Skip to content

Commit be127de

Browse files
mutianfmutianf
authored
fix: stop publishing a bigtable-beam-import pom with no dependencies (#4632)
* fix: stop publishing a bigtable-beam-import pom with no dependencies bigtable-beam-import attaches its shaded jar under a classifier, so the main artifact is the thin, unshaded jar and its pom must keep every compile dependency. maven-shade-plugin still strips them from the generated dependency-reduced pom in that configuration (MSHADE-419), which is not fixed in 3.6.0 despite what the comment in the root pom claimed. The bump to 3.6.0 in #4626 therefore published 2.20.0 and 2.20.1 poms declaring zero compile dependencies. Consumers resolving the artifact from Maven Central get no transitive deps at all. GoogleCloudPlatform/DataflowTemplates hits this staging the Cloud_Bigtable_to_GCS_SequenceFile template, which fails with ClassNotFoundException: org.apache.hadoop.hbase.io.ImmutableBytesWritable. Nothing caught it in-repo because the reactor resolves sibling modules from source poms and never reads dependency-reduced-pom.xml. - set createDependencyReducedPom=false explicitly on the module rather than relying on a plugin default that changed between 3.2.4 and 3.6.0 - add a verify-published-pom-deps goal to bigtable-build-helper that inspects the pom that would actually be deployed and fails the build if a required compile dependency is missing, wired into the module's verify phase; covered by integration tests for both the healthy and the MSHADE-419-stripped case - correct the root pom comment and drop the renovate rule that pinned maven-shade-plugin away from 3.3.0, which was both an incomplete description of the bug and moot now that the flag is explicit Change-Id: I2d269c60175e10da7e5b361f410dd06f7861ba48 * fix: guard against a missing or half-declared pom in verify-published-pom-deps Change-Id: Ice5b8a44978b4833bc48c5fe037a263bbce68b77
1 parent 1d582d7 commit be127de

8 files changed

Lines changed: 413 additions & 10 deletions

File tree

‎bigtable-dataflow-parent/bigtable-beam-import/pom.xml‎

Lines changed: 39 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -320,6 +320,14 @@ limitations under the License.
320320
</executions>
321321
<configuration>
322322
<shadedArtifactAttached>true</shadedArtifactAttached>
323+
<!-- The shaded jar is attached under a classifier, so the main artifact is the thin,
324+
unshaded jar and it still needs every one of its compile dependencies declared.
325+
A dependency-reduced pom would strip them and leave consumers with nothing to
326+
resolve (MSHADE-419 does exactly that in shade >= 3.3.0, which shipped broken
327+
poms in 2.20.0 and 2.20.1). Set explicitly rather than relying on the plugin
328+
default, whose behavior here changed between 3.2.4 and 3.6.0.
329+
Guarded by the verify-published-pom-deps check below. -->
330+
<createDependencyReducedPom>false</createDependencyReducedPom>
323331
<transformers>
324332
<transformer implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer" />
325333
<transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer" />
@@ -378,6 +386,37 @@ limitations under the License.
378386
<skip>true</skip>
379387
</configuration>
380388
</plugin>
389+
390+
<plugin>
391+
<groupId>com.google.cloud.bigtable.test</groupId>
392+
<artifactId>bigtable-build-helper</artifactId>
393+
<version>2.20.2-SNAPSHOT</version> <!-- {x-version-update:bigtable-client-parent:current} -->
394+
<executions>
395+
<execution>
396+
<id>verify-published-pom-deps</id>
397+
<phase>verify</phase>
398+
<goals>
399+
<goal>verify-published-pom-deps</goal>
400+
</goals>
401+
<configuration>
402+
<!-- The main artifact is the thin, unshaded jar, so these have to survive into the
403+
published pom. Shade stripped every one of them in 2.20.0 and 2.20.1, which
404+
broke downstream consumers (e.g. DataflowTemplates) with a
405+
NoClassDefFoundError that no build in this repo could reproduce. -->
406+
<requiredDependencies>
407+
<requiredDependency>com.google.cloud.bigtable:bigtable-hbase-beam</requiredDependency>
408+
<requiredDependency>org.apache.beam:beam-sdks-java-core</requiredDependency>
409+
<requiredDependency>org.apache.beam:beam-sdks-java-io-hadoop-format</requiredDependency>
410+
<requiredDependency>org.apache.beam:beam-runners-google-cloud-dataflow-java</requiredDependency>
411+
<requiredDependency>org.apache.hadoop:hadoop-client-api</requiredDependency>
412+
<requiredDependency>org.apache.hadoop:hadoop-client-runtime</requiredDependency>
413+
<requiredDependency>org.apache.hbase:hbase-shaded-mapreduce</requiredDependency>
414+
<requiredDependency>com.google.cloud.bigdataoss:gcs-connector</requiredDependency>
415+
</requiredDependencies>
416+
</configuration>
417+
</execution>
418+
</executions>
419+
</plugin>
381420
</plugins>
382421
</build>
383422

