DependencyTrack / DependencyTrack/dependency-track

Use Enforcer Plugin to Improve Release Process

Open
#3,060 0 comments 1 reaction 0 assignees View on GitHub
enhancement
Dominant language
Java
Stars
4.2k
Forks
811
Avg merge
8h 39m
Merged PRs (30d)
237

Description

### Current Behavior

* A past release of Dependency-Track was accidentally released containing a SNAPSHOT version of Alpine
* Testing of Dependency-Track v4.9.0 SNAPSHOT has included builds that used `cyclonedx-core-java` 7.4.0-SNAPSHOT. This has been really useful for testing... but runs the risk that the `cyclonedx-core-java` 7.4.0-SNAPSHOT is not updated to a release version before Dependency-Track itself next has a release.

### Proposed Behavior

Dependency-Track is released using GitHub actions and does not use the `maven-release-plugin` which (by default) will fail to release with error "“Can’t release project due to non released dependencies”.

Thus, suggest using the `maven-enforcer-plugin` in a maven profile that can be invoked on release. The plugin configuration would look like this:

```

org.apache.maven.plugins
maven-enforcer-plugin
3.4.1


initialize
enforce-versions

enforce




No Snapshots Allowed for Dependencies!


Snapshot Version is Not Allowed for Release


true


```

### Checklist

- [X] I have read and understand the [contributing guidelines](https://github.com/DependencyTrack/dependency-track/blob/master/CONTRIBUTING.md#filing-issues)
- [X] I have checked the [existing issues](https://github.com/DependencyTrack/dependency-track/issues) for whether this enhancement was already requested

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.