Skip to content

Commit 574bbd1

Browse files
chrisdutzchrisdutz
authored
Feature/dependency check (#13587)
1 parent 734786f commit 574bbd1

File tree

5 files changed

+412
-0
lines changed

5 files changed

+412
-0
lines changed

‎.github/workflows/dependency-check.yml

+59
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,59 @@
1+
# This workflow will check if dependencies have changed (adding new dependencies or removing existing ones)
2+
3+
name: Dependency Check
4+
5+
on:
6+
push:
7+
branches:
8+
- master
9+
- 'rel/*'
10+
- "rc/*"
11+
paths-ignore:
12+
- 'docs/**'
13+
- 'site/**'
14+
pull_request:
15+
branches:
16+
- master
17+
- 'rel/*'
18+
- "rc/*"
19+
paths-ignore:
20+
- 'docs/**'
21+
- 'site/**'
22+
# allow manually run the action:
23+
workflow_dispatch:
24+
25+
concurrency:
26+
group: ${{ github.workflow }}-${{ github.ref }}
27+
cancel-in-progress: true
28+
29+
env:
30+
MAVEN_OPTS: -Dhttp.keepAlive=false -Dmaven.wagon.http.pool=false -Dmaven.wagon.http.retryHandler.class=standard -Dmaven.wagon.http.retryHandler.count=3
31+
MAVEN_ARGS: --batch-mode --no-transfer-progress
32+
DEVELOCITY_ACCESS_KEY: ${{ secrets.GE_ACCESS_TOKEN }}
33+
34+
jobs:
35+
dependency-check:
36+
strategy:
37+
fail-fast: false
38+
max-parallel: 15
39+
matrix:
40+
java: [ 17 ]
41+
os: [ ubuntu-latest ]
42+
runs-on: ${{ matrix.os }}
43+
44+
steps:
45+
- uses: actions/checkout@v4
46+
- name: Set up JDK ${{ matrix.java }}
47+
uses: actions/setup-java@v4
48+
with:
49+
distribution: corretto
50+
java-version: ${{ matrix.java }}
51+
- name: Cache Maven packages
52+
uses: actions/cache@v4
53+
with:
54+
path: ~/.m2
55+
key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }}
56+
restore-keys: ${{ runner.os }}-m2-
57+
- name: Do the dependency check
58+
shell: bash
59+
run: mvn verify -Dmaven.test.skip=true -DdependencyCheck.skip=false -Dmdep.analyze.skip=true