‎bigtable-test/bigtable-build-helper/src/it/verify-published-pom-deps-ok/pom.xml‎

Lines changed: 91 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
Copyright 2026 Google LLC
4+
5+
Licensed under the Apache License, Version 2.0 (the "License");
6+
you may not use this file except in compliance with the License.
7+
You may obtain a copy of the License at
8+
9+
http://www.apache.org/licenses/LICENSE-2.0
10+
11+
Unless required by applicable law or agreed to in writing, software
12+
distributed under the License is distributed on an "AS IS" BASIS,
13+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
See the License for the specific language governing permissions and
15+
limitations under the License.
16+
-->
17+
<project xmlns="http://maven.apache.org/POM/4.0.0"
18+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
19+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
20+
<modelVersion>4.0.0</modelVersion>
21+
22+
<!-- groupId is deliberately com.google.guava so that the dependency below can be declared as
23+
${project.groupId} and exercise the interpolation the real bigtable-beam-import pom needs -->
24+
<groupId>com.google.guava</groupId>
25+
<artifactId>verify-published-pom-deps-ok</artifactId>
26+
<version>1.0-SNAPSHOT</version>
27+
28+
<description>Test project where the attached shaded jar leaves the published pom's compile deps intact</description>
29+
30+
<properties>
31+
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
32+
</properties>
33+
34+
<build>
35+
<plugins>
36+
<plugin>
37+
<groupId>org.apache.maven.plugins</groupId>
38+
<artifactId>maven-shade-plugin</artifactId>
39+
<version>3.6.0</version>
40+
<executions>
41+
<execution>
42+
<phase>package</phase>
43+
<goals>
44+
<goal>shade</goal>
45+
</goals>
46+
<configuration>
47+
<shadedArtifactAttached>true</shadedArtifactAttached>
48+
<createDependencyReducedPom>false</createDependencyReducedPom>
49+
<filters>
50+
<filter>
51+
<artifact>*:*</artifact>
52+
<excludes>
53+
<exclude>META-INF/*.MF</exclude>
54+
</excludes>
55+
</filter>
56+
</filters>
57+
</configuration>
58+
</execution>
59+
</executions>
60+
</plugin>
61+
62+
<plugin>
63+
<groupId>com.google.cloud.bigtable.test</groupId>
64+
<artifactId>bigtable-build-helper</artifactId>
65+
<version>2.20.2-SNAPSHOT</version> <!-- {x-version-update:bigtable-client-parent:current} -->
66+
<executions>
67+
<execution>
68+
<id>test</id>
69+
<goals>
70+
<goal>verify-published-pom-deps</goal>
71+
</goals>
72+
<configuration>
73+
<requiredDependencies>
74+
<requiredDependency>com.google.guava:guava</requiredDependency>
75+
</requiredDependencies>
76+
</configuration>
77+
</execution>
78+
</executions>
79+
</plugin>
80+
</plugins>
81+
</build>
82+
83+
<!-- Do not upgrade these dependencies, they are only used as a test subject -->
84+
<dependencies>
85+
<dependency>
86+
<groupId>${project.groupId}</groupId>
87+
<artifactId>guava</artifactId>
88+
<version>30.1-android</version>
89+
</dependency>
90+
</dependencies>
91+
</project>

‎bigtable-test/bigtable-build-helper/src/it/verify-published-pom-deps-stripped/invoker.properties‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1 @@
1+
invoker.buildResult = failure

‎bigtable-test/bigtable-build-helper/src/it/verify-published-pom-deps-stripped/pom.xml‎

