/camel-consul,!components/camel-zookeeper' \
+ --no-transfer-progress --batch-mode \
+ 2>&1 | tee dep-check-output.txt
+
+ - name: Upload dependency analysis report
+ if: always()
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
Review Comment:
💡 **Nit — exclusion list duplicated in two steps:** The `--pl '!...'` string appears verbatim in both the `test-compile` step (line 83) and the `pilot:dependencies` step (line 90). If they drift — e.g. a new exclusion is added to one but not the other — the analysis step would silently attempt to analyze modules that failed to compile, producing an empty/misleading result.
Extract to a job-level env var so both steps share the same source of truth:
```suggestion
mvn eu.maveniverse.maven.plugins:pilot-plugin:0.4.0:dependencies \
-Pdep-check -Dlicense.skip \
--pl '!components/camel-spring-parent/camel-spring-xml,!components/camel-test/camel-test-spring-junit6,!components/camel-spring-parent/camel-spring-main,!tooling/maven/camel-maven-plugin,!catalog/camel-allcomponents,!coverage,!components/camel-hazelcast,!components/camel-mail,!components/camel-consul,!components/camel-zookeeper' \
--no-transfer-progress --batch-mode \
2>&1 | tee dep-check-output.txt
```
(The fix is to extract the list to a shared env var, e.g. at job level — the suggestion above is a placeholder since GitHub doesn't support multi-step refactoring suggestions. The actual change would be adding `env: EXCLUDED_MODULES: '...'` at the `dep-check:` job level and using `$EXCLUDED_MODULES` in both steps.)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-22967: Add dep-check profile using pilot:dependencies [camel]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on code in PR #26330:
URL: https://github.com/apache/camel/pull/26330#discussion_r4061575798
##########
.github/workflows/dep-check.yml:
##########
@@ -0,0 +1,126 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: 'Dependency Analysis'
+
+on:
+ pull_request:
+ branches:
+ - main
+ paths-ignore:
+ - .claude-plugin/**
+ - .idea/**
+ - .github/**
+ - .oss-ai-helper-rules/**
+ - AGENTS.md
+ - README.md
+ - SECURITY.md
+ - Jenkinsfile
+ - Jenkinsfile.*
+ - NOTICE.txt
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+ cancel-in-progress: true
+
+permissions:
+ contents: read
+
+jobs:
+ dep-check:
+ if: github.repository == 'apache/camel'
+ name: Dependency Analysis (non-blocking)
+ runs-on: ubuntu-latest
+ continue-on-error: true
+ env:
+ # Modules excluded from analysis — kept in one place so both the compile and analysis steps stay in sync.
+ # See comments in the compile step below for the exclusion rationale.
+ # Also update docs/main/modules/contributing/pages/building.adoc
+ # when changing the pilot-plugin version (0.4.0 below).
+ EXCLUDED_MODULES: '!bom,!components/camel-spring-parent/camel-spring-xml,!components/camel-test/camel-test-spring-junit5,!components/camel-test/camel-test-spring-junit6'
+ steps:
+ - name: Checkout
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ ref: ${{ github.event.pull_request.head.sha }}
Review Comment:
Fixed in a63d2e045093: updated comment to mention both `pom.xml <pluginManagement>` and `building.adoc` as sync points.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-22967: Add dep-check profile for maven-dependency-plugin:analyze [camel]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on code in PR #26330:
URL: https://github.com/apache/camel/pull/26330#discussion_r4002920377
##########
.github/workflows/dep-check.yml:
##########
@@ -0,0 +1,75 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: 'Dependency Analysis'
+
+on:
+ pull_request:
+ branches:
+ - main
+ paths-ignore:
+ - .claude-plugin/**
+ - .idea/**
+ - .github/**
+ - .oss-ai-helper-rules/**
+ - AGENTS.md
+ - README.md
+ - SECURITY.md
+ - Jenkinsfile
+ - Jenkinsfile.*
+ - NOTICE.txt
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+ cancel-in-progress: true
+
+permissions:
+ contents: read
+
+jobs:
+ dep-check:
+ if: github.repository == 'apache/camel'
+ name: Dependency Analysis (non-blocking)
+ runs-on: ubuntu-latest
+ continue-on-error: true
+ steps:
+ - name: Checkout
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ ref: ${{ github.event.pull_request.head.sha }}
+ fetch-depth: 0
+
+ - name: Set up JDK 21
+ uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+ with:
+ distribution: 'temurin'
Review Comment:
Fixed in e3de1ab89dd7.
##########
.github/workflows/dep-check.yml:
##########
@@ -0,0 +1,75 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: 'Dependency Analysis'
+
+on:
+ pull_request:
+ branches:
+ - main
+ paths-ignore:
+ - .claude-plugin/**
+ - .idea/**
+ - .github/**
+ - .oss-ai-helper-rules/**
+ - AGENTS.md
+ - README.md
+ - SECURITY.md
+ - Jenkinsfile
+ - Jenkinsfile.*
+ - NOTICE.txt
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+ cancel-in-progress: true
+
+permissions:
+ contents: read
+
+jobs:
+ dep-check:
+ if: github.repository == 'apache/camel'
+ name: Dependency Analysis (non-blocking)
+ runs-on: ubuntu-latest
+ continue-on-error: true
+ steps:
+ - name: Checkout
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ ref: ${{ github.event.pull_request.head.sha }}
+ fetch-depth: 0
+
+ - name: Set up JDK 21
+ uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+ with:
+ distribution: 'temurin'
+ java-version: '21'
+ cache: 'maven'
+
+ - name: Run dependency analysis
+ run: |
+ mvn verify -Pdep-check -DskipTests -Dlicense.skip -Dquickly \
+ --no-transfer-progress --batch-mode -q \
+ 2>&1 | tee dep-check-output.txt || true
Review Comment:
Fixed in e3de1ab89dd7. Removed both `-q` and `|| true`.
##########
pom.xml:
##########
@@ -992,6 +994,43 @@
</pluginRepository>
</pluginRepositories>
</profile>
+ <profile>
+ <!--
+ Opt-in dependency analysis profile.
+ Usage: mvn verify -Pdep-check [-DfailOnWarning=true]
+ Runs maven-dependency-plugin:analyze on every module and reports
+ used-undeclared / unused-declared dependencies. Non-blocking by
+ default (failOnWarning=false); set -DfailOnWarning=true to enforce.
