gnodet-bot commented on code in PR #13166:
URL: https://github.com/apache/maven/pull/13166#discussion_r4041969214
##########
impl/maven-core/src/main/resources/org/apache/maven/lifecycle/plugin-versions.properties:
##########
@@ -20,16 +20,16 @@
# POM properties (version.maven-<name>-plugin), making them visible to
Review Comment:
📝 **[NOT ADDRESSED] Stale comment — still references the old
`version.maven-<name>-plugin` naming.**
This comment was flagged in the previous review. The properties were renamed
to `lifecycle.*-plugin` but the header comment still says
`version.maven-<name>-plugin`.
```suggestion
# POM properties (lifecycle.<name>-plugin), making them visible to
```
##########
pom.xml:
##########
@@ -1302,5 +1302,154 @@ under the License.
</plugins>
</build>
</profile>
+ <profile>
+ <!--
+ This profile is NEVER activated during a normal build.
+ It configures versions-maven-plugin to map the version.maven-*-plugin
+ properties (in impl/maven-core/pom.xml) to their corresponding Maven
+ plugin artifacts, enabling:
+
Review Comment:
📝 **Stale comment — property naming doesn't match the actual properties.**
The comment says "map the `version.maven-*-plugin` properties" but those
were renamed to `lifecycle.*-plugin` in this very PR. A reader will be confused
when they look at the `<property>` elements below and see
`lifecycle.clean-plugin`, not `version.maven-clean-plugin`.
```suggestion
It configures versions-maven-plugin to map the lifecycle.*-plugin
properties (in impl/maven-core/pom.xml) to their corresponding Maven
```
##########
.github/workflows/update-lifecycle-plugins.yml:
##########
@@ -0,0 +1,94 @@
+# Licensed to the Apache Software Foundation (ASF) under one
+# or more contributor license agreements. See the NOTICE file
+# distributed with this work for additional information
+# regarding copyright ownership. The ASF licenses this file
+# to you under the Apache License, Version 2.0 (the
+# "License"); you may not use this file except in compliance
+# with the License. You may obtain a copy of the License at
+#
+# http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing,
+# software distributed under the License is distributed on an
+# "AS IS" BASIS, WITHOUT WARRANTIES OR CONDITIONS OF ANY
+# KIND, either express or implied. See the License for the
+# specific language governing permissions and limitations
+# under the License.
+
+name: Update lifecycle plugin versions
+
+on:
+ schedule:
+ # Every Monday at 08:00 UTC
+ - cron: '0 8 * * 1'
+ workflow_dispatch:
+
+permissions:
+ contents: read
+
+jobs:
+ update-lifecycle-plugins:
+ runs-on: ubuntu-latest
+ permissions:
+ contents: write
+ pull-requests: write
+ strategy:
+ fail-fast: false
+ matrix:
+ branch: [master, maven-4.0.x]
+ steps:
+ - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 #
v7.0.1
+ with:
+ ref: ${{ matrix.branch }}
+ persist-credentials: false
+
+ - uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 #
v6.0.1
+ with:
+ java-version: '21'
+ distribution: 'temurin'
+ cache: maven
+
+ - name: Update lifecycle plugin versions
+ run: |
+ mvn -B versions:update-properties \
+ -Pversions-update \
+ -DallowMajorUpdates=false \
+
-DincludeProperties="lifecycle.clean-plugin,lifecycle.compiler-plugin,lifecycle.deploy-plugin,lifecycle.ear-plugin,lifecycle.ejb-plugin,lifecycle.install-plugin,lifecycle.jar-plugin,lifecycle.plugin-plugin,lifecycle.rar-plugin,lifecycle.resources-plugin,lifecycle.site-plugin,lifecycle.surefire-plugin,lifecycle.war-plugin"
\
+ -pl impl/maven-core
+
+ - name: Create Pull Request
+ env:
+ GH_TOKEN: ${{ github.token }}
+ BRANCH: update/lifecycle-plugins-${{ matrix.branch }}
+ BASE_BRANCH: ${{ matrix.branch }}
+ run: |
+ if git diff --quiet impl/maven-core/pom.xml; then
+ echo "No lifecycle plugin version changes detected."
+ exit 0
Review Comment:
⚠️ **[REGRESSION, 3rd time] `github.token` re-introduced — PRs it creates
won't trigger CI.**
This was fixed in commit `9c41c1ad` (switched to `secrets.GH_TOKEN`),
reverted in `f6a1987c` (lost when `peter-evans/create-pull-request` was
replaced), re-flagged in the `f6a1987c` review, re-flagged in the `e61d44df`
review, re-flagged in the `8a29466e` review — and it's back again.
GitHub explicitly blocks `on: pull_request` workflow runs on PRs opened by
`GITHUB_TOKEN`. The update PRs will have no `Java CI` checks. A maintainer will
have to manually push a commit or close/reopen to trigger checks.
Use a PAT stored as a repo secret:
```suggestion
GH_TOKEN: ${{ secrets.GH_TOKEN }}
```
##########
pom.xml:
##########
@@ -1302,5 +1302,154 @@ under the License.
</plugins>
</build>
</profile>
+ <profile>
+ <!--
+ This profile is NEVER activated during a normal build.
+ It configures versions-maven-plugin to map the version.maven-*-plugin
+ properties (in impl/maven-core/pom.xml) to their corresponding Maven
+ plugin artifacts, enabling:
+
+ mvn versions:update-properties -Pversions-update \
+ -DincludeProperties="lifecycle.clean-plugin,..." \
+ -pl impl/maven-core
+
+ The GitHub Actions workflow
.github/workflows/update-lifecycle-plugins.yml
+ runs this command weekly and opens a PR when updates are found.
+ -->
+ <id>versions-update</id>
+ <build>
+ <plugins>
+ <plugin>
+ <groupId>org.codehaus.mojo</groupId>
+ <artifactId>versions-maven-plugin</artifactId>
+ <version>2.18.0</version>
Review Comment:
⬆️ **`versions-maven-plugin` is stale — latest is `2.22.0`, not `2.18.0`.**
As noted by @slawekjaranowski: 2.22.0 is the current release on Maven
Central. Shipping a 4-minor-version-old release of the very tool responsible
for keeping dependencies up to date is a bad look.
```suggestion
<version>2.22.0</version>
```
--
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.
To unsubscribe, e-mail: [email protected]
For queries about this service, please contact Infrastructure at:
[email protected]
