Centrally Manage Dependency Versions for google-auth-library and the rest of the libraries in google-cloud-java

未關閉
  • 哪裡不對？
#13,176 0 則留言 0 個 reaction 已指派 0 人 在 GitHub 檢視

維護者通常 1 天內回覆

還沒有人認領這個 Issue。

評估

難度
5/5
預估耗時
一週以上
新手友好度
25/100
Issue 類型
重構
描述清晰度
需要釐清
活躍度
冷清
技術堆疊
java
領域
build-system, release

研究方向

將 google-auth-library-java/pom.xml 中的相依性屬性與 sdk-platform-java/gapic-generator-java-pom-parent/pom.xml 中的相依性屬性進行比較，然後審查提出的三種方法。實作前需要 maintainer 作出決定；done 應表示以一致的方式管理共用相依性版本，同時不建立循環的 Maven Central staging 相依性。

由索引模型根據 Issue 內容生成。

描述

priority: p1 type: feature request

The Problem: Auth Dependencies Are Managed Separately

Currently, the google-auth-library-java module manages its third-party dependencies (like Guava, Protobuf, Jackson, and JUnit) separately within its own local <properties> block. The rest of the monorepo manages identical dependencies inside gapic-generator-java-pom-parent.

This duplicates versions and increases the risk of dependency drift across the monorepo:

  • google-auth-library-java/pom.xml
  • sdk-platform-java/gapic-generator-java-pom-parent/pom.xml

Because com.google.auth and com.google.cloud deploy under different staging profiles on Maven Central, they are uploaded to separate staging repositories. If google-auth-library-java references unreleased in-development versions of com.google.cloud parent POMs or BOMs, a circular release staging deadlock is created at release time.

Proposed Solutions

Option 1: Extract Version Properties to google-cloud-shared-config

Move shared version properties (like <guava.version>) into the external parent POM com.google.cloud:google-cloud-shared-config from which both modules inherit.

  • Pros:
    • Single, definitive source of truth at the parent configuration level.
    • Completely clean code structure with zero duplicate config.
  • Cons:
    • Rigid Release Pipeline: Upgrading a dependency (like an urgent security CVE patch) requires releasing a new version of google-cloud-shared-config to Maven Central first, waiting for Central's CDN to sync, and then updating the parent references in both projects.
Option 2: Extract Versions to a Common Base BOM Module (in Monorepo)

Introduce a lightweight, internal BOM module (e.g., base-shared-dependencies) in this monorepo containing only the third-party library versions. Both the auth library and client library BOMs would import it.

  • Pros:
    • Prevents circular staging deadlocks by maintaining a strictly acyclic dependency graph.
    • Single source of truth located directly within the same monorepo.
  • Cons:
    • Release Staging Delay: Due to staging profile boundaries, releases must be built sequentially (waiting for the base BOM to fully sync to Maven Central before releasing the auth library, and then repeating before client libraries can release).
Option 3: Keep It as It Is and Use Automation to Update

Keep the properties blocks isolated inside their respective directories, but coordinate updates strictly using Renovate Bot or other CI scripting to bump them in parallel.

  • Pros:
    • Maximum Autonomy: The auth team can delay upgrades to preserve legacy client compatibility (like Firebase/Android) without blocking the client libraries.
    • Zero Release Bottlenecks: No sequential staging wait-times; both projects release in parallel.
  • Cons:
    • Relies on external tooling and automation scripts to maintain consistency; human error/drift is still possible if manually edited.
主要語言
Java
星號
2.1k
分支
1.2k
平均合併
2 天 14 小時
30 天內合併 PR
192

環境準備

  • 沒有 Dockerfile 或 Docker Compose 檔案
  • 沒有 Pull Request 範本
  • 閱讀貢獻指南

從這裡開始

  1. 先讀完整個 Issue，再讀專案的貢獻指南。
  2. 在 Issue 下留言說明你要接手 —— 這能避免兩個人做同樣的事。
  3. Fork 儲存庫，在一個分支上完成修改。
  4. 送出 Pull Request，並在描述裡引用這個 Issue 編號。

googleapis/google-cloud-java 的其他 Issue

查看 googleapis/google-cloud-java 的全部 Issue

相似的 Issue

更多 Java Issue

把新 issue 寄到你的電子郵件信箱

精選適合新手參與的 GitHub issue 摘要。