+ -->
+ <id>dep-check</id>
+ <build>
+ <plugins>
+ <plugin>
+ <groupId>org.apache.maven.plugins</groupId>
+ <artifactId>maven-dependency-plugin</artifactId>
+ <executions>
+ <execution>
+ <id>dep-analyze</id>
+ <goals>
+ <goal>analyze-only</goal>
+ </goals>
+ <phase>verify</phase>
+ <configuration>
+ <failOnWarning>${failOnWarning}</failOnWarning>
+ <outputXML>true</outputXML>
+ <ignoredUnusedDeclaredDependencies>
+ <!-- Logging implementations are runtime deps intentionally declared at compile scope -->
+ <ignoredUnusedDeclaredDependency>org.apache.logging.log4j:log4j-slf4j2-impl</ignoredUnusedDeclaredDependency>
+ <ignoredUnusedDeclaredDependency>org.apache.logging.log4j:log4j-core</ignoredUnusedDeclaredDependency>
+ </ignoredUnusedDeclaredDependencies>
Review Comment:
Fixed in e3de1ab89dd7.
##########
.github/workflows/dep-check.yml:
##########
@@ -0,0 +1,75 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: 'Dependency Analysis'
+
+on:
+ pull_request:
+ branches:
+ - main
+ paths-ignore:
+ - .claude-plugin/**
+ - .idea/**
+ - .github/**
+ - .oss-ai-helper-rules/**
+ - AGENTS.md
+ - README.md
+ - SECURITY.md
+ - Jenkinsfile
+ - Jenkinsfile.*
+ - NOTICE.txt
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+ cancel-in-progress: true
+
+permissions:
+ contents: read
+
+jobs:
+ dep-check:
+ if: github.repository == 'apache/camel'
+ name: Dependency Analysis (non-blocking)
+ runs-on: ubuntu-latest
+ continue-on-error: true
+ steps:
+ - name: Checkout
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ ref: ${{ github.event.pull_request.head.sha }}
+ fetch-depth: 0
+
+ - name: Set up JDK 21
+ uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+ with:
+ distribution: 'temurin'
Review Comment:
Fixed in e3de1ab89dd7.
##########
.github/workflows/dep-check.yml:
##########
@@ -0,0 +1,75 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: 'Dependency Analysis'
+
+on:
+ pull_request:
+ branches:
+ - main
+ paths-ignore:
+ - .claude-plugin/**
+ - .idea/**
+ - .github/**
+ - .oss-ai-helper-rules/**
+ - AGENTS.md
+ - README.md
+ - SECURITY.md
+ - Jenkinsfile
+ - Jenkinsfile.*
+ - NOTICE.txt
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+ cancel-in-progress: true
+
+permissions:
+ contents: read
+
+jobs:
+ dep-check:
+ if: github.repository == 'apache/camel'
+ name: Dependency Analysis (non-blocking)
+ runs-on: ubuntu-latest
+ continue-on-error: true
+ steps:
+ - name: Checkout
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ ref: ${{ github.event.pull_request.head.sha }}
+ fetch-depth: 0
+
+ - name: Set up JDK 21
+ uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+ with:
+ distribution: 'temurin'
+ java-version: '21'
+ cache: 'maven'
+
+ - name: Run dependency analysis
+ run: |
+ mvn verify -Pdep-check -DskipTests -Dlicense.skip -Dquickly \
+ --no-transfer-progress --batch-mode -q \
+ 2>&1 | tee dep-check-output.txt || true
Review Comment:
Fixed in e3de1ab89dd7.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-22967: Add dep-check profile for maven-dependency-plugin:analyze [camel]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on code in PR #26330:
URL: https://github.com/apache/camel/pull/26330#discussion_r4002921709
##########
.github/workflows/dep-check.yml:
##########
@@ -0,0 +1,75 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: 'Dependency Analysis'
+
+on:
+ pull_request:
+ branches:
+ - main
+ paths-ignore:
+ - .claude-plugin/**
+ - .idea/**
+ - .github/**
+ - .oss-ai-helper-rules/**
+ - AGENTS.md
+ - README.md
+ - SECURITY.md
+ - Jenkinsfile
+ - Jenkinsfile.*
+ - NOTICE.txt
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+ cancel-in-progress: true
+
+permissions:
+ contents: read
+
+jobs:
+ dep-check:
+ if: github.repository == 'apache/camel'
+ name: Dependency Analysis (non-blocking)
+ runs-on: ubuntu-latest
+ continue-on-error: true
+ steps:
+ - name: Checkout
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ ref: ${{ github.event.pull_request.head.sha }}
+ fetch-depth: 0
+
+ - name: Set up JDK 21
Review Comment:
Fixed in e3de1ab89dd7.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-22967: Add dep-check profile for maven-dependency-plugin:analyze [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #26330:
URL: https://github.com/apache/camel/pull/26330#issuecomment-5633724357
<!-- ci-tested-modules -->
:information_source: CI did not run targeted module tests.
---
:gear: [View full build and test results](https://github.com/apache/camel/actions/runs/34592628356)
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-22967: Add dep-check profile using pilot:dependencies [camel]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on PR #26330:
URL: https://github.com/apache/camel/pull/26330#issuecomment-5758882666
Fixed `Dependency Analysis (non-blocking)` CI failure in 5e3b40ae89f657b793d45adbbdb55c1f66df6dbd.
**Root cause:** `camel-xml-io`'s `generate-xml-sources` execution (generate-xml-parser + generate-xml-writer) runs at `generate-sources` phase and reads `camel-core-model/target/classes/META-INF/jandex.idx`, which is produced by `PackageJandexMojo` at `process-classes` phase. In the dep-check workflow's clean checkout, only `compile` phase runs — so `process-classes` never executes and `jandex.idx` is missing.
**Why the previous fix didn't work:** The `7d68953` commit tried to bind `generate-xml-sources` to `phase=none` via `pluginManagement` in the root dep-check profile. This doesn't work: Maven's pluginManagement phase binding in a **parent** profile is overridden by an explicit `<phase>` in the **child pom's** own execution block. So `camel-xml-io/pom.xml`'s own `<phase>generate-sources</phase>` always won.
