GoogleCloudPlatform / GoogleCloudPlatform/cloud-opensource-java

Linkage Monitor does not detect errors when pom.xml has the same version as the one in libraries-bom

Open
#1,085 3 comments 0 reactions 0 assignees View on GitHub
bug p3
Dominant language
Java
Stars
163
Forks
80
PR merge metrics
No merged PRs in 30d

Description

Linkage Monitor does not detect linkage errors when "-SNAPSHOT" is not added to pom.xml yet during a release cycle.

# Case of java-cloud-bom
This PR https://github.com/googleapis/java-cloud-bom/pull/146 should have detected linkage errors by Linkage Monitor, but it did not. The log (http://sponge2/ed689c2b-ba00-4ea7-881f-a959ef01a151) had

```
...
[INFO] Installing /tmpfs/src/github/java-cloud-bom/pom.xml to /root/.m2/repository/com/google/cloud/google-cloud-bom/0.120.2-alpha/google-cloud-bom-0.120.2-alpha.pom
...

INFO: BOM Coordinates: com.google.cloud:libraries-bom:3.2.0
Dec 17, 2019 1:34:41 PM com.google.cloud.tools.dependencies.linkagemonitor.LinkageMonitor run
INFO: Could not find SNAPSHOT versions for the artifacts in the BOM. Not running comparison.
```

This presubmit check should have reported the error on `google-auth-library-oauth2-http-0.17.1.jar`. ([link](https://g3c.corp.google.com/results/invocations/5caa06c0-8068-430a-85c0-936de4a08f84/targets/cloud-devrel%2Fclient-libraries%2Fjava%2Fjava-cloud-bom%2Fpresubmit%2Flinkage-monitor/log)).

# Why didn't Linkage Monitor work?

The commit https://github.com/googleapis/java-cloud-bom/pull/146/commits/00bf96454f6ebb4612e58ca829cadd4c86d59d9d had "0.120.2-alpha" as version. This does not have "-SNAPSHOT" yet.

```
suztomo@suxtomo24:~/java-cloud-bom$ git checkout 00bf96454f6ebb4612e58ca829cadd4c86d59d9d
HEAD is now at 00bf964 updates
suztomo@suxtomo24:~/java-cloud-bom$ grep '' pom.xml |head -1
0.120.2-alpha
```

Because `com.google.cloud:libraries-bom:3.2.0` already has "0.120.2-alpha" for google-cloud-java, Linkage Monitor did not compare the result of the change. Even if it compares the results, which contain the google-auth-library-oauth2-http errors, there's no diff to report.

# (temporary) Solution

Do not rely on Linkage Monitor presubmit checks during a release, when "-SNAPSHOT" is stripped.

Update the version of pom.xml to have "-SNAPSHOT" soon after a release is finished. In the case of the example above, it took 11 days to update the version from `0.120.2` to `0.120.3-SNAPSHOT`.

```
* 14fc838 release-please[bot] Tue Dec 17 08:31:15 2019 -0800 chore: release 0.120.3-SNAPSHOT (#149)
* 797a131 Elliotte Rusty Harold Tue Dec 17 11:30:54 2019 -0500 deps: update google-cloud-automl-bom to 0.115.1 (#150)
...
* a8d88a4 Renovate Bot Tue Dec 17 15:33:16 2019 +0200 chore(deps): update dependency io.grafeas:grafeas to v0.23.0 (#134)
| * 00bf964 Elliotte Rusty Harold Tue Dec 17 08:31:12 2019 -0500 updates
|/
* 62544be Anuraag Agrawal Tue Dec 17 21:53:11 2019 +0900 fix: bump trace to fix missing dependency (#142)
* 006a6da release-please[bot] Fri Dec 6 14:52:15 2019 -0800 chore: release 0.120.2 (#140)
```

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.