chore: publish XSDs upon deployment and validate generated pom lock files are valid #97

smaarn · 2025-05-25T09:27:14Z

Objective of this PR is to do two things:

Ensure generated lock files are validated against eligible XSDs (Fixes Add test that validates the generated POM lock file towards the schema #89)
Publish automatically XSD resources upon releasing

Worth noting:

XSD resources publishing is currently relying on the maven "site" workflow but could be left to a github action
It requires giving the "release" job with permissions to write contents (the same would apply to the github action usage TBH)

smaarn · 2025-05-25T09:28:26Z

.dependency-lock/pom.xml

+    <dependency>
+      <groupId>org.slf4j</groupId>
+      <artifactId>slf4j-simple</artifactId>
+      <version>1.7.36</version>
+      <type>jar</type>
+      <scope>test</scope>
+      <optional>false</optional>
+      <dependency-lock:integrity>sha512:zc6+j6WFJ6G8faDBjpCpVHzorJnMz+VleGDColR4wDDqdYJR2j4ypx6rnLuRNgaStcbFiHofFZfR/aBxUbJ+Xw==</dependency-lock:integrity>
+    </dependency>


New dependency effectively added (for testing only)

smaarn · 2025-05-25T09:46:12Z

.dependency-lock/pom.xml

Add a test dependency for logging purposes

Added Xerces Impl libraries supporting XML Schema 1.1

Add a plugin for publishing the staged site to github

Add a plugin to be able to generate and use test XSDs

smaarn · 2025-05-25T09:47:04Z

.dependency-lock/pom.xml

+            <groupId>org.apache.sshd</groupId>
+            <artifactId>sshd-core</artifactId>
+            <version>2.7.0</version>
+            <type>jar</type>
+            <dependency-lock:integrity>sha512:a6KwwY08ayyyD6wSSXqYOmkeVUqiH4P18Os+IzpGdF+sw3tT2JB4WkgH77ZKScpHJC7+bqlsFELpfqIQYMCvOA==</dependency-lock:integrity>
+          </dependency>
+          <dependency>
+            <groupId>org.apache.sshd</groupId>
+            <artifactId>sshd-osgi</artifactId>
+            <version>2.7.0</version>
+            <type>jar</type>
+            <dependency-lock:integrity>sha512:yUv2WnT8f0RzWzx9rZqc1cyQYXSxlhW7FrbTJc6m41hFAuqaSBP3FT3NpKnd8IInAMmsc+BWyitdxl20wGEK0A==</dependency-lock:integrity>
+          </dependency>
+          <dependency>
+            <groupId>org.apache.sshd</groupId>
+            <artifactId>sshd-sftp</artifactId>
+            <version>2.7.0</version>
+            <type>jar</type>
+            <dependency-lock:integrity>sha512:m0pFn5JMdKMX41VRki5lsXa3nuogDq3S5q17AxdzibdSDVi2qwR/akZTSu+jJFVI5JNHgfKi7uzStrigDML0hw==</dependency-lock:integrity>
+          </dependency>
+          <dependency>
+            <groupId>org.codehaus.plexus</groupId>
+            <artifactId>plexus-cipher</artifactId>
+            <version>2.0</version>
+            <type>jar</type>
+            <dependency-lock:integrity>sha512:jxh7B4Z6fCnXdFSq5LdkeTACONnE53fBr6KuvjO4jauRbikRHdVaysE0GEn0V5/pGlRw/dRcy6DgVwnCzjodZQ==</dependency-lock:integrity>
+          </dependency>
+          <dependency>
+            <groupId>org.codehaus.plexus</groupId>
+            <artifactId>plexus-interactivity-api</artifactId>
+            <version>1.3</version>
+            <type>jar</type>
+            <dependency-lock:integrity>sha512:rd9HrDaBluUmIjJOydA/b7ePh9wlNM18nrTxMNESQt7BJ3jbuk+MQFfVaosrxWZzQy4LDdhwCsbLF7fFkEKm8w==</dependency-lock:integrity>
+          </dependency>
+          <dependency>
+            <groupId>org.codehaus.plexus</groupId>
+            <artifactId>plexus-interpolation</artifactId>
+            <version>1.27</version>
+            <type>jar</type>
+            <dependency-lock:integrity>sha512:NK4TmedVYNauxnQ8434Q0iNjQuxYFFw/3XsDNA9O0+9QD4JMhF1FLbuMPxTRGMhVcH3koIAHT6Vy2vfM/vTd3w==</dependency-lock:integrity>
+          </dependency>
+          <dependency>
+            <groupId>org.codehaus.plexus</groupId>
+            <artifactId>plexus-sec-dispatcher</artifactId>
+            <version>2.0</version>
+            <type>jar</type>
+            <dependency-lock:integrity>sha512:rU6BTIuv94Ck7uBkkD5SsJrgBCCln7B173LbuNZNEtPVAJsD1WwV+TWH2THDp/BsrWNRqy3JQVzMbuqw2uvrBw==</dependency-lock:integrity>
