ctubbsii commented on PR #284: URL: https://github.com/apache/maven-apache-parent/pull/284#issuecomment-2583864816
> SonarQube is supported and encouraged by the ASF (https://infra.apache.org/build-supported-services.html#sonarcloud), Supported, yes. Encouraged... I don't know where you get that. INFRA supports integrations with lots of 3rd party tools. It's up to the individual PMC to decide whether to use them for their projects. INFRA tends to be neutral on such matters. > and part of it is exposing [coverage metrics](https://docs.sonarsource.com/sonarqube-cloud/enriching/test-coverage/overview/). This part requires jacoco-m-p, so this doesn't make it an arbitrary 3rd party plugin, but one with a close relation to ASF projects. That is one of many optional analysis services of SonarQube. That doesn't make imply any close relation to ASF projects. It's just an option that SonarQube provides. DockerHub is another similar service that INFRA supports, and there exist maven plugins that help facilitate features of DockerHub as well, but that doesn't establish any stronger relationship. Even if this plugin is required for that particular feature at SonarQube, it doesn't mean that projects want to use SonarQube, or this plugin, or if they do use SonarQube, that they also want to use that particular feature at SonarQube that requires this plugin. > Looking at https://sonarcloud.io/organizations/apache/projects exposes 340 projects (not sure how many leverage Maven and the ASF parent POM), but for me this number qualifies to make this part of the ASF parent POM. I started looking to find out, and of the first half dozen I looked at before I stopped, I saw that some had jacoco-m-p configured to be disabled, or used custom configuration that would conflict with configuration in the parent POM, and most of the rest were gradle or sbt that wouldn't be affected by this parent POM. I stopped looking at the rest, though, because it doesn't really matter. This change adds jacoco to all projects that use this parent POM, not just the subset of projects who use this parent POM who also use SonarQube and who also want to use that particular optional feature of SonarQube and who actually look at those reports. It's up to individual projects whether to make use of SonarQube, or jacoco, and these aren't satisfying some universal use case or ASF-requirement. Overall, I just don't think the argument to add it is all that convincing. This plugin, and the use cases it's supporting seems too niche, and more likely to cause problems than to solve them. So, I still would strongly advocate against adding this. However, if it is added, then I'd suggest the following changes: 1. Manage only the version in the pluginManagement section outside the profile 2. Put the executions in the profile, so it doesn't automatically apply to users who don't activate the profile 3. Give the profile a more unique name that is less likely to conflict with user's own profile names But I still don't think it should be added. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: issues-unsubscr...@maven.apache.org For queries about this service, please contact Infrastructure at: us...@infra.apache.org