**Fix:** Add `!core/camel-xml-io` to `EXCLUDED_MODULES` in the workflow. The generated sources are pre-committed in `src/generated/java`, so skipping this module from dep-check is safe. Also removed the now-dead `pluginManagement` entry from `pom.xml`.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-22967: Add dep-check profile using pilot:dependencies [camel]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on code in PR #26330:
URL: https://github.com/apache/camel/pull/26330#discussion_r4060963994
##########
pom.xml:
##########
@@ -992,6 +992,43 @@
</pluginRepository>
</pluginRepositories>
</profile>
+ <profile>
+ <!--
+ Opt-in dependency analysis profile.
+ Usage: mvn test-compile pilot:dependencies -Pdep-check [-Dpilot.action=check]
Review Comment:
Fixed in 5aa9a2431485.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-22967: Add dep-check profile using pilot:dependencies [camel]
Posted by "gnodet-bot (via GitHub)" <gi...@apache.org>.
gnodet-bot commented on code in PR #26330:
URL: https://github.com/apache/camel/pull/26330#discussion_r4060946693
##########
pom.xml:
##########
@@ -992,6 +992,43 @@
</pluginRepository>
</pluginRepositories>
</profile>
+ <profile>
+ <!--
+ Opt-in dependency analysis profile.
+ Usage: mvn test-compile pilot:dependencies -Pdep-check [-Dpilot.action=check]
Review Comment:
💡 **Nit — stale usage comment:** `building.adoc` and the workflow both now use `compile + -Dpilot.skipTestScope=true` (switched in `139b7959`), but this profile comment still documents `test-compile`. A developer following this comment on a full reactor checkout will hit the `camel-test-spring-junit6` resolution failure the workflow migration was specifically designed to avoid.
```suggestion
Usage: mvn compile pilot:dependencies -Pdep-check -Dpilot.skipTestScope=true [-Dpilot.action=check]
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-22967: Add dep-check profile for maven-dependency-plugin:analyze [camel]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on PR #26330:
URL: https://github.com/apache/camel/pull/26330#issuecomment-5666048718
Converting to draft while we investigate a better approach.
`maven-dependency-plugin:analyze-only` works on classpath class presence, which produces significant noise on a framework like Camel. Testing it on `camel-bean` showed several false positives: `camel-api`, `camel-util`, and `slf4j-api` all flagged as "used undeclared" when they are in fact correctly pulled in transitively via `camel-support` — the plugin just can't distinguish that.
A better alternative is [`pilot:dependencies`](https://github.com/maveniverse/pilot) from Maveniverse, which uses ASM bytecode analysis with member-level granularity and is SPI/ServiceLoader-aware — exactly what Camel needs. On the same module it correctly attributed all transitive deps and produced zero false positives.
Two issues currently block using it in CI:
- [maveniverse/pilot#144](https://github.com/maveniverse/pilot/issues/144): `action=check` is not headless — requires a PTY, hangs in a non-interactive shell
- [maveniverse/pilot#145](https://github.com/maveniverse/pilot/issues/145): requires Java 22+, Camel CI uses JDK 21
Will update the PR to use `pilot:dependencies -Dpilot.action=check` once those are resolved.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-22967: Add dep-check profile using pilot:dependencies [camel]
Posted by "gnodet-bot (via GitHub)" <gi...@apache.org>.
gnodet-bot commented on code in PR #26330:
URL: https://github.com/apache/camel/pull/26330#discussion_r4060210349
##########
.github/workflows/dep-check.yml:
##########
@@ -0,0 +1,88 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: 'Dependency Analysis'
+
+on:
+ pull_request:
+ branches:
+ - main
+ paths-ignore:
+ - .claude-plugin/**
+ - .idea/**
+ - .github/**
+ - .oss-ai-helper-rules/**
+ - AGENTS.md
+ - README.md
+ - SECURITY.md
+ - Jenkinsfile
+ - Jenkinsfile.*
+ - NOTICE.txt
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+ cancel-in-progress: true
+
+permissions:
+ contents: read
+
+jobs:
+ dep-check:
+ if: github.repository == 'apache/camel'
+ name: Dependency Analysis (non-blocking)
+ runs-on: ubuntu-latest
+ continue-on-error: true
+ steps:
+ - name: Checkout
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ ref: ${{ github.event.pull_request.head.sha }}
+ fetch-depth: 1
+
+ - name: Set up JDK 21
+ uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+ with:
+ distribution: 'temurin'
+ java-version: '21'
+ cache: 'maven'
+
+ - name: Compile (test-compile for accurate test-scope analysis)
+ run: |
+ # camel-spring-xml is excluded: it unpacks SNAPSHOT source JARs (camel-api:sources, etc.)
+ # during process-resources, which are not available in a clean CI checkout without a
+ # prior mvn install. The XSD it generates is pre-committed, so skipping it here is safe.
+ # camel-test-spring-junit6 is excluded: it has a compile dependency on camel-spring-xml,
+ # which is not available in a clean checkout without a prior mvn install.
+ mvn test-compile -Pdep-check -Dlicense.skip -Dquickly \
+ --pl '!components/camel-spring-parent/camel-spring-xml,!components/camel-test/camel-test-spring-junit6' \
+ --no-transfer-progress --batch-mode -q
+
+ - name: Run dependency analysis
+ run: |
+ mvn eu.maveniverse.maven.plugins:pilot-plugin:0.4.0:dependencies \
+ -Pdep-check -Dlicense.skip \
Review Comment:
💡 **Nit — version hardcoded in three places:** `pilot-plugin:0.4.0` appears here in the workflow, in `pom.xml` `<pluginManagement>`, and in the `building.adoc` examples. When pilot releases a new version, all three need updating independently — the pluginManagement version does not propagate to this command because the fully-qualified form (`groupId:artifactId:version:goal`) bypasses pluginManagement resolution.
Consider extracting to a root-pom property:
```suggestion
mvn eu.maveniverse.maven.plugins:pilot-plugin:${pilot.version}:dependencies \
```
with `<pilot.version>0.4.0</pilot.version>` in the root `pom.xml` properties — then the workflow could reference it via `-Dpilot.version` or use the profile-driven short form `pilot:dependencies` if a `<pluginGroups>` entry is added to the project's CI settings. Alternatively, accept the duplication as-is and add a comment pointing to the two sibling locations.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-22967: Add dep-check profile for maven-dependency-plugin:analyze [camel]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on PR #26330:
URL: https://github.com/apache/camel/pull/26330#issuecomment-5660363304
Addressed all review findings in e3de1ab89dd7:
1. **test-bundles phase ordering** — moved `copy-legal` from `generate-resources` to `initialize` so `legal.xml` is in place before `remote-resources:process` runs, regardless of plugin merge order when dep-check profile is active.
