Skip to content

fix: stop publishing a bigtable-beam-import pom with no dependencies #4632

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
mutianf merged 2 commits into from
Sep 3, 2026
Merged

fix: stop publishing a bigtable-beam-import pom with no dependencies #4632

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
1d0f89a
fix: stop publishing a bigtable-beam-import pom with no dependencies
mutianf Sep 3, 2026
23d3938
fix: guard against a missing or half-declared pom in verify-published…
mutianf Sep 3, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
39 changes: 39 additions & 0 deletions bigtable-dataflow-parent/bigtable-beam-import/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -320,6 +320,14 @@ limitations under the License.
</executions>
<configuration>
<shadedArtifactAttached>true</shadedArtifactAttached>
<!-- The shaded jar is attached under a classifier, so the main artifact is the thin,
unshaded jar and it still needs every one of its compile dependencies declared.
A dependency-reduced pom would strip them and leave consumers with nothing to
resolve (MSHADE-419 does exactly that in shade >= 3.3.0, which shipped broken
poms in 2.20.0 and 2.20.1). Set explicitly rather than relying on the plugin
default, whose behavior here changed between 3.2.4 and 3.6.0.
Guarded by the verify-published-pom-deps check below. -->
<createDependencyReducedPom>false</createDependencyReducedPom>
<transformers>
<transformer implementation="org.apache.maven.plugins.shade.resource.ServicesResourceTransformer" />
<transformer implementation="org.apache.maven.plugins.shade.resource.ManifestResourceTransformer" />
Expand Down Expand Up @@ -378,6 +386,37 @@ limitations under the License.
<skip>true</skip>
</configuration>
</plugin>

<plugin>
<groupId>com.google.cloud.bigtable.test</groupId>
<artifactId>bigtable-build-helper</artifactId>
<version>2.20.2-SNAPSHOT</version> <!-- {x-version-update:bigtable-client-parent:current} -->
<executions>
<execution>
<id>verify-published-pom-deps</id>
<phase>verify</phase>
<goals>
<goal>verify-published-pom-deps</goal>
</goals>
<configuration>
<!-- The main artifact is the thin, unshaded jar, so these have to survive into the
published pom. Shade stripped every one of them in 2.20.0 and 2.20.1, which
broke downstream consumers (e.g. DataflowTemplates) with a
NoClassDefFoundError that no build in this repo could reproduce. -->
<requiredDependencies>
<requiredDependency>com.google.cloud.bigtable:bigtable-hbase-beam</requiredDependency>
<requiredDependency>org.apache.beam:beam-sdks-java-core</requiredDependency>
<requiredDependency>org.apache.beam:beam-sdks-java-io-hadoop-format</requiredDependency>
<requiredDependency>org.apache.beam:beam-runners-google-cloud-dataflow-java</requiredDependency>
<requiredDependency>org.apache.hadoop:hadoop-client-api</requiredDependency>
<requiredDependency>org.apache.hadoop:hadoop-client-runtime</requiredDependency>
<requiredDependency>org.apache.hbase:hbase-shaded-mapreduce</requiredDependency>
<requiredDependency>com.google.cloud.bigdataoss:gcs-connector</requiredDependency>
</requiredDependencies>
</configuration>
</execution>
</executions>
</plugin>
</plugins>
</build>

Expand Down
91 changes: 91 additions & 0 deletions bigtable-test/bigtable-build-helper/src/it/verify-published-pom-deps-ok/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,91 @@
<?xml version="1.0" encoding="UTF-8"?>
<!--
Copyright 2026 Google LLC

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>

<!-- groupId is deliberately com.google.guava so that the dependency below can be declared as
${project.groupId} and exercise the interpolation the real bigtable-beam-import pom needs -->
<groupId>com.google.guava</groupId>
<artifactId>verify-published-pom-deps-ok</artifactId>
<version>1.0-SNAPSHOT</version>

<description>Test project where the attached shaded jar leaves the published pom's compile deps intact</description>

<properties>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
</properties>

<build>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-shade-plugin</artifactId>
<version>3.6.0</version>
<executions>
<execution>
<phase>package</phase>
<goals>
<goal>shade</goal>
</goals>
<configuration>
<shadedArtifactAttached>true</shadedArtifactAttached>
<createDependencyReducedPom>false</createDependencyReducedPom>
<filters>
<filter>
<artifact>*:*</artifact>
<excludes>
<exclude>META-INF/*.MF</exclude>
</excludes>
</filter>
</filters>
</configuration>
</execution>
</executions>
</plugin>

<plugin>
<groupId>com.google.cloud.bigtable.test</groupId>
<artifactId>bigtable-build-helper</artifactId>
<version>2.20.2-SNAPSHOT</version> <!-- {x-version-update:bigtable-client-parent:current} -->
<executions>
<execution>
<id>test</id>
<goals>
<goal>verify-published-pom-deps</goal>
</goals>
<configuration>
<requiredDependencies>
<requiredDependency>com.google.guava:guava</requiredDependency>
</requiredDependencies>
</configuration>
</execution>
</executions>
</plugin>
</plugins>
</build>

