Centrally Manage Dependency Versions for google-auth-library and the rest of the libraries in google-cloud-java

Aperta
  • Qualcosa non va?
#13,176 0 commenti 0 reazioni 0 assegnatari Vedi su GitHub

I maintainer di solito rispondono entro 1 giorno

Nessuno ha ancora preso questa issue.

Valutazione

Difficoltà
5/5
Tempo stimato
Più di una settimana
Idoneità per principianti
25/100
Tipo di issue
Refactoring
Chiarezza
Da chiarire
Stato di attività
Tranquilla
Stack tecnologico
java
Ambito
build-system, release

Direzione di ricerca

Confronta le proprietà delle dipendenze in google-auth-library-java/pom.xml con quelle in sdk-platform-java/gapic-generator-java-pom-parent/pom.xml, quindi esamina i tre approcci proposti. Prima dell'implementazione è necessaria una decisione del maintainer; «done» deve significare che le versioni delle dipendenze condivise sono gestite in modo coerente senza creare una dipendenza circolare di staging di Maven Central.

Scritto dal modello di indicizzazione a partire dal testo della issue.

Descrizione

priority: p1 type: feature request

The Problem: Auth Dependencies Are Managed Separately

Currently, the google-auth-library-java module manages its third-party dependencies (like Guava, Protobuf, Jackson, and JUnit) separately within its own local <properties> block. The rest of the monorepo manages identical dependencies inside gapic-generator-java-pom-parent.

This duplicates versions and increases the risk of dependency drift across the monorepo:

  • google-auth-library-java/pom.xml
  • sdk-platform-java/gapic-generator-java-pom-parent/pom.xml

Because com.google.auth and com.google.cloud deploy under different staging profiles on Maven Central, they are uploaded to separate staging repositories. If google-auth-library-java references unreleased in-development versions of com.google.cloud parent POMs or BOMs, a circular release staging deadlock is created at release time.

Proposed Solutions

Option 1: Extract Version Properties to google-cloud-shared-config

Move shared version properties (like <guava.version>) into the external parent POM com.google.cloud:google-cloud-shared-config from which both modules inherit.

  • Pros:
    • Single, definitive source of truth at the parent configuration level.
    • Completely clean code structure with zero duplicate config.
  • Cons:
    • Rigid Release Pipeline: Upgrading a dependency (like an urgent security CVE patch) requires releasing a new version of google-cloud-shared-config to Maven Central first, waiting for Central's CDN to sync, and then updating the parent references in both projects.
Option 2: Extract Versions to a Common Base BOM Module (in Monorepo)

Introduce a lightweight, internal BOM module (e.g., base-shared-dependencies) in this monorepo containing only the third-party library versions. Both the auth library and client library BOMs would import it.

  • Pros:
    • Prevents circular staging deadlocks by maintaining a strictly acyclic dependency graph.
    • Single source of truth located directly within the same monorepo.
  • Cons:
    • Release Staging Delay: Due to staging profile boundaries, releases must be built sequentially (waiting for the base BOM to fully sync to Maven Central before releasing the auth library, and then repeating before client libraries can release).
Option 3: Keep It as It Is and Use Automation to Update

Keep the properties blocks isolated inside their respective directories, but coordinate updates strictly using Renovate Bot or other CI scripting to bump them in parallel.

  • Pros:
    • Maximum Autonomy: The auth team can delay upgrades to preserve legacy client compatibility (like Firebase/Android) without blocking the client libraries.
    • Zero Release Bottlenecks: No sequential staging wait-times; both projects release in parallel.
  • Cons:
    • Relies on external tooling and automation scripts to maintain consistency; human error/drift is still possible if manually edited.
Lingua principale
Java
Stelle
2.1k
Fork
1.2k
Merge medio
2g 14h
PR unite (30g)
192

Preparare l'ambiente

Come iniziare

  1. Leggi tutta la issue e poi la guida ai contributi del progetto.
  2. Commenta sulla issue per dire che te ne occupi tu — evita che due persone facciano lo stesso lavoro.
  3. Fai un fork del repository e lavora su un branch.
  4. Apri una pull request che faccia riferimento al numero della issue.

Altre issue di googleapis/google-cloud-java

Tutte le issue di googleapis/google-cloud-java

Issue simili

Altre issue su Java

Ricevi le nuove issue nella tua casella

Un breve riepilogo di issue GitHub adatte ai principianti.