2. **setup-java v6.0.0** — pinned to the same commit hash used by all other workflows.
3. **Removed `-q` and `|| true`** — warnings are now visible in the report, and genuine build failures will surface (non-blocking via `continue-on-error: true`).
4. **fetch-depth: 1** — full history not needed for dependency analysis.
5. **JUnit ignores** — added `junit-jupiter` to unused-declared and `junit-jupiter-api` to used-undeclared ignore lists.
RE: non-blocking suggestions from the review:
- **CI cost / schedule trigger** — good point, open to switching to `schedule:` + `workflow_dispatch` if the per-PR cost is too high. Left as-is for now since it's still non-blocking.
- **`failOnWarning` property naming** — noted; can namespace it in a follow-up if preferred.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-22967: Add dep-check profile for maven-dependency-plugin:analyze [camel]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on PR #26330:
URL: https://github.com/apache/camel/pull/26330#issuecomment-5731192927
## Update: switched to `pilot:dependencies`
This PR now uses [`pilot:dependencies`](https://github.com/maveniverse/pilot) (bytecode-level analysis) instead of `maven-dependency-plugin:analyze-only`.
### What changed
- **`pom.xml`**: The `dep-check` profile now configures `eu.maveniverse.maven.plugins:pilot-plugin:0.3.0` in `pluginManagement` with the same ignore-lists. The mojo is invoked explicitly (not lifecycle-bound) since it requires compiled classes to be present first.
- **`.github/workflows/dep-check.yml`**: Two-step workflow — `test-compile` first, then `pilot:dependencies`.
- **`docs/main/modules/contributing/pages/building.adoc`**: Updated usage docs.
### Usage
```shell
# Full reactor — report mode (non-blocking, default)
mvn test-compile eu.maveniverse.maven.plugins:pilot-plugin:0.3.0:dependencies -Pdep-check -Dlicense.skip -Dquickly
# Single module
cd components/camel-jetty
mvn test-compile eu.maveniverse.maven.plugins:pilot-plugin:0.3.0:dependencies -Pdep-check
# Fail on findings (enforcement)
mvn test-compile eu.maveniverse.maven.plugins:pilot-plugin:0.3.0:dependencies -Pdep-check -Dpilot.action=check
# Fix mode (rewrites pom.xml — verify the result builds before committing)
mvn test-compile eu.maveniverse.maven.plugins:pilot-plugin:0.3.0:dependencies -Pdep-check -Dpilot.action=fix
```
### Sample report (selected compiled modules, `--skipTestScope`)
Running against `camel-api`, `camel-core-model`, `camel-core-engine`, `camel-support`, `camel-http`, `camel-jetty`, `camel-ftp`:
**`camel-api`** — ✅ No dependency issues found.
**`camel-core-model`** — findings:
```
Used transitive dependencies (should be declared):
- org.slf4j:slf4j-api
- jakarta.xml.bind:jakarta.xml.bind-api
- org.apache.camel:camel-util-json
```
**`camel-core-engine`** — findings:
```
Unused declared dependencies (can be removed):
- jakarta.xml.bind:jakarta.xml.bind-api
- org.apache.camel:camel-management-api
Used transitive dependencies (should be declared):
- org.slf4j:slf4j-api
- org.apache.camel:camel-core-model
- org.apache.camel:camel-util-json
```
**`camel-jetty`** — findings:
```
Unused declared dependencies (can be removed):
- org.eclipse.jetty.ee10:jetty-ee10-servlet
- org.eclipse.jetty:jetty-security
- org.eclipse.jetty.ee10:jetty-ee10-servlets
- org.eclipse.jetty:jetty-client
Used transitive dependencies (should be declared):
- org.apache.camel:camel-api
- org.slf4j:slf4j-api
- org.apache.camel:camel-http-base
- org.apache.camel:camel-attachments
- jakarta.activation:jakarta.activation-api
- jakarta.servlet:jakarta.servlet-api
- org.eclipse.jetty:jetty-io
```
### On `fix` mode
The `fix` action is available but **not yet validated end-to-end** across the full reactor. Pilot will rewrite pom.xml files in place — the resulting build must be verified before any auto-fix PR is opened. The Jetty findings above (unused `jetty-security`, used-transitive `jetty-io`) are a good candidate for a small proof-of-concept fix.
---
_Hermes Agent (Claude Sonnet 4.6) on behalf of Guillaume Nodet_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-22967: Add dep-check profile using pilot:dependencies [camel]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on PR #26330:
URL: https://github.com/apache/camel/pull/26330#issuecomment-5758453904
Fixed in e41518dc452b: added an 'Install SNAPSHOT build plugins' step that runs `mvn install -pl tooling/maven/camel-package-maven-plugin --also-make` before the compile step.
Root cause: `camel-package-maven-plugin:4.23.0-SNAPSHOT` is used as a build plugin by dozens of modules (core, dsl, components, catalog). In a clean CI checkout it hasn't been compiled yet, so Maven cannot parse its descriptor when it encounters an execution bound to `process-classes` during `mvn compile`. The pre-install step puts the descriptor in the local repository before the main compile step runs.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-22967: Add dep-check profile for maven-dependency-plugin:analyze [camel]
Posted by "davsclaus (via GitHub)" <gi...@apache.org>.
davsclaus commented on code in PR #26330:
URL: https://github.com/apache/camel/pull/26330#discussion_r4002318829
##########
.github/workflows/dep-check.yml:
##########
@@ -0,0 +1,75 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: 'Dependency Analysis'
+
+on:
+ pull_request:
+ branches:
+ - main
+ paths-ignore:
+ - .claude-plugin/**
+ - .idea/**
+ - .github/**
+ - .oss-ai-helper-rules/**
+ - AGENTS.md
+ - README.md
+ - SECURITY.md
+ - Jenkinsfile
+ - Jenkinsfile.*
+ - NOTICE.txt
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+ cancel-in-progress: true
+
+permissions:
+ contents: read
+
+jobs:
+ dep-check:
+ if: github.repository == 'apache/camel'
+ name: Dependency Analysis (non-blocking)
+ runs-on: ubuntu-latest
+ continue-on-error: true
+ steps:
+ - name: Checkout
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ ref: ${{ github.event.pull_request.head.sha }}
+ fetch-depth: 0
+
+ - name: Set up JDK 21
+ uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+ with:
+ distribution: 'temurin'
Review Comment:
All 12 other `setup-java` usages in `.github/workflows` pin v6.0.0; Dependabot will otherwise open a bump PR right away.
