feat: order lockfile entries by groupId, artifactId and version (#890)

Author: massimeddu-sj

maven_plugin/src/main/java/io/github/chains_project/maven_lockfile/LockFileFacade.java

@@ -99,7 +99,7 @@ public static LockFile generateLockFileFromProject(
         var roots = graph.getGraph().stream()
                 .filter(v -> v.getParent() == null)
                 .collect(Collectors.toCollection(() -> new TreeSet<>(Comparator.comparing(
-                        io.github.chains_project.maven_lockfile.graph.DependencyNode::getChecksum))));
+                        io.github.chains_project.maven_lockfile.graph.DependencyNode::getComparatorString))));
         return new LockFile(
                 GroupId.of(project.getGroupId()),
                 ArtifactId.of(project.getArtifactId()),

maven_plugin/src/main/java/io/github/chains_project/maven_lockfile/graph/DependencyGraph.java

@@ -20,7 +20,7 @@ public Set<DependencyNode> getRoots() {
         return graph.stream()
                 .filter(node -> node.getParent() == null)
                 .collect(Collectors.toCollection(
-                        () -> new TreeSet<>(Comparator.comparing(DependencyNode::getChecksum))));
+                        () -> new TreeSet<>(Comparator.comparing(DependencyNode::getComparatorString))));
     }
 
     private DependencyGraph(Set<DependencyNode> graph) {
@@ -60,15 +60,15 @@ public static DependencyGraph of(
         var roots = graph.nodes().stream()
                 .filter(it -> graph.predecessors(it).isEmpty())
                 .collect(Collectors.toList());
-        Set<DependencyNode> nodes = new TreeSet<>(Comparator.comparing(DependencyNode::getChecksum));
+        Set<DependencyNode> nodes = new TreeSet<>(Comparator.comparing(DependencyNode::getComparatorString));
         for (var artifact : roots) {
             createDependencyNode(artifact, graph, calc, true, reduced).ifPresent(nodes::add);
         }
         // maven dependency tree contains the project itself as a root node. We remove it here.
         Set<DependencyNode> dependencyRoots = nodes.stream()
                 .flatMap(v -> v.getChildren().stream())
                 .collect(Collectors.toCollection(
-                        () -> new TreeSet<>(Comparator.comparing(DependencyNode::getChecksum))));
+                        () -> new TreeSet<>(Comparator.comparing(DependencyNode::getComparatorString))));
         dependencyRoots.forEach(v -> v.setParent(null));
         return new DependencyGraph(dependencyRoots);
     }

maven_plugin/src/main/java/io/github/chains_project/maven_lockfile/graph/DependencyNode.java

@@ -61,7 +61,7 @@ public class DependencyNode implements Comparable<DependencyNode> {
         this.classifier = classifier;
         this.checksumAlgorithm = checksumAlgorithm;
         this.checksum = checksum;
-        this.children = new TreeSet<>(Comparator.comparing(DependencyNode::getChecksum));
+        this.children = new TreeSet<>(Comparator.comparing(DependencyNode::getComparatorString));
         this.id = new NodeId(groupId, artifactId, version);
         this.scope = scope;
     }
@@ -231,4 +231,9 @@ public String toString() {
                 + ", scope=" + scope + ", selectedVersion=" + selectedVersion + ", id=" + id + ", parent=" + parent
                 + ", children=" + children + "]";
     }
+
+    public String getComparatorString() {
+        return this.getGroupId().getValue() + ":" + this.getArtifactId().getValue() + "@"
+                + this.getVersion().getValue() + "-" + this.getChecksum();
+    }
 }

maven_plugin/src/test/java/it/IntegrationTestsIT.java

@@ -3,6 +3,7 @@
 import static com.soebes.itf.extension.assertj.MavenITAssertions.assertThat;
 import static org.junit.jupiter.api.Assertions.assertTrue;
 
+import com.google.common.collect.Ordering;
 import com.soebes.itf.jupiter.extension.MavenJupiterExtension;
 import com.soebes.itf.jupiter.extension.MavenTest;
 import com.soebes.itf.jupiter.maven.MavenExecutionResult;
@@ -19,6 +20,7 @@
 import java.nio.file.Path;
 import java.util.ArrayList;
 import java.util.List;
+import java.util.stream.Collectors;
 import org.apache.commons.io.FileUtils;
 import org.apache.maven.model.Dependency;
 import org.apache.maven.model.Model;
@@ -315,4 +317,18 @@ public void withoutEnvironmentFromLockfile(MavenExecutionResult result) throws E
         assertThat(lockFile.getConfig().isIncludeEnvironment()).isFalse();
         assertThat(lockFile.getEnvironment()).isNull();
     }
+
+    @MavenTest
+    public void orderedLockfile(MavenExecutionResult result) throws Exception {
+        // contract: the dependency list should be ordered
+        assertThat(result).isSuccessful();
+        Path lockFilePath = findFile(result, "lockfile.json");
+        assertThat(lockFilePath).exists();
+        var lockFile = LockFile.readLockFile(lockFilePath);
+        var dependencyList = lockFile.getDependencies().stream()
+                .map(it -> it.getComparatorString())
+                .collect(Collectors.toList());
+        boolean sorted = Ordering.natural().isOrdered(dependencyList);
+        assertThat(sorted).isTrue();
+    }
 }

maven_plugin/src/test/resources-its/it/IntegrationTestsIT/orderedLockfile/pom.xml

@@ -0,0 +1,52 @@
+<project>
+  <modelVersion>4.0.0</modelVersion>
+
+  <groupId>com.mycompany.app</groupId>
+  <artifactId>my-app</artifactId>
+  <packaging>jar</packaging>
+  <version>1</version>
+  <properties>
+    <maven.compiler.target>11</maven.compiler.target>
+    <maven.compiler.source>11</maven.compiler.source>
+    <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+  </properties>
+  <dependencies>
+    <dependency>
+      <groupId>org.junit.jupiter</groupId>
+      <artifactId>junit-jupiter-api</artifactId>
+      <version>5.9.2</version>
+    </dependency>
+    <dependency>
+      <groupId>org.junit.jupiter</groupId>
+      <artifactId>junit-jupiter-api</artifactId>
+      <version>5.9.2</version>
+      <classifier>sources</classifier>
+    </dependency>
+    <dependency>
+      <groupId>org.junit.jupiter</groupId>
+      <artifactId>junit-jupiter-api</artifactId>
+      <version>5.9.2</version>
+      <classifier>javadoc</classifier>
+    </dependency>
+  </dependencies>
+  <build>
+    <plugins>
+      <plugin>
+        <groupId>io.github.chains-project</groupId>
+        <artifactId>
+          maven-lockfile</artifactId>
+        <version>@project.version@</version>
+        <executions>
+          <execution>
+            <goals>
+              <goal>generate</goal>
+            </goals>
+          </execution>
+        </executions>
+        <configuration>
+          <includeEnvironment>false</includeEnvironment>
+        </configuration>
+      </plugin>
+    </plugins>
+  </build>
+</project>

maven_plugin/src/test/resources-its/it/IntegrationTestsIT/orderedLockfile/src/main/java/HelloWorld.java

@@ -0,0 +1,7 @@
+package simpleProject.src.main.java;
+
+public class HelloWorld {
+  public static void main(String[] args) {
+    System.out.println("Hello World!");
+  }
+}