‎dependencies.json

+167
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,167 @@
1+
{
2+
"dependencies": [
3+
"cglib:cglib",
4+
"ch.qos.logback:logback-classic",
5+
"ch.qos.logback:logback-core",
6+
"ch.qos.reload4j:reload4j",
7+
"com.bugsnag:bugsnag",
8+
"com.digitalpetri.fsm:strict-machine",
9+
"com.digitalpetri.netty:netty-channel-fsm",
10+
"com.fasterxml.jackson.core:jackson-annotations",
11+
"com.fasterxml.jackson.core:jackson-core",
12+
"com.fasterxml.jackson.core:jackson-databind",
13+
"com.fasterxml.jackson.dataformat:jackson-dataformat-yaml",
14+
"com.fasterxml.jackson.datatype:jackson-datatype-jsr310",
15+
"com.fasterxml.jackson.jaxrs:jackson-jaxrs-base",
16+
"com.fasterxml.jackson.jaxrs:jackson-jaxrs-json-provider",
17+
"com.fasterxml.jackson.module:jackson-module-jaxb-annotations",
18+
"com.github.ben-manes.caffeine:caffeine",
19+
"com.github.luben:zstd-jni",
20+
"com.github.stephenc.jcip:jcip-annotations",
21+
"com.github.wendykierp:JTransforms",
22+
"com.google.code.findbugs:jsr305",
23+
"com.google.code.gson:gson",
24+
"com.google.errorprone:error_prone_annotations",
25+
"com.google.guava:failureaccess",
26+
"com.google.guava:guava",
27+
"com.google.guava:listenablefuture",
28+
"com.google.j2objc:j2objc-annotations",
29+
"com.h2database:h2-mvstore",
30+
"com.librato.metrics:librato-java",
31+
"com.librato.metrics:metrics-librato",
32+
"com.lmax:disruptor",
33+
"com.nimbusds:content-type",
34+
"com.nimbusds:lang-tag",
35+
"com.nimbusds:nimbus-jose-jwt",
36+
"com.nimbusds:oauth2-oidc-sdk",
37+
"com.sun.istack:istack-commons-runtime",
38+
"com.zaxxer:HikariCP",
39+
"commons-cli:commons-cli",
40+
"commons-codec:commons-codec",
41+
"commons-io:commons-io",
42+
"commons-logging:commons-logging",
43+
"io.airlift:airline",
44+
"io.airlift:concurrent",
45+
"io.airlift:log",
46+
"io.airlift:units",
47+
"io.dropwizard.metrics:metrics-core",
48+
"io.dropwizard.metrics:metrics-jvm",
49+
"io.jsonwebtoken:jjwt-api",
50+
"io.micrometer:micrometer-commons",
51+
"io.micrometer:micrometer-core",
52+
"io.micrometer:micrometer-observation",
53+
"io.moquette:moquette-broker",
54+
"io.netty:netty-buffer",
55+
"io.netty:netty-codec",
56+
"io.netty:netty-codec-dns",
57+
"io.netty:netty-codec-http",
58+
"io.netty:netty-codec-http2",
59+
"io.netty:netty-codec-mqtt",
60+
"io.netty:netty-codec-socks",
61+
"io.netty:netty-common",
62+
"io.netty:netty-handler",
63+
"io.netty:netty-handler-proxy",
64+
"io.netty:netty-resolver",
65+
"io.netty:netty-resolver-dns",
66+
"io.netty:netty-resolver-dns-classes-macos",
67+
"io.netty:netty-resolver-dns-native-macos",
68+
"io.netty:netty-transport",
69+
"io.netty:netty-transport-classes-epoll",
70+
"io.netty:netty-transport-native-epoll",
71+
"io.netty:netty-transport-native-unix-common",
72+
"io.projectreactor:reactor-core",
73+
"io.projectreactor.netty:reactor-netty-core",
74+
"io.projectreactor.netty:reactor-netty-http",
75+
"io.swagger:swagger-annotations",
76+
"io.swagger:swagger-core",
77+
"io.swagger:swagger-jaxrs",
78+
"io.swagger:swagger-models",
79+
"jakarta.activation:jakarta.activation-api",
80+
"jakarta.annotation:jakarta.annotation-api",
81+
"jakarta.servlet:jakarta.servlet-api",
82+
"jakarta.validation:jakarta.validation-api",
83+
"jakarta.ws.rs:jakarta.ws.rs-api",
84+
"jakarta.xml.bind:jakarta.xml.bind-api",
85+
"net.java.dev.jna:jna",
86+
"net.minidev:accessors-smart",
87+
"net.minidev:json-smart",
88+
"org.antlr:antlr4-runtime",
89+
"org.apache.commons:commons-collections4",
90+
"org.apache.commons:commons-csv",
91+
"org.apache.commons:commons-jexl3",
92+
"org.apache.commons:commons-lang3",
93+
"org.apache.commons:commons-math3",
94+
"org.apache.commons:commons-pool2",
95+
"org.apache.httpcomponents:httpclient",
96+
"org.apache.httpcomponents:httpcore",
97+
"org.apache.ratis:ratis-client",
98+
"org.apache.ratis:ratis-common",
99+
"org.apache.ratis:ratis-grpc",
100+
"org.apache.ratis:ratis-metrics-api",
101+
"org.apache.ratis:ratis-proto",
102+
"org.apache.ratis:ratis-server",
103+
"org.apache.ratis:ratis-server-api",
104+
"org.apache.ratis:ratis-thirdparty-misc",
105+
"org.apache.thrift:libthrift",
106+
"org.apache.tsfile:common",
107+
"org.apache.tsfile:tsfile",
108+
"org.bouncycastle:bcpkix-jdk18on",
109+
"org.bouncycastle:bcprov-jdk18on",
110+
"org.bouncycastle:bcutil-jdk18on",
111+
"org.checkerframework:checker-qual",
112+
"org.eclipse.collections:eclipse-collections",
113+
"org.eclipse.collections:eclipse-collections-api",
114+
"org.eclipse.jetty:jetty-http",
115+
"org.eclipse.jetty:jetty-io",
116+
"org.eclipse.jetty:jetty-security",
117+
"org.eclipse.jetty:jetty-server",
118+
"org.eclipse.jetty:jetty-servlet",
119+
"org.eclipse.jetty:jetty-util",
120+
"org.eclipse.jetty:jetty-util-ajax",
121+
"org.eclipse.milo:bsd-core",
122+
"org.eclipse.milo:bsd-generator",
123+
"org.eclipse.milo:sdk-client",
124+
"org.eclipse.milo:sdk-core",
125+
"org.eclipse.milo:sdk-server",
126+
"org.eclipse.milo:stack-client",
127+
"org.eclipse.milo:stack-core",
128+
"org.eclipse.milo:stack-server",
129+
"org.fusesource.hawtbuf:hawtbuf",
130+
"org.fusesource.hawtdispatch:hawtdispatch",
131+
"org.fusesource.hawtdispatch:hawtdispatch-transport",
132+
"org.fusesource.mqtt-client:mqtt-client",
133+
"org.glassfish.hk2:hk2-api",
134+
"org.glassfish.hk2:hk2-locator",
135+
"org.glassfish.hk2:hk2-utils",
136+
"org.glassfish.hk2:osgi-resource-locator",
137+
"org.glassfish.hk2.external:aopalliance-repackaged",
138+
"org.glassfish.hk2.external:jakarta.inject",
139+
"org.glassfish.jaxb:jaxb-runtime",
140+
"org.glassfish.jaxb:txw2",
141+
"org.glassfish.jersey.containers:jersey-container-servlet-core",
142+
"org.glassfish.jersey.core:jersey-client",
143+
"org.glassfish.jersey.core:jersey-common",
144+
"org.glassfish.jersey.core:jersey-server",
145+
"org.glassfish.jersey.inject:jersey-hk2",
146+
"org.glassfish.jersey.media:jersey-media-multipart",
147+
"org.hdrhistogram:HdrHistogram",
148+
"org.java-websocket:Java-WebSocket",
149+
"org.javassist:javassist",
150+
"org.jline:jline",
151+
"org.jvnet.mimepull:mimepull",
152+
"org.latencyutils:LatencyUtils",
153+
"org.lz4:lz4-java",
154+
"org.ops4j.pax.jdbc:pax-jdbc-common",
155+
"org.osgi:osgi.cmpn",
156+
"org.osgi:osgi.core",
157+
"org.ow2.asm:asm",
158+
"org.reactivestreams:reactive-streams",
159+
"org.reflections:reflections",
160+
"org.slf4j:slf4j-api",
161+
"org.slf4j:slf4j-reload4j",
162+
"org.tukaani:xz",
163+
"org.xerial.snappy:snappy-java",
164+
"org.yaml:snakeyaml",
165+
"pl.edu.icm:JLargeArrays"
166+
]
167+
}