```suggestion
uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
```
##########
.github/workflows/dep-check.yml:
##########
@@ -0,0 +1,75 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: 'Dependency Analysis'
+
+on:
+ pull_request:
+ branches:
+ - main
+ paths-ignore:
+ - .claude-plugin/**
+ - .idea/**
+ - .github/**
+ - .oss-ai-helper-rules/**
+ - AGENTS.md
+ - README.md
+ - SECURITY.md
+ - Jenkinsfile
+ - Jenkinsfile.*
+ - NOTICE.txt
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+ cancel-in-progress: true
+
+permissions:
+ contents: read
+
+jobs:
+ dep-check:
+ if: github.repository == 'apache/camel'
+ name: Dependency Analysis (non-blocking)
+ runs-on: ubuntu-latest
+ continue-on-error: true
+ steps:
+ - name: Checkout
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ ref: ${{ github.event.pull_request.head.sha }}
+ fetch-depth: 0
+
+ - name: Set up JDK 21
+ uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+ with:
+ distribution: 'temurin'
+ java-version: '21'
+ cache: 'maven'
+
+ - name: Run dependency analysis
+ run: |
+ mvn verify -Pdep-check -DskipTests -Dlicense.skip -Dquickly \
+ --no-transfer-progress --batch-mode -q \
+ 2>&1 | tee dep-check-output.txt || true
Review Comment:
Two things here:
- `-q` sets Maven's log level to ERROR, so the `[WARNING] Used undeclared dependencies found:` lines from `analyze-only` never reach `dep-check-output.txt`. Verified on `core/camel-util`: 0 findings with `-q`, the expected junit findings without it.
- `|| true` hides genuine `BUILD FAILURE`s (which is how the `legal.xml` failure went unnoticed). Dependency warnings are already non-blocking via `failOnWarning=false`, and `continue-on-error: true` keeps the job from blocking the PR — so let the step itself go red when Maven fails.
```suggestion
mvn verify -Pdep-check -DskipTests -Dlicense.skip -Dquickly \
--no-transfer-progress --batch-mode \
2>&1 | tee dep-check-output.txt
```
##########
pom.xml:
##########
@@ -992,6 +994,43 @@
</pluginRepository>
</pluginRepositories>
</profile>
+ <profile>
+ <!--
+ Opt-in dependency analysis profile.
+ Usage: mvn verify -Pdep-check [-DfailOnWarning=true]
+ Runs maven-dependency-plugin:analyze on every module and reports
+ used-undeclared / unused-declared dependencies. Non-blocking by
+ default (failOnWarning=false); set -DfailOnWarning=true to enforce.
+ -->
+ <id>dep-check</id>
+ <build>
+ <plugins>
+ <plugin>
+ <groupId>org.apache.maven.plugins</groupId>
+ <artifactId>maven-dependency-plugin</artifactId>
+ <executions>
+ <execution>
+ <id>dep-analyze</id>
+ <goals>
+ <goal>analyze-only</goal>
+ </goals>
+ <phase>verify</phase>
+ <configuration>
+ <failOnWarning>${failOnWarning}</failOnWarning>
+ <outputXML>true</outputXML>
+ <ignoredUnusedDeclaredDependencies>
+ <!-- Logging implementations are runtime deps intentionally declared at compile scope -->
+ <ignoredUnusedDeclaredDependency>org.apache.logging.log4j:log4j-slf4j2-impl</ignoredUnusedDeclaredDependency>
+ <ignoredUnusedDeclaredDependency>org.apache.logging.log4j:log4j-core</ignoredUnusedDeclaredDependency>
+ </ignoredUnusedDeclaredDependencies>
Review Comment:
Suggest also ignoring the JUnit aggregator/api pair, otherwise nearly every module in the reactor gets flagged twice (`parent/pom.xml` declares `junit-jupiter`, code compiles against `junit-jupiter-api`):
```suggestion
<ignoredUnusedDeclaredDependencies>
<!-- Logging implementations are runtime deps intentionally declared at compile scope -->
<ignoredUnusedDeclaredDependency>org.apache.logging.log4j:log4j-slf4j2-impl</ignoredUnusedDeclaredDependency>
<ignoredUnusedDeclaredDependency>org.apache.logging.log4j:log4j-core</ignoredUnusedDeclaredDependency>
<!-- JUnit aggregator is declared in parent; code compiles against junit-jupiter-api -->
<ignoredUnusedDeclaredDependency>org.junit.jupiter:junit-jupiter</ignoredUnusedDeclaredDependency>
</ignoredUnusedDeclaredDependencies>
<ignoredUsedUndeclaredDependencies>
<ignoredUsedUndeclaredDependency>org.junit.jupiter:junit-jupiter-api</ignoredUsedUndeclaredDependency>
</ignoredUsedUndeclaredDependencies>
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-22967: Add dep-check profile for maven-dependency-plugin:analyze [camel]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on PR #26330:
URL: https://github.com/apache/camel/pull/26330#issuecomment-5700970631
Thanks for this PR! I wanted to bring up an alternative worth considering before we wire in `maven-dependency-plugin:analyze` — [maveniverse/pilot](https://github.com/maveniverse/pilot) (`pilot:dependencies`) covers the same ground (used-undeclared, unused-declared) but uses bytecode-level analysis rather than the class-index heuristics that `dependency:analyze` relies on. This tends to produce significantly fewer false positives on a large multi-module project like Camel.