<!-- Do not upgrade these dependencies, they are only used as a test subject -->
<dependencies>
<dependency>
<groupId>${project.groupId}</groupId>
<artifactId>guava</artifactId>
<version>30.1-android</version>
</dependency>
</dependencies>
</project>
1 change: 1 addition & 0 deletions ...e-test/bigtable-build-helper/src/it/verify-published-pom-deps-stripped/invoker.properties
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1 @@
invoker.buildResult = failure
93 changes: 93 additions & 0 deletions bigtable-test/bigtable-build-helper/src/it/verify-published-pom-deps-stripped/pom.xml
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,93 @@
<?xml version="1.0" encoding="UTF-8"?>
<!--
Copyright 2026 Google LLC

Licensed under the Apache License, Version 2.0 (the "License");
you may not use this file except in compliance with the License.
You may obtain a copy of the License at

http://www.apache.org/licenses/LICENSE-2.0

Unless required by applicable law or agreed to in writing, software
distributed under the License is distributed on an "AS IS" BASIS,
WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
See the License for the specific language governing permissions and
limitations under the License.
-->
<project xmlns="http://maven.apache.org/POM/4.0.0"
xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
<modelVersion>4.0.0</modelVersion>

<groupId>com.google.cloud.bigtable.hbase.enforcer.it</groupId>
<artifactId>verify-published-pom-deps-stripped</artifactId>
<version>1.0-SNAPSHOT</version>

<description>
Reproduces MSHADE-419: the shaded jar is attached under a classifier, so the main artifact is
the thin unshaded jar, yet the generated dependency-reduced pom still strips its compile deps.
The check must fail rather than let such a pom be published.
</description>

<properties>
<project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
</properties>

<build>
<plugins>
<plugin>
<groupId>org.apache.maven.plugins</groupId>
<artifactId>maven-shade-plugin</artifactId>
<version>3.6.0</version>
<executions>
<execution>
<phase>package</phase>
<goals>
<goal>shade</goal>
</goals>
<configuration>
<shadedArtifactAttached>true</shadedArtifactAttached>
<createDependencyReducedPom>true</createDependencyReducedPom>
<filters>
<filter>
<artifact>*:*</artifact>
<excludes>
<exclude>META-INF/*.MF</exclude>
</excludes>
</filter>
</filters>
</configuration>
</execution>
</executions>
</plugin>

<plugin>
<groupId>com.google.cloud.bigtable.test</groupId>
<artifactId>bigtable-build-helper</artifactId>
<version>2.20.2-SNAPSHOT</version> <!-- {x-version-update:bigtable-client-parent:current} -->
<executions>
<execution>
<id>test</id>
<goals>
<goal>verify-published-pom-deps</goal>
</goals>
<configuration>
<requiredDependencies>
<requiredDependency>com.google.guava:guava</requiredDependency>
</requiredDependencies>
</configuration>
</execution>
</executions>
</plugin>
</plugins>
</build>

<!-- Do not upgrade these dependencies, they are only used as a test subject -->
<dependencies>
<dependency>
<groupId>com.google.guava</groupId>
<artifactId>guava</artifactId>
<version>30.1-android</version>
</dependency>
</dependencies>
</project>
36 changes: 36 additions & 0 deletions bigtable-test/bigtable-build-helper/src/it/verify-published-pom-deps-stripped/verify.bsh
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,36 @@
/*
* Copyright 2026 Google LLC
*
* Licensed under the Apache License, Version 2.0 (the "License");
* you may not use this file except in compliance with the License.
* You may obtain a copy of the License at
*
* http://www.apache.org/licenses/LICENSE-2.0
*
* Unless required by applicable law or agreed to in writing, software
* distributed under the License is distributed on an "AS IS" BASIS,
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
* See the License for the specific language governing permissions and
* limitations under the License.
*/
import java.nio.file.Files;

File buildLog = new File(basedir, "build.log");
String content = new String(Files.readAllBytes(buildLog.toPath()));

@gemini-code-assist gemini-code-assist Bot Sep 3, 2026

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

medium

Reading the file bytes into a String without specifying a charset uses the platform's default encoding. This can lead to flaky or failing tests on environments (like Windows runners in CI) where the default encoding is not UTF-8. It is safer to explicitly specify StandardCharsets.UTF_8.

String content = new String(Files.readAllBytes(buildLog.toPath()), java.nio.charset.StandardCharsets.UTF_8);

@mutianf mutianf Sep 3, 2026

Copy link
Copy Markdown
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Skipping this one. Both assertion strings are pure ASCII, which decodes identically under any charset this would realistically run with, so there is no flakiness to fix. The three existing verify.bsh files in this module (verify-shaded-jar-entries-leak, verify-shaded-exclusions-unpromoted, verify-mirror-deps-misaligned) all read the build log the same way, and making only the new one differ costs consistency for no behavior change. Worth doing as a sweep across all four if we ever want it.


boolean success = true;

assertContains(s) {
if (!content.contains(s)) {
print( "FAILED: Expected build log to contain: " + s);
success = false;
}
}

assertContains("[ERROR] com.google.guava:guava is missing from the pom that will be published");
assertContains("createDependencyReducedPom");

if (!success) {
throw new IllegalStateException("Build output was missing expected details, "
+ "see target/it/verify-published-pom-deps-stripped/build.log for more details");
}
Loading
Loading