‎pom.xml

+85
Original file line numberDiff line numberDiff line change
@@ -68,6 +68,7 @@
6868
<commons-pool2.version>2.11.1</commons-pool2.version>
6969
<commons.collections4.version>4.4</commons.collections4.version>
7070
<ctest.skip.tests>false</ctest.skip.tests>
71+
<dependencyCheck.skip>true</dependencyCheck.skip>
7172
<disruptor.version>3.4.4</disruptor.version>
7273
<drill.freemarker.maven.plugin.version>1.21.1</drill.freemarker.maven.plugin.version>
7374
<dropwizard.metrics.version>4.2.19</dropwizard.metrics.version>
@@ -1360,6 +1361,90 @@
13601361
</execution>
13611362
</executions>
13621363
</plugin>
1364+
<!-- Check if we've changed any dependencies being included -->
1365+
<plugin>
1366+
<groupId>org.cyclonedx</groupId>
1367+
<artifactId>cyclonedx-maven-plugin</artifactId>
1368+
<!-- Only run this in the root module of the project -->
1369+
<inherited>false</inherited>
1370+
<configuration>
1371+
<outputName>apache-${project.artifactId}-${project.version}-sbom</outputName>
1372+
</configuration>
1373+
<executions>
1374+
<execution>
1375+
<phase>package</phase>
1376+
<goals>
1377+
<goal>makeAggregateBom</goal>
1378+
</goals>
1379+
</execution>
1380+
</executions>
1381+
</plugin>
1382+
<plugin>
1383+
<groupId>org.codehaus.mojo</groupId>
1384+
<artifactId>xml-maven-plugin</artifactId>
1385+
<version>1.1.0</version>
1386+
<!-- Only run this in the root module of the project -->
1387+
<inherited>false</inherited>
1388+
<executions>
1389+
<execution>
1390+
<phase>package</phase>
1391+
<goals>
1392+
<goal>transform</goal>
1393+
</goals>
1394+
<configuration>
1395+
<transformationSets>
1396+
<transformationSet>
1397+
<dir>${project.basedir}/target/</dir>
1398+
<includes>apache-${project.artifactId}-${project.version}-sbom.xml</includes>
1399+
<stylesheet>src/main/xslt/sbom-filter.xsl</stylesheet>
1400+
<outputDir>${project.basedir}/target/</outputDir>
1401+
<fileMappers>
1402+
<fileMapper implementation="org.codehaus.plexus.components.io.filemappers.FileExtensionMapper">
1403+
<targetExtension>transformed.json</targetExtension>
1404+
</fileMapper>
1405+
</fileMappers>
1406+
</transformationSet>
1407+
</transformationSets>
1408+
</configuration>
1409+
</execution>
1410+
</executions>
1411+
<dependencies>
1412+
<dependency>
1413+
<groupId>net.sf.saxon</groupId>
1414+
<artifactId>Saxon-HE</artifactId>
1415+
<version>12.5</version>
1416+
</dependency>
1417+
</dependencies>
1418+
</plugin>
1419+
<plugin>
1420+
<groupId>org.codehaus.gmaven</groupId>
1421+
<artifactId>groovy-maven-plugin</artifactId>
1422+
<version>2.1.1</version>
1423+
<!-- Only run this in the root module of the project -->
1424+
<inherited>false</inherited>
1425+
<executions>
1426+
<execution>
1427+
<id>compare-with-reference-list</id>
1428+
<phase>verify</phase>
1429+
<goals>
1430+
<goal>execute</goal>
1431+
</goals>
1432+
<configuration>
1433+
<properties>
1434+
<skipDependencyCheck>${dependencyCheck.skip}</skipDependencyCheck>
1435+
</properties>
1436+
<source>src/main/groovy/checkDependencies.groovy</source>
1437+
</configuration>
1438+
</execution>
1439+
</executions>
1440+
<dependencies>
1441+
<dependency>
1442+
<groupId>org.apache.groovy</groupId>
1443+
<artifactId>groovy</artifactId>
1444+
<version>4.0.22</version>
1445+
</dependency>
1446+
</dependencies>
1447+
</plugin>
13631448
</plugins>
13641449
</build>
13651450
<licenses>

