Aias00 commented on issue #6602:
URL: https://github.com/apache/shenyu/issues/6602#issuecomment-6211156464
Thanks @yangjj-iso — this is an excellent audit, and it changes how we
should land this.
**Decision: staged rollout, not one bundled change.**
**1. #6602 stays scoped to the plugin + version guardrails (hard-fail,
safe).**
Confirmed your setup: the root POM inherits `org.apache:apache:21`, which
already brings an `enforce-maven-version` execution pinned to Maven 3.0.5 (so a
repo-only grep misses it — good catch), and `<java.version>` is `17`. So #6602
will add a repo-owned `maven-enforcer-plugin` execution bound to `validate`
with only the rules that already pass:
- `requireMavenVersion` — `<version>[3.6.3,)</version>` (upgrades the
inherited 3.0.5 floor to match the wrapper)
- `requireJavaVersion` — `<version>[${java.version},)</version>` (17+)
That delivers the build-time guardrail the issue is about, without breaking
any module.
**2. Dependency alignment is tracked separately, not bundled into #6602.**
191/213 projects with violations is a cross-cutting change; folding it in
would make the PR unreviewable and delay the safe win. I've opened #7679 to own
it, seeded with your inventory.
**3. Staged enablement of the dependency rules** (in #7679):
- Stage 1 (transitional): land `dependencyConvergence` +
`requireUpperBoundDeps` in **report-only** mode so drift is visible in CI
without blocking builds.
- Stage 2: align the graph via `<dependencyManagement>`/BOM, module by
module.
- Stage 3: flip both rules to **hard-fail** (globally, or per-module as each
is cleaned).
**4. Warning-only is transitional, not the end state.** Agreed — permanently
leaving the dependency checks non-failing would leave the guardrail incomplete;
the target is hard-fail once the graph is aligned.
If you're happy with this split, would you like to open step 1 (plugin +
version rules only, no dependency rules) as a PR against `master`? Please paste
your `shenyu-common` minimal repro into #7679 as the starting point. Thanks
again for the thorough investigation.
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
