Question

Im working on a large multi-module project which uses an internal framework as one of its dependencies. The framework version is set in the top level pom at the beginning of a project, and has to stay constant. If any submodule uses a different version, I want the build to fail.

Ive tried declaring the dependency as a single version:

<dependency>
  <groupId>framework_snt</groupId>
  <artifactId>SFP</artifactId>
  <version>[6.1]</version>
  <type>pom</type>
</dependency>

Ive tried using the enforcer plugin with banned dependencies:

<plugin>
  <groupId>org.apache.maven.plugins</groupId>
  <artifactId>maven-enforcer-plugin</artifactId>
  <version>1.0.1</version>
  <executions>
    <execution>
      <id>enforce-versions</id>
      <goals>
        <goal>enforce</goal>
      </goals>
      <configuration>
        <rules>
          <requireJavaVersion>
            <version>[1.6.0-21]</version>
          </requireJavaVersion>
          <requireMavenVersion>
            <version>[3.0.3]</version>
          </requireMavenVersion>
          <bannedDependencies>
            <excludes>
              <exclude>framework_snt:SFP</exclude>
            </excludes>
            <includes>
              <include>framework_snt:SFP:6.1.2</include>
            </includes>
          </bannedDependencies>
        </rules>
      </configuration>
    </execution>
  </executions>
</plugin>

Ive also tried adding the <DependencyConvergence/> tag as mentioned here, but none of these approaches work.

So given this top level pom fragment:

<project>
  <groupId>glb</groupId>
  <artifactId>GLB</artifactId>
  <packaging>pom</packaging>
  <name>Global</name>
  <version>1.0</version>
  ........
  <dependencies>
    <dependency>
      <groupId>framework_snt</groupId>
      <artifactId>SFP</artifactId>
      <version>[6.1.2]</version>
      <type>pom</type>
    </dependency>
  </dependencies>  
  .....
</project>

And this (invalid) submmodule:

<project>
  <groupId>glb</groupId>
  <artifactId>CORE</artifactId>
  <packaging>jar</packaging>
  <name>Core</name>
  <version>1.0</version>

  <parent>
    <groupId>glb</groupId>
    <artifactId>GLB</artifactId>
    <version>1.0</version>
  </parent>

  <dependencies>
    <dependency>
      <groupId>framework_snt</groupId>
      <artifactId>SFP</artifactId>
      <version>6.3</version>
      <type>pom</type>
    </dependency>
  </dependencies>
</project>

how do I setup maven so the build will fail when using the child module above, but when I remove the tag <version>6.3</version> it succeeds (or I change the version to match the one from the top level pom?

Answer 1

Well after much search and trying stuff with various plugins and getting nowhere, I decided to write my own plugin to do conflict checking. Using the dependency:tree plugin source as a base I wrote the following:

   /**
    * Walks the dependency tree looking for anything marked as a conflict, and fails the build if one is found
    * code ripped from the dependency:tree plugin
    *
    * @param rootNode
    * the dependency tree root node to check
    *
    */
   private void checkForConflicts( DependencyNode rootNode ) throws MojoExecutionException
   {
   StringWriter writer = new StringWriter();
   boolean conflicts=false;

   // build the tree
   DependencyNodeVisitor visitor = new SerializingDependencyNodeVisitor( writer, SerializingDependencyNodeVisitor.STANDARD_TOKENS);
   visitor = new BuildingDependencyNodeVisitor( visitor );
   rootNode.accept( visitor );

   getLog().debug("Root: "+rootNode.toNodeString() );

   DependencyNode node;
   Artifact actual, conflict;
   DependencyTreeInverseIterator iter = new DependencyTreeInverseIterator(rootNode);
   while (iter.hasNext() )
     {
      node = (DependencyNode)iter.next();
      if (node.getState() == DependencyNode.OMITTED_FOR_CONFLICT)
        {
         actual = node.getArtifact();
         conflict = node.getRelatedArtifact();
         getLog().debug("conflict node: " + node.toNodeString() );
         getLog().debug("conflict with: "+conflict.toString() );

         getLog().error(actual.getGroupId()+":"+actual.getArtifactId()+":"+actual.getType()+" Conflicting versions: "+actual.getVersion()+" and "+conflict.getVersion() );
         conflicts=true;
        }
     }

    if (conflicts)
      throw new MojoExecutionException( "version conflict detected");
   }

You can call this from your existing plugin using the following:

try
  {
   rootNode = dependencyTreeBuilder.buildDependencyTree( project, localRepository, artifactFactory, artifactMetadataSource, null, artifactCollector );
   checkForConflicts( rootNode );
  }
catch ( DependencyTreeBuilderException e)
  {
   throw new MojoExecutionException( "Cannot build project dependency tree", e);
  }

Then in your plugin pom.xml, include dependencies from the existing dependency plugin source and your good to go.

This works for our project — but if anyone knows a cleaner or better way, please let me know.