CycloneDX / CycloneDX/cyclonedx-maven-plugin

Running makeAggregateBom in a reactor POM leads to warnings

Open
#85 3 comments 5 reactions 0 assignees View on GitHub
Dominant language
Java
Stars
385
Forks
107
Avg merge
17h 31m
Merged PRs (30d)
7

Description

When defining an execution for `makeAggregateBom` in the reactor POM of a multi-module project, warnings are shown for any dependencies which are part of the reactor:

```
[WARNING] The following dependencies could not be resolved at this point of the build but seem to be part of the reactor:
[WARNING] o com.example.maven2.pom:divpom-configs-multi-test-jar:jar:1-SNAPSHOT (compile)
[WARNING] Try running the build up to the lifecycle phase "package"
[INFO]
[INFO] --- cyclonedx-maven-plugin:1.6.4:makeAggregateBom (default-makeAggregateBom) @ divpom-configs-multi-test ---
[INFO] CycloneDX: Creating BOM
[INFO] CycloneDX: Writing BOM
[INFO] CycloneDX: Validating BOM
```

I am not sure whether this may be avoided but it is a bit annoying, we try to run all builds without `WARNINGS`.
Maybe the execution of `makeAggregateBom` should be delayed until the reactor reaches the last module project, somehow like `maven-install-plugin` does it when specifying `installAtEnd`. Maybe `requiresDependencyResolution` is wrong here?

Contributor guide

Open the contributing guide

Research direction

Start by reproducing issue #85 with a multi-module reactor POM and an execution of makeAggregateBom. Investigate the goal's requiresDependencyResolution setting and reactor lifecycle timing; done means reactor dependencies no longer produce unresolved-dependency warnings during aggregate BOM generation.

Written by the indexing model from the issue text.

Assessment

Tech stack
java
Domain
build-system
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.