DependencyTrack / DependencyTrack/dependency-track
Use Enforcer Plugin to Improve Release Process
- Dominant language
- Java
- Stars
- 4.2k
- Forks
- 811
- Avg merge
- 8h 39m
- Merged PRs (30d)
- 237
Description
### Current Behavior
* A past release of Dependency-Track was accidentally released containing a SNAPSHOT version of Alpine
* Testing of Dependency-Track v4.9.0 SNAPSHOT has included builds that used `cyclonedx-core-java` 7.4.0-SNAPSHOT. This has been really useful for testing... but runs the risk that the `cyclonedx-core-java` 7.4.0-SNAPSHOT is not updated to a release version before Dependency-Track itself next has a release.
### Proposed Behavior
Dependency-Track is released using GitHub actions and does not use the `maven-release-plugin` which (by default) will fail to release with error "“Can’t release project due to non released dependencies”.
Thus, suggest using the `maven-enforcer-plugin` in a maven profile that can be invoked on release. The plugin configuration would look like this:
```
org.apache.maven.plugins
maven-enforcer-plugin
3.4.1
initialize
enforce-versions
enforce
No Snapshots Allowed for Dependencies!
Snapshot Version is Not Allowed for Release
true
```
### Checklist
- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested
Contributor guide
Assessment
This issue has not been assessed yet.