+          </dependency>
+          <dependency>
+            <groupId>org.codehaus.plexus</groupId>
+            <artifactId>plexus-utils</artifactId>
+            <version>4.0.1</version>
+            <type>jar</type>
+            <dependency-lock:integrity>sha512:7PYJ1JXJ53KEdso11CkMlNhiw5OvxqmAkFcfQEfUGE0cUjH9avS8aP59gy7KJhcfhq9exZDW8vcHQLcgpvY2tQ==</dependency-lock:integrity>
+          </dependency>
+          <dependency>
+            <groupId>org.codehaus.plexus</groupId>
+            <artifactId>plexus-xml</artifactId>
+            <version>3.0.0</version>
+            <type>jar</type>
+            <dependency-lock:integrity>sha512:MbaKAlqyZY/lnV+7eaJCVWA5Lj2ydGsKuAWEaliBbEI13W1Q7T7S1JGfdJTgWAdTcbspaU9KquNwyeDKouVSRQ==</dependency-lock:integrity>
+          </dependency>
+          <dependency>
+            <groupId>org.eclipse.jgit</groupId>
+            <artifactId>org.eclipse.jgit.ssh.apache</artifactId>
+            <version>5.13.3.202401111512-r</version>
+            <type>jar</type>
+            <dependency-lock:integrity>sha512:YQ5xWesdGwBdAHXNzglG6VouootDuOw3LLsVOFN4riGZsMrkuqNM1CVVuMNOYUjx9NGCOjJpm9ID0i484tQ1mg==</dependency-lock:integrity>
+          </dependency>
+          <dependency>
+            <groupId>org.eclipse.jgit</groupId>
+            <artifactId>org.eclipse.jgit</artifactId>
+            <version>5.13.3.202401111512-r</version>
+            <type>jar</type>
+            <dependency-lock:integrity>sha512:0CcRWumPQbpI98UK+A6PmTZCKErtYajWY2cgOwNgokuWIiEeuXTsprjvMCgrwJcEOAv+YVWrOFVt6nuQBr0ysw==</dependency-lock:integrity>
+          </dependency>
+          <dependency>
+            <groupId>org.jdom</groupId>
+            <artifactId>jdom2</artifactId>
+            <version>2.0.6.1</version>
+            <type>jar</type>
+            <dependency-lock:integrity>sha512:gWQtt2NY+/Ex3+nC8dnCgPwjtr/eahai022sxJChoq9OD7Srtc14AFcYux0VikL9aDTNK/5hbsWWJd8BlR8keA==</dependency-lock:integrity>
+          </dependency>
+          <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>jcl-over-slf4j</artifactId>
+            <version>1.7.36</version>
+            <type>jar</type>
+            <dependency-lock:integrity>sha512:rCMatEUhu1R4dCrxNiTbXBSuqAnDosE7mJ+6MBhrptuEDy0bSupU+cH3eVR7l1/QQt01P1QCVZJ3TUAZK9cRSA==</dependency-lock:integrity>
+          </dependency>
+          <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-api</artifactId>
+            <version>1.7.36</version>
+            <type>jar</type>
+            <dependency-lock:integrity>sha512:+bAz/AGaRPmLFgSNp+K1nt1KalJ7pg41j2WriOCvrgOpNA8bPopUPUn6VCKQ9JnFWUJZr/of8+bnvztCjUxhCw==</dependency-lock:integrity>
+          </dependency>
+        </dependencies>
+        <dependency-lock:integrity>sha512:DWOWDQgfaye/tpgDXbqsqZo5PVOxe0VIYiLAPOW5vRVufFPauScNXiJGnoxlTY1ZTaA2LxOKA3I2roORPrE4bQ==</dependency-lock:integrity>
      </plugin>


Plugin added to publish to SCM the generated site

smaarn · 2025-05-25T09:47:32Z

.dependency-lock/pom.xml

+      </plugin>
+      <plugin>
+        <groupId>org.codehaus.mojo</groupId>
+        <artifactId>build-helper-maven-plugin</artifactId>


Plugin added to be able to attach test resources (for testing and IDE integration)

smaarn · 2025-05-25T09:48:48Z

src/it/pom/lock-build-with-extension/expected-pom.xml

Ordering of dependency-lock:integrity elements

smaarn · 2025-05-25T09:49:12Z

src/it/pom/lock-build/expected-pom.xml

Ordering of dependency-lock:integrity elements

+ Ensure templates are also filtered

+ Fix XSD compliance

vandmo · 2025-05-26T07:05:18Z

src/main/resources/se/vandmo/dependencylock/maven/pom/pom-with-plugins.ftlx

      <plugin>
        <groupId>${plugin.artifactIdentifier.groupId}</groupId>
        <artifactId>${plugin.artifactIdentifier.artifactId}</artifactId>
        <version>${plugin.version}</version>
-        <dependency-lock:integrity>${plugin.getIntegrityForLockFile()}</dependency-lock:integrity>


Do this need to change place? I think it belongs where it is conceptually.

