ci: split enforcer into fast PR metadata check and release banDuplicateClasses check - #14142
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request configures java-samples to skip the enforcer plugin, updates the minimum Maven and Java version requirements in the shared configuration, and removes the banDuplicateClasses rule. The reviewer noted that removing the banDuplicateClasses rule completely exposes downstream projects to classpath conflicts and suggested instead moving it to a separate profile or execution phase to maintain protection without slowing down PR checks.
I am having trouble creating individual review comments. Click here to see my feedback.
java-shared-config/java-shared-config/pom.xml (257-264)
Removing the banDuplicateClasses rule entirely from the shared configuration eliminates protection against classpath conflicts (JAR hell) for all downstream projects inheriting this configuration. While this significantly speeds up the CI enforcer job by avoiding bytecode inspection of compiled dependencies, completely disabling this check increases the risk of duplicate classes causing runtime issues (such as LinkageError or NoSuchMethodError).
Consider keeping this rule but binding it to a separate execution or a profile (e.g., activated only during release or packaging phases) so that it doesn't block fast PR checks but still runs before releases.
- Update enforcer job in ci.yaml to run only when PR is raised from release-please--branches--main and title does not end with SNAPSHOT - Skips enforcer check on standard feature/bugfix PRs to eliminate 20+ minute CI turnaround time
9a15d11 to
82fc824
Compare
lqiu96
changed the title
…teClasses check - Split enforcer plugin executions into enforce (requireUpperBoundDeps, requireMavenVersion, requireJavaVersion) and enforce-banned-duplicate-classes (banDuplicateClasses) - Run fast in-memory enforcer checks on every PR without full-repo build (~15s runtime) - Scope bytecode-level banDuplicateClasses check to release-please PRs with pre-installed module JARs - Configure enforcer overrides in google-auth-library-java and grpc-gcp-java
lqiu96
changed the title
| </extension> | ||
| </extensions> | ||
| <plugins> | ||
| <!-- Temporary enforcer configuration override until a new version of google-cloud-shared-config is released to Maven Central. |
There was a problem hiding this comment.
This is probably a separate issue. java-shared-config is in the same repo now, other modules should be able to use the SNAPSHOT version of java-shared-config.
There was a problem hiding this comment.
From an older change:
as part of monorepo migration.I think this probably requires a bit larger of an effort the fix
There was a problem hiding this comment.
I see. Auth makes sense because it needs to be published first and its group id com.google.auth is different from shared-config's group id com.google.cloud. But we can probably change grpc-gcp to use snapshot version of shared-config because it has the same group id.
2 participants
Summary
Separates the Maven Enforcer configuration into two distinct executions:
enforce(Fast Metadata Checks): ChecksrequireUpperBoundDeps,requireMavenVersion, andrequireJavaVersion. Runs on every PR directly in memory (~15s) without needing a full-repo build.enforce-banned-duplicate-classes(Bytecode Scanner): ChecksbanDuplicateClasses. Runs only on Release-Please (non-SNAPSHOT) PRs after compiling and installing all module JARs to disk.Key Changes
java-shared-config/pom.xml:<id>enforce</id>into fast metadata rules (requireUpperBoundDeps,requireMavenVersion: [3.8.0,),requireJavaVersion: [1.8,)).<id>enforce-banned-duplicate-classes</id>execution containing the<banDuplicateClasses>rule..github/workflows/ci.yaml:enforcerjob: Runs on every PR usingmvn -B -ntp enforcer:enforce@enforce -T 1C(executes in ~15 seconds across all modules without pre-installing JARs).ban-duplicate-classesjob: Runs on Release-Please PRs (release-please--branches--mainnon-SNAPSHOT) with the fullJOB_TYPE: installstep followed bymvn -B -ntp enforcer:enforce@enforce-banned-duplicate-classes -T 1C.grpc-gcp-java:google-cloud-shared-config:1.21.0-SNAPSHOTparent via relative path and Release-Please tracking comment (<!-- {x-version-update:google-cloud-shared-config:current} -->), directly inheriting the split enforcer configuration.google-auth-library-java:<rules combine.self="override">to prevent running the oldbanDuplicateClassesrule inherited from the remotegoogle-cloud-shared-config:1.17.0release artifact.google-cloud-shared-configis published to Maven Central, at which point the parent version will be bumped and the overrides removed.java-samples:<enforcer.skip>true</enforcer.skip>to sample parent POM.Benefits
requireUpperBoundDeps) and tool versions in ~15 seconds rather than waiting 20+ minutes.banDuplicateClassesbefore publishing.