The mojo supports three actions:
- `report` — prints findings, always exits 0 (safe to add to CI as a non-blocking check)
- `check` — same output, exits non-zero if issues are found (enforcing gate)
- `fix` — modifies pom.xml in-place to apply suggested fixes
Before committing to either tool at scale, it would be worth doing a dry run across the full reactor to see what each one actually reports on Camel. A `check` pass with pilot (`action=check`) would let us see the full picture without modifying anything — and we'd quickly learn whether the results are actionable or full of noise.
Once there's confidence in the output quality, we could run `fix` to apply the bulk of the changes and then use `check` as the CI gate going forward.
Worth exploring before landing the `dep-check` profile?
_Guillaume Nodet_
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-22967: Add dep-check profile using pilot:dependencies [camel]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet merged PR #26330:
URL: https://github.com/apache/camel/pull/26330
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-22967: Add dep-check profile for maven-dependency-plugin:analyze [camel]
Posted by "gnodet-bot (via GitHub)" <gi...@apache.org>.
gnodet-bot commented on code in PR #26330:
URL: https://github.com/apache/camel/pull/26330#discussion_r3988583956
##########
.github/workflows/dep-check.yml:
##########
@@ -0,0 +1,75 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: 'Dependency Analysis'
+
+on:
+ pull_request:
+ branches:
+ - main
+ paths-ignore:
+ - .claude-plugin/**
+ - .idea/**
+ - .github/**
+ - .oss-ai-helper-rules/**
+ - AGENTS.md
+ - README.md
+ - SECURITY.md
+ - Jenkinsfile
+ - Jenkinsfile.*
+ - NOTICE.txt
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+ cancel-in-progress: true
+
+permissions:
+ contents: read
+
+jobs:
+ dep-check:
+ if: github.repository == 'apache/camel'
+ name: Dependency Analysis (non-blocking)
+ runs-on: ubuntu-latest
+ continue-on-error: true
+ steps:
+ - name: Checkout
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ ref: ${{ github.event.pull_request.head.sha }}
+ fetch-depth: 0
+
+ - name: Set up JDK 21
+ uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+ with:
+ distribution: 'temurin'
+ java-version: '21'
+ cache: 'maven'
+
+ - name: Run dependency analysis
+ run: |
+ mvn verify -Pdep-check -DskipTests -Dlicense.skip -Dquickly \
+ --no-transfer-progress --batch-mode -q \
+ 2>&1 | tee dep-check-output.txt || true
Review Comment:
⚠️ **`-q` suppresses the report:** Maven's `-q` (quiet) flag hides `[WARNING]` output. Since `dependency:analyze-only` reports used-undeclared/unused-declared findings at WARNING level (when `failOnWarning=false`), the captured `dep-check-output.txt` will be effectively empty — defeating the purpose of the artifact upload.
Drop `-q` or replace it with `-e` (errors only still shows warnings in this context):
```suggestion
mvn verify -Pdep-check -DskipTests -Dlicense.skip -Dquickly \
--no-transfer-progress --batch-mode \
2>&1 | tee dep-check-output.txt || true
```
##########
.github/workflows/dep-check.yml:
##########
@@ -0,0 +1,75 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: 'Dependency Analysis'
+
+on:
+ pull_request:
+ branches:
+ - main
+ paths-ignore:
+ - .claude-plugin/**
+ - .idea/**
+ - .github/**
+ - .oss-ai-helper-rules/**
+ - AGENTS.md
+ - README.md
+ - SECURITY.md
+ - Jenkinsfile
+ - Jenkinsfile.*
+ - NOTICE.txt
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+ cancel-in-progress: true
+
+permissions:
+ contents: read
+
+jobs:
+ dep-check:
+ if: github.repository == 'apache/camel'
+ name: Dependency Analysis (non-blocking)
+ runs-on: ubuntu-latest
+ continue-on-error: true
+ steps:
+ - name: Checkout
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ ref: ${{ github.event.pull_request.head.sha }}
+ fetch-depth: 0
+
+ - name: Set up JDK 21
+ uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+ with:
+ distribution: 'temurin'
Review Comment:
⚠️ **Version mismatch:** All 9 existing workflows in the repo pin `actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0`. This uses v4.7.1 — two major versions behind.
```suggestion
uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-22967: Add dep-check profile using pilot:dependencies [camel]
Posted by "gnodet (via GitHub)" <gi...@apache.org>.
gnodet commented on code in PR #26330:
URL: https://github.com/apache/camel/pull/26330#discussion_r4060308768
##########
.github/workflows/dep-check.yml:
##########
@@ -0,0 +1,88 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: 'Dependency Analysis'
+
+on:
+ pull_request:
+ branches:
+ - main
+ paths-ignore:
+ - .claude-plugin/**
+ - .idea/**
+ - .github/**
+ - .oss-ai-helper-rules/**
+ - AGENTS.md
+ - README.md
+ - SECURITY.md
+ - Jenkinsfile
+ - Jenkinsfile.*
+ - NOTICE.txt
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+ cancel-in-progress: true
+
+permissions:
+ contents: read
+
+jobs:
+ dep-check:
+ if: github.repository == 'apache/camel'
+ name: Dependency Analysis (non-blocking)
+ runs-on: ubuntu-latest
+ continue-on-error: true
+ steps:
+ - name: Checkout
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ ref: ${{ github.event.pull_request.head.sha }}
+ fetch-depth: 1
+
+ - name: Set up JDK 21
+ uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+ with:
+ distribution: 'temurin'
+ java-version: '21'
+ cache: 'maven'
+
+ - name: Compile (test-compile for accurate test-scope analysis)
+ run: |
+ # camel-spring-xml is excluded: it unpacks SNAPSHOT source JARs (camel-api:sources, etc.)
+ # during process-resources, which are not available in a clean CI checkout without a
+ # prior mvn install. The XSD it generates is pre-committed, so skipping it here is safe.
+ # camel-test-spring-junit6 is excluded: it has a compile dependency on camel-spring-xml,
+ # which is not available in a clean checkout without a prior mvn install.
+ mvn test-compile -Pdep-check -Dlicense.skip -Dquickly \
+ --pl '!components/camel-spring-parent/camel-spring-xml,!components/camel-test/camel-test-spring-junit6' \
+ --no-transfer-progress --batch-mode -q
+
+ - name: Run dependency analysis
+ run: |
+ mvn eu.maveniverse.maven.plugins:pilot-plugin:0.4.0:dependencies \
+ -Pdep-check -Dlicense.skip \
Review Comment:
Fixed in ef0b26328bba: added a comment in `dep-check.yml` job-level `env` block pointing to the two sibling locations (pom.xml <pluginManagement> and building.adoc) that need updating when the version changes.