‎src/main/groovy/checkDependencies.groovy

+60
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,60 @@
1+
package src.main.groovy
2+
/*
3+
* Licensed to the Apache Software Foundation (ASF) under one
4+
* or more contributor license agreements. See the NOTICE file
5+
* distributed with this work for additional information
6+
* regarding copyright ownership. The ASF licenses this file
7+
* to you under the Apache License, Version 2.0 (the
8+
* "License"); you may not use this file except in compliance
9+
* with the License. You may obtain a copy of the License at
10+
*
11+
* http://www.apache.org/licenses/LICENSE-2.0
12+
*
13+
* Unless required by applicable law or agreed to in writing,
14+
* software distributed under the License is distributed on an
15+
* "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
16+
* KIND, either express or implied. See the License for the
17+
* specific language governing permissions and limitations
18+
* under the License.
19+
*/
20+
21+
import groovy.json.JsonSlurper
22+
23+
if(Boolean.parseBoolean(properties['skipDependencyCheck']).booleanValue()) {
24+
println "Skipping dependency check"
25+
return
26+
}
27+
28+
def jsonSlurper = new JsonSlurper()
29+
30+
var referenceFile = new File(basedir, "dependencies.json")
31+
if(!referenceFile.exists()) {
32+
throw new RuntimeException("Missing Reference: dependencies.json")
33+
}
34+
def referenceJson = jsonSlurper.parse(referenceFile)
35+
36+
var curBuildFile = new File(project.build.directory, "apache-${project.artifactId}-${project.version}-sbom.transformed.json")
37+
if(!curBuildFile.exists()) {
38+
throw new RuntimeException("Missing Build: apache-${project.artifactId}-${project.version}-sbom.transformed.json")
39+
}
40+
def curBuildJson = jsonSlurper.parse(curBuildFile)
41+
42+
def differencesFound = false
43+
referenceJson.dependencies.each {
44+
if(!curBuildJson.dependencies.contains(it)) {
45+
println "current build has removed a dependency: " + it
46+
differencesFound = true
47+
}
48+
}
49+
curBuildJson.dependencies.each {
50+
if(!referenceJson.dependencies.contains(it)) {
51+
println "current build has added a dependency: " + it
52+
differencesFound = true
53+
}
54+
}
55+
56+
if(differencesFound) {
57+
println "Differences were found between the information in ${referenceFile.getPath()} and ${curBuildFile.toPath()}"
58+
println "The simplest fix for this, is to replace the content of ${referenceFile.getPath()} with that of ${curBuildFile.toPath()} and to inspect the diff of the resulting file in your IDE of choice."
59+
throw new RuntimeException("Differences found.")
60+
}

0 commit comments

Comments
 (0)