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,93 @@
1+
<?xml version="1.0" encoding="UTF-8"?>
2+
<!--
3+
Copyright 2026 Google LLC
4+
5+
Licensed under the Apache License, Version 2.0 (the "License");
6+
you may not use this file except in compliance with the License.
7+
You may obtain a copy of the License at
8+
9+
http://www.apache.org/licenses/LICENSE-2.0
10+
11+
Unless required by applicable law or agreed to in writing, software
12+
distributed under the License is distributed on an "AS IS" BASIS,
13+
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
See the License for the specific language governing permissions and
15+
limitations under the License.
16+
-->
17+
<project xmlns="http://maven.apache.org/POM/4.0.0"
18+
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
19+
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
20+
<modelVersion>4.0.0</modelVersion>
21+
22+
<groupId>com.google.cloud.bigtable.hbase.enforcer.it</groupId>
23+
<artifactId>verify-published-pom-deps-stripped</artifactId>
24+
<version>1.0-SNAPSHOT</version>
25+
26+
<description>
27+
Reproduces MSHADE-419: the shaded jar is attached under a classifier, so the main artifact is
28+
the thin unshaded jar, yet the generated dependency-reduced pom still strips its compile deps.
29+
The check must fail rather than let such a pom be published.
30+
</description>
31+
32+
<properties>
33+
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
34+
</properties>
35+
36+
<build>
37+
<plugins>
38+
<plugin>
39+
<groupId>org.apache.maven.plugins</groupId>
40+
<artifactId>maven-shade-plugin</artifactId>
41+
<version>3.6.0</version>
42+
<executions>
43+
<execution>
44+
<phase>package</phase>
45+
<goals>
46+
<goal>shade</goal>
47+
</goals>
48+
<configuration>
49+
<shadedArtifactAttached>true</shadedArtifactAttached>
50+
<createDependencyReducedPom>true</createDependencyReducedPom>
51+
<filters>
52+
<filter>
53+
<artifact>*:*</artifact>
54+
<excludes>
55+
<exclude>META-INF/*.MF</exclude>
56+
</excludes>
57+
</filter>
58+
</filters>
59+
</configuration>
60+
</execution>
61+
</executions>
62+
</plugin>
63+
64+
<plugin>
65+
<groupId>com.google.cloud.bigtable.test</groupId>
66+
<artifactId>bigtable-build-helper</artifactId>
67+
<version>2.20.2-SNAPSHOT</version> <!-- {x-version-update:bigtable-client-parent:current} -->
68+
<executions>
69+
<execution>
70+
<id>test</id>
71+
<goals>
72+
<goal>verify-published-pom-deps</goal>
73+
</goals>
74+
<configuration>
75+
<requiredDependencies>
76+
<requiredDependency>com.google.guava:guava</requiredDependency>
77+
</requiredDependencies>
78+
</configuration>
79+
</execution>
80+
</executions>
81+
</plugin>
82+
</plugins>
83+
</build>
84+
85+
<!-- Do not upgrade these dependencies, they are only used as a test subject -->
86+
<dependencies>
87+
<dependency>
88+
<groupId>com.google.guava</groupId>
89+
<artifactId>guava</artifactId>
90+
<version>30.1-android</version>
91+
</dependency>
92+
</dependencies>
93+
</project>

‎bigtable-test/bigtable-build-helper/src/it/verify-published-pom-deps-stripped/verify.bsh‎

Lines changed: 36 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,36 @@
1+
/*
2+
* Copyright 2026 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
import java.nio.file.Files;
17+
18+
File buildLog = new File(basedir, "build.log");
19+
String content = new String(Files.readAllBytes(buildLog.toPath()));
20+
21+
boolean success = true;
22+
23+
assertContains(s) {
24+
if (!content.contains(s)) {
25+
print( "FAILED: Expected build log to contain: " + s);
26+
success = false;
27+
}
28+
}
29+
30+
assertContains("[ERROR] com.google.guava:guava is missing from the pom that will be published");
31+
assertContains("createDependencyReducedPom");
32+
33+
if (!success) {
34+
throw new IllegalStateException("Build output was missing expected details, "
35+
+ "see target/it/verify-published-pom-deps-stripped/build.log for more details");
36+
}

0 commit comments

Comments
 (0)