CycloneDX / CycloneDX/cyclonedx-maven-plugin
Running makeAggregateBom in a reactor POM leads to warnings
- Dominant language
- Java
- Stars
- 385
- Forks
- 107
- Avg merge
- 17h 31m
- Merged PRs (30d)
- 7
Description
When defining an execution for `makeAggregateBom` in the reactor POM of a multi-module project, warnings are shown for any dependencies which are part of the reactor:
```
[WARNING] The following dependencies could not be resolved at this point of the build but seem to be part of the reactor:
[WARNING] o com.example.maven2.pom:divpom-configs-multi-test-jar:jar:1-SNAPSHOT (compile)
[WARNING] Try running the build up to the lifecycle phase "package"
[INFO]
[INFO] --- cyclonedx-maven-plugin:1.6.4:makeAggregateBom (default-makeAggregateBom) @ divpom-configs-multi-test ---
[INFO] CycloneDX: Creating BOM
[INFO] CycloneDX: Writing BOM
[INFO] CycloneDX: Validating BOM
```
I am not sure whether this may be avoided but it is a bit annoying, we try to run all builds without `WARNINGS`.
Maybe the execution of `makeAggregateBom` should be delayed until the reactor reaches the last module project, somehow like `maven-install-plugin` does it when specifying `installAtEnd`. Maybe `requiresDependencyResolution` is wrong here?
Contributor guide
Research direction
Start by reproducing issue #85 with a multi-module reactor POM and an execution of makeAggregateBom. Investigate the goal's requiresDependencyResolution setting and reactor lifecycle timing; done means reactor dependencies no longer produce unresolved-dependency warnings during aggregate BOM generation.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- java
- Domain
- build-system
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100