##########
.github/workflows/dep-check.yml:
##########
@@ -0,0 +1,94 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: 'Dependency Analysis'
+
+on:
+ pull_request:
+ branches:
+ - main
+ paths-ignore:
+ - .claude-plugin/**
+ - .idea/**
+ - .github/**
+ - .oss-ai-helper-rules/**
+ - AGENTS.md
+ - README.md
+ - SECURITY.md
+ - Jenkinsfile
+ - Jenkinsfile.*
+ - NOTICE.txt
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+ cancel-in-progress: true
+
+permissions:
+ contents: read
+
+jobs:
+ dep-check:
+ if: github.repository == 'apache/camel'
+ name: Dependency Analysis (non-blocking)
+ runs-on: ubuntu-latest
+ continue-on-error: true
+ steps:
+ - name: Checkout
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ ref: ${{ github.event.pull_request.head.sha }}
+ fetch-depth: 1
+
+ - name: Set up JDK 21
+ uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+ with:
+ distribution: 'temurin'
+ java-version: '21'
+ cache: 'maven'
+
+ - name: Compile (test-compile for accurate test-scope analysis)
+ run: |
+ # camel-spring-xml is excluded: it unpacks SNAPSHOT source JARs (camel-api:sources, etc.)
+ # during process-resources, which are not available in a clean CI checkout without a
+ # prior mvn install. The XSD it generates is pre-committed, so skipping it here is safe.
+ # camel-test-spring-junit6 is excluded: it has a compile dependency on camel-spring-xml,
+ # which is not available in a clean checkout without a prior mvn install.
+ # camel-spring-main is excluded: it has a test dependency on camel-test-spring-junit6,
+ # which is excluded above and therefore not available in a clean checkout.
+ # camel-maven-plugin, catalog/camel-allcomponents, coverage are excluded: they have a
+ # compile dependency on camel-spring-main, which is excluded above.
+ # camel-hazelcast, camel-mail, camel-consul, camel-zookeeper are excluded: they have a
+ # test dependency on camel-spring-main, which is not resolvable in a clean checkout.
+ mvn test-compile -Pdep-check -Dlicense.skip -Dquickly \
+ --pl '!components/camel-spring-parent/camel-spring-xml,!components/camel-test/camel-test-spring-junit6,!components/camel-spring-parent/camel-spring-main,!tooling/maven/camel-maven-plugin,!catalog/camel-allcomponents,!coverage,!components/camel-hazelcast,!components/camel-mail,!components/camel-consul,!components/camel-zookeeper' \
+ --no-transfer-progress --batch-mode -q
+
+ - name: Run dependency analysis
+ run: |
+ mvn eu.maveniverse.maven.plugins:pilot-plugin:0.4.0:dependencies \
+ -Pdep-check -Dlicense.skip \
+ --pl '!components/camel-spring-parent/camel-spring-xml,!components/camel-test/camel-test-spring-junit6,!components/camel-spring-parent/camel-spring-main,!tooling/maven/camel-maven-plugin,!catalog/camel-allcomponents,!coverage,!components/camel-hazelcast,!components/camel-mail,!components/camel-consul,!components/camel-zookeeper' \
+ --no-transfer-progress --batch-mode \
+ 2>&1 | tee dep-check-output.txt
+
+ - name: Upload dependency analysis report
+ if: always()
+ uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
Review Comment:
Fixed in ef0b26328bba: extracted to job-level `EXCLUDED_MODULES` env var; both steps now reference `$EXCLUDED_MODULES`.
##########
.github/workflows/dep-check.yml:
##########
@@ -0,0 +1,94 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: 'Dependency Analysis'
+
+on:
+ pull_request:
+ branches:
+ - main
+ paths-ignore:
+ - .claude-plugin/**
+ - .idea/**
+ - .github/**
+ - .oss-ai-helper-rules/**
+ - AGENTS.md
+ - README.md
+ - SECURITY.md
+ - Jenkinsfile
+ - Jenkinsfile.*
+ - NOTICE.txt
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+ cancel-in-progress: true
+
+permissions:
+ contents: read
+
+jobs:
+ dep-check:
+ if: github.repository == 'apache/camel'
+ name: Dependency Analysis (non-blocking)
+ runs-on: ubuntu-latest
+ continue-on-error: true
+ steps:
+ - name: Checkout
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ ref: ${{ github.event.pull_request.head.sha }}
+ fetch-depth: 1
+
+ - name: Set up JDK 21
+ uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0
+ with:
+ distribution: 'temurin'
+ java-version: '21'
+ cache: 'maven'
+
+ - name: Compile (test-compile for accurate test-scope analysis)
+ run: |
+ # camel-spring-xml is excluded: it unpacks SNAPSHOT source JARs (camel-api:sources, etc.)
+ # during process-resources, which are not available in a clean CI checkout without a
+ # prior mvn install. The XSD it generates is pre-committed, so skipping it here is safe.
+ # camel-test-spring-junit6 is excluded: it has a compile dependency on camel-spring-xml,
+ # which is not available in a clean checkout without a prior mvn install.
+ # camel-spring-main is excluded: it has a test dependency on camel-test-spring-junit6,
+ # which is excluded above and therefore not available in a clean checkout.
+ # camel-maven-plugin, catalog/camel-allcomponents, coverage are excluded: they have a
+ # compile dependency on camel-spring-main, which is excluded above.
+ # camel-hazelcast, camel-mail, camel-consul, camel-zookeeper are excluded: they have a
+ # test dependency on camel-spring-main, which is not resolvable in a clean checkout.
