Skip to content

Stop publishing feign-bom twice during release - #3568

Merged
velo merged 1 commit into
masterfrom
fix/remove-duplicate-bom-publish
Sep 9, 2026
Merged

Stop publishing feign-bom twice during release#3568
velo merged 1 commit into
masterfrom
fix/remove-duplicate-bom-publish

Conversation

@velo

@velo velo commented Sep 9, 2026

Copy link
Copy Markdown
Member

Removes the Publish BOM to Maven Central step from the release job. feign-bom is already published by the regular reactor deploy, so this step uploaded a second, competing copy of the same coordinates on every release.

What went wrong in 13.15

The step's bundle upload was rejected by Central:

Component with package url: 'pkg:maven/io.github.openfeign/feign-bom@13.15?type=pom' already exists

The CircleCI job still went green, because the step only checks that the upload returns 201. Central validates asynchronously, so the failure surfaced later in the publisher portal and left a FAILED deployment sitting there to be dropped by hand.

Why the step is obsolete

It was added in a551824 (Feb 2026), back when the reactor deploy did not produce a usable BOM. That changed in 44f688e (#3508, Aug 2026), which put flatten-maven-plugin with flattenMode=bom on feign-bom. Since 13.14 the reactor deploy has been publishing the BOM on its own, and this step has been a duplicate.

The published feign-bom-13.15.pom confirms which one won — it has no <parent>, <build> or <properties>, i.e. it is the flattened artifact from the reactor deploy.

Why it is worth deleting rather than guarding

The step uploads target/classes/feign-bom/pom.xml, the raw sundr-generated POM, which still carries <parent>, <build> and <properties>. That is precisely the unflattened shape #3508 removed because it overrides consumer dependency management. Today the duplicate loses the race and is rejected; if it ever won, it would republish the bug.

Verification

  • circleci config validate passes.
  • nexus-deploy now has a single step, Deploy Core Modules Sonatype.
  • feign-bom is not in the deploy's -pl exclusion list, so the reactor continues to publish it.
  • On Central, 43 of the 45 BOM-listed modules are live at 13.15. The two absent ones, feign-vertx4-test and feign-vertx5-test, are excluded from the deploy on purpose and are also missing at 13.14 — a pre-existing wart, untouched here.

CI-only change; no Maven or Java sources affected.

Signed-off-by: Marvin Froeder <velo.br@gmail.com>
@velo
velo merged commit e2a1e27 into master Sep 9, 2026
4 checks passed
@velo
velo deleted the fix/remove-duplicate-bom-publish branch September 9, 2026 18:07
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant