apache / apache/maven-antrun-plugin

Aggregate maven.project.dependencies fileset omits artifacts not in the local repository (reactor builds)

Open
#373 0 comments 0 reactions 1 assignee Claimed by @elharo View on GitHub
bug
Dominant language
Java
Stars
36
Forks
20
Avg merge
1h 48m
Merged PRs (30d)
1

Description

## Summary
The aggregate `maven.project.dependencies` fileset produced by `DependencyFilesetsTask` is rooted at the local repository and uses `localRepository.pathOf(artifact)` for its includes. Artifacts that are not physically located in the local repository (notably reactor inter-module dependencies, resolved to a sibling module's `target/` directory) silently match nothing, so the aggregate fileset is incomplete in reactor builds.

## Affected code
`src/main/java/org/apache/maven/ant/tasks/DependencyFilesetsTask.java` lines 63-85 (master @ `441382c`)

```java
FileSet dependenciesFileSet = new FileSet();
dependenciesFileSet.setProject(getProject());
ArtifactRepository localRepository = getProject().getReference("maven.local.repository");
dependenciesFileSet.setDir(new File(localRepository.getBasedir()));
...
for (Artifact artifact : depArtifacts) {
String relativeArtifactPath = localRepository.pathOf(artifact);
dependenciesFileSet.createInclude().setName(relativeArtifactPath);
...
FileSet singleArtifactFileSet = new FileSet();
singleArtifactFileSet.setProject(getProject());
singleArtifactFileSet.setFile(artifact.getFile());
getProject().addReference(fileSetName, singleArtifactFileSet);
}
```

## Problem
The per-dependency filesets correctly point at `artifact.getFile()` (the actual resolved location), but the aggregate fileset is based on the local repository directory plus the *would-be* installed path from `localRepository.pathOf(artifact)`. In a reactor build, a dependency on a sibling module resolves to that module's output directory (e.g. `module/target/classes` or the built jar), which is **not** present under the local repository — so the aggregate fileset silently omits those dependencies. The same applies to any artifact resolved from a non-default location. Users consuming `maven.project.dependencies` in reactor builds get an incomplete (or empty) fileset with no warning.

## Expected behavior
The aggregate fileset should be assembled from the actual resolved artifact files (as the per-dependency filesets are), rather than from paths reconstructed against the local repository.

Contributor guide

No contributing guide indexed for this repository

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.