+ mvn test-compile -Pdep-check -Dlicense.skip -Dquickly \
+ --pl '!components/camel-spring-parent/camel-spring-xml,!components/camel-test/camel-test-spring-junit6,!components/camel-spring-parent/camel-spring-main,!tooling/maven/camel-maven-plugin,!catalog/camel-allcomponents,!coverage,!components/camel-hazelcast,!components/camel-mail,!components/camel-consul,!components/camel-zookeeper' \
+ --no-transfer-progress --batch-mode -q
+
+ - name: Run dependency analysis
+ run: |
+ mvn eu.maveniverse.maven.plugins:pilot-plugin:0.4.0:dependencies \
+ -Pdep-check -Dlicense.skip \
+ --pl '!components/camel-spring-parent/camel-spring-xml,!components/camel-test/camel-test-spring-junit6,!components/camel-spring-parent/camel-spring-main,!tooling/maven/camel-maven-plugin,!catalog/camel-allcomponents,!coverage,!components/camel-hazelcast,!components/camel-mail,!components/camel-consul,!components/camel-zookeeper' \
+ --no-transfer-progress --batch-mode \
+ 2>&1 | tee dep-check-output.txt
+
+ - name: Upload dependency analysis report
Review Comment:
Fixed in ef0b26328bba: added a comment in the job-level `env` block pointing to the two other locations (pom.xml `<pluginManagement>` and `building.adoc`) that need updating on a pilot release.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-22967: Add dep-check profile for maven-dependency-plugin:analyze [camel]
Posted by "gnodet-bot (via GitHub)" <gi...@apache.org>.
gnodet-bot commented on code in PR #26330:
URL: https://github.com/apache/camel/pull/26330#discussion_r3988591949
##########
.github/workflows/dep-check.yml:
##########
@@ -0,0 +1,75 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: 'Dependency Analysis'
+
+on:
+ pull_request:
+ branches:
+ - main
+ paths-ignore:
+ - .claude-plugin/**
+ - .idea/**
+ - .github/**
+ - .oss-ai-helper-rules/**
+ - AGENTS.md
+ - README.md
+ - SECURITY.md
+ - Jenkinsfile
+ - Jenkinsfile.*
+ - NOTICE.txt
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+ cancel-in-progress: true
+
+permissions:
+ contents: read
+
+jobs:
+ dep-check:
+ if: github.repository == 'apache/camel'
+ name: Dependency Analysis (non-blocking)
+ runs-on: ubuntu-latest
+ continue-on-error: true
+ steps:
+ - name: Checkout
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ ref: ${{ github.event.pull_request.head.sha }}
+ fetch-depth: 0
+
+ - name: Set up JDK 21
Review Comment:
💡 **Nit:** `fetch-depth: 0` pulls the entire git history, which is unnecessary for `dependency:analyze-only` (it only needs compiled classes + POMs). For a repo this size, this adds non-trivial checkout time. The default (`fetch-depth: 1`) is sufficient.
```suggestion
fetch-depth: 1
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-22967: Add dep-check profile for maven-dependency-plugin:analyze [camel]
Posted by "github-actions[bot] (via GitHub)" <gi...@apache.org>.
github-actions[bot] commented on PR #26330:
URL: https://github.com/apache/camel/pull/26330#issuecomment-5633554816
:star2: Thank you for your contribution to the Apache Camel project! :star2:
:robot: CI automation will test this PR automatically.
:camel: Apache Camel Committers, please review the following items:
* First-time contributors **require MANUAL approval** for the GitHub Actions to run
* You can use the command `/component-test (camel-)component-name1 (camel-)component-name2..` to request a test from the test bot although they are normally detected and executed by CI.
* You can label PRs using `skip-tests` and `test-dependents` to fine-tune the checks executed by this PR.
* Build and test logs are available in the summary page. **Only** [Apache Camel committers](https://camel.apache.org/community/team/#committers) have access to the summary.
:warning: Be careful when sharing logs. Review their contents before sharing them publicly.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org
Re: [PR] CAMEL-22967: Add dep-check profile using pilot:dependencies [camel]
Posted by "gnodet-bot (via GitHub)" <gi...@apache.org>.
gnodet-bot commented on code in PR #26330:
URL: https://github.com/apache/camel/pull/26330#discussion_r4061556162
##########
.github/workflows/dep-check.yml:
##########
@@ -0,0 +1,126 @@
+#
+# Licensed to the Apache Software Foundation (ASF) under one or more
+# contributor license agreements. See the NOTICE file distributed with
+# this work for additional information regarding copyright ownership.
+# The ASF licenses this file to You under the Apache License, Version 2.0
+# (the "License"); you may not use this file except in compliance with
+# the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+name: 'Dependency Analysis'
+
+on:
+ pull_request:
+ branches:
+ - main
+ paths-ignore:
+ - .claude-plugin/**
+ - .idea/**
+ - .github/**
+ - .oss-ai-helper-rules/**
+ - AGENTS.md
+ - README.md
+ - SECURITY.md
+ - Jenkinsfile
+ - Jenkinsfile.*
+ - NOTICE.txt
+
+concurrency:
+ group: ${{ github.workflow }}-${{ github.event.pull_request.number || github.ref }}
+ cancel-in-progress: true
+
+permissions:
+ contents: read
+
+jobs:
+ dep-check:
+ if: github.repository == 'apache/camel'
+ name: Dependency Analysis (non-blocking)
+ runs-on: ubuntu-latest
+ continue-on-error: true
+ env:
+ # Modules excluded from analysis — kept in one place so both the compile and analysis steps stay in sync.
+ # See comments in the compile step below for the exclusion rationale.
+ # Also update docs/main/modules/contributing/pages/building.adoc
+ # when changing the pilot-plugin version (0.4.0 below).
+ EXCLUDED_MODULES: '!bom,!components/camel-spring-parent/camel-spring-xml,!components/camel-test/camel-test-spring-junit5,!components/camel-test/camel-test-spring-junit6'
+ steps:
+ - name: Checkout
+ uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+ with:
+ ref: ${{ github.event.pull_request.head.sha }}
Review Comment:
💡 **Nit — pom.xml sync reference dropped:** The comment added in ef0b26 to track all three version locations was narrowed to only mention `building.adoc`. The `pom.xml` `<pluginManagement>` entry (version 0.4.0 is still there in the diff) is also a sync point: when invoking via the short form `mvn pilot:dependencies -Pdep-check` (no explicit `groupId:artifactId:version` qualifier), Maven resolves the version from pluginManagement. A developer using the short form locally would silently get the outdated version if it drifts.
```suggestion
# Also update pom.xml <pluginManagement> and docs/main/modules/contributing/pages/building.adoc
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: commits-unsubscribe@camel.apache.org
For queries about this service, please contact Infrastructure at:
users@infra.apache.org