Found a way to revert this change by switching to a custom Xerces Impl package supporting XML Schema 1.1

Indeed there was the following issues:

Using standard Xerces library shipped with JDK seems to not work (because in XML Schema 1.0 you cannot "extend" a complex type containing an "all" clause)

Using Woodstox led to the validator code used to fail if ordering wasn't respected (it seemed to expect first all parent content and then child content... Don't ask me why but it didn't like the "dependencies" node appearing after dependency-lock:integrity 🤷 )

…te against XSD (allows relaxing the ordering constraint)

smaarn · 2025-05-26T19:17:35Z

.dependency-lock/pom.xml

@@ -113,6 +113,15 @@
      <optional>false</optional>
      <dependency-lock:integrity>sha512:mLxmXBYmj/EHT0FfSTumbSFKwjZltulkCGtg1SOzWxsD/S55IR6Eqo6/CSHqAo+ZKCfkZC/QhtcQSkCLRU04zg==</dependency-lock:integrity>
    </dependency>
+    <dependency>
+      <groupId>edu.princeton.cup</groupId>
+      <artifactId>java-cup</artifactId>


Used by Xerces Impl XML Schema 1.1 Validation classes

smaarn · 2025-05-26T19:17:44Z

.dependency-lock/pom.xml

@@ -473,6 +482,25 @@
      <optional>false</optional>
      <dependency-lock:integrity>sha512:aMXfAa1SKRfZVLYss7ETdrNEaSDo1cs1c33lCOas2Ro2s0FEkz9Ce74dKdypCXup3SQxxxP+GAafJxqAtRnwUQ==</dependency-lock:integrity>
    </dependency>
+    <dependency>
+      <groupId>org.exist-db.thirdparty.org.eclipse.wst.xml</groupId>
+      <artifactId>xpath2</artifactId>


Used by Xerces Impl XML Schema 1.1 Validation classes

smaarn · 2025-05-26T19:18:27Z

.dependency-lock/pom.xml

+    </dependency>
+    <dependency>
+      <groupId>org.exist-db.thirdparty.xerces</groupId>
+      <artifactId>xercesImpl</artifactId>


Manually crafted XML Schema 1.1 Supporting Xerces Implementation wrapper (https://blog.adamretter.org.uk/xerces-xsd11-maven/ for the credits)

smaarn · 2025-05-26T19:19:40Z

src/test/java/se/vandmo/dependencylock/maven/mojos/LockProjectHelperTest.java

This file wasn't appropriately formatted it seems 🤦

smaarn commented May 25, 2025

View reviewed changes

smaarn added 3 commits May 25, 2025 11:50

Add automatic XSD generation and publishing upon release

fd3cecf

+ Ensure templates are also filtered

Add testing of valid XSDs

7e565c0

+ Fix XSD compliance

Fix default formatting

20e7ab1

smaarn force-pushed the chore/add-xsd-testing branch from 8af4291 to 20e7ab1 Compare May 25, 2025 09:50

vandmo reviewed May 26, 2025

View reviewed changes

PR Feedback: switch to Xerces XML Schema 1.1 implementation to valida…

7dd3dd4

…te against XSD (allows relaxing the ordering constraint)

smaarn commented May 26, 2025

View reviewed changes

smaarn marked this pull request as ready for review May 26, 2025 19:20

smaarn requested a review from vandmo May 26, 2025 19:23

vandmo merged commit 0083f84 into vandmo:master May 30, 2025
2 checks passed

smaarn deleted the chore/add-xsd-testing branch May 31, 2025 17:10

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

chore: publish XSDs upon deployment and validate generated pom lock files are valid #97

chore: publish XSDs upon deployment and validate generated pom lock files are valid #97

Uh oh!

smaarn commented May 25, 2025 •

edited

Loading

Uh oh!

smaarn May 25, 2025

Uh oh!

smaarn May 25, 2025 •

edited

Loading

Uh oh!

smaarn May 25, 2025

Uh oh!

smaarn May 25, 2025

Uh oh!

smaarn May 25, 2025

Uh oh!

smaarn May 25, 2025

Uh oh!

vandmo May 26, 2025

Uh oh!

smaarn May 26, 2025

Uh oh!

smaarn May 26, 2025

Uh oh!

smaarn May 26, 2025

Uh oh!

smaarn May 26, 2025

Uh oh!

smaarn May 26, 2025

Uh oh!

Uh oh!

Uh oh!

chore: publish XSDs upon deployment and validate generated pom lock files are valid #97

chore: publish XSDs upon deployment and validate generated pom lock files are valid #97

Uh oh!

Conversation

smaarn commented May 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Choose a reason for hiding this comment

Uh oh!

smaarn May 25, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Uh oh!

smaarn commented May 25, 2025 •

edited

Loading

smaarn May 25, 2025 •

edited

Loading