Fix dependency cve monitor list and add new workflow to verify list - #7274
Conversation
| -DtransitiveExcludes=*:* | ||
| -DclasspathScope=runtime | ||
| -pl !build-tools,!release-scripts,!archetypes,!test/test-utils,!test/sdk-benchmarks,!test/http-client-tests,!test/http-client-benchmarks,!test/s3-benchmarks,!test/protocol-tests-core,!test/ruleset-testing-core,!test/protocol-tests,!test/service-test-utils,!test/codegen-generated-classes-test,!test/sdk-standard-benchmarks,!test/module-path-tests,!test/tests-coverage-reporting,!test/stability-tests,!test/sdk-native-image-test,!test/auth-tests,!test/region-testing,!test/old-client-version-compatibility-test,!test/bundle-logging-bridge-binding-test,!test/v2-migration-tests,!test/bundle-shading-tests,!test/crt-unavailable-tests,!test/architecture-tests,!test/s3-tests | ||
| -pl !build-tools,!release-scripts,!archetypes,!test/test-utils,!test/sdk-benchmarks,!test/http-client-tests,!test/http-client-benchmarks,!test/s3-benchmarks,!test/protocol-tests-core,!test/ruleset-testing-core,!test/protocol-tests,!test/service-test-utils,!test/codegen-generated-classes-test,!test/sdk-standard-benchmarks,!test/module-path-tests,!test/tests-coverage-reporting,!test/stability-tests,!test/sdk-native-image-test,!test/auth-tests,!test/service-client-backward-compat-test,!test/bundle-logging-bridge-binding-test,!test/v2-migration-tests,!test/bundle-shading-tests,!test/crt-unavailable-tests,!test/architecture-tests,!test/s3-tests |
There was a problem hiding this comment.
not blocking: seems like this same list occurs is multiple places. We should move it to a single central location (e.g. NON_PUBLISHED_MODULES or something) that can be updated once and all other build scripts can just reference it
There was a problem hiding this comment.
It seems this exact list is only present here. We have a similar exclusion list generated by generate-modules-to-skip.sh for Maven and Docs, but that one dynamically derives it from ls test/, and also excludes (publishes) 5 test modules. This one can't easily do the same since it's a YAML input to a third-party GitHub Action.
|
This pull request has been closed and the conversation has been locked. Comments on closed PRs are hard for our team to see. If you need more assistance, please open a new issue that references this one. |
3 participants
Motivation and Context
The dependency-cve-monitor workflow started failing after #7161 removed
test/region-testingand renamedtest/old-client-version-compatibility-test.Modifications
dependency-cve-monitor.ymlto removetest/region-testingand fix to renamedtest/service-client-backward-compat-testcve-monitor-list-check.yml— a PR check that validates all entries in the-plexclusion list still exist in the reactor, so this class of breakage is caught before merge.Testing
Ran the validation script locally against the current pom.xml — passes with stale entries removed, fails if they're re-added.
Types of changes