Skip to main content

[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index] [List Home]
[cross-project-issues-dev] Fwd: Using Maven Dependencies and Keeping them Up-to-date

Hi,

I've started to use the really cool dash license tool for doing license checking as part of a build.  It's really easy to set up:

  https://github.com/eclipse/dash-licenses/blob/master/README.md#add-to-your-maven-build

It can even automatically create reviews in IP lab, though I'm not sure exactly how to fully enable that part:

  https://gitlab.eclipse.org/eclipsefdn/helpdesk/-/issues/2673

In any case, the contents of https://download.eclipse.org/oomph/simrel-maven/nightly/latest are fully IP reviewed and IP approved now and these are the latest direct-from-Maven versions available.

I've been using the generated reports to keep the Platform's dependencies up-to-date. The following two projects have dependencies that can be updated and probably should be updated:

  https://github.com/merks/simrel-maven/blob/main/m2e/REPORT.md
  https://github.com/merks/simrel-maven/blob/main/tm4e/REPORT.md

Regards,
Ed


-------- Forwarded Message --------
Subject: Using Maven Dependencies and Keeping them Up-to-date
Date: Tue, 24 Jan 2023 13:36:35 +0100
From: Ed Merks <ed.merks@xxxxxxxxx>
To: Cross project issues <cross-project-issues-dev@xxxxxxxxxxx>


Hi,

I've been working on a generator for analyzing Maven dependencies in *.target files for helping to keep them-up-to-date:

  https://bugs.eclipse.org/bugs/show_bug.cgi?id=581397

I provided documentation in this public Github repo because git.eclipse.org doesn't provide nice *.md rendering:

  https://github.com/merks/simrel-maven/blob/main/README.md

The generated reports (described and linked in the above README.md) are useful for each SimRel project; I've been using the one for the Platform to keep the Platform up-to-date.  I just copy and update the updated.target linked in the report.)

This new infrastructure also produces the following site which contains all the direct-from-maven dependencies of all the projects, updated to their latest versions, including source bundles, along proper PGP signatures.

  https://download.eclipse.org/oomph/simrel-maven/nightly/latest

It is my hope that by all of the projects using the latest version of such dependencies that we will further reduce duplicates in the train repository.  I still need to figure out what must be done to ensure that every dependency has been properly IP reviewed.  Then perhaps some project will also wish to consume bundles from this source when it starts to produce milestone builds...

If you have any follow up questions or suggestions please use the above Bugzilla or use the following issue for that purpose:

  https://github.com/merks/simrel-maven/issues/1

Regards,
Ed


Back to the top