KH-520: Track dependency changes in maven sub modules.

[corneliouzbett]

• Tracks dependency changes in maven sub modules.

[rbuisson]

Looks good @corneliouzbett .
One possible concern which might not apply.
In the case of Oz Kh, the root project does not generate any dependency report at all. I want to make sure that this won't trigger a false positive and rebuild/redeploy the distro every time the check runs.

[corneliouzbett]

This if block checks for the dependency report, if it doesn't exist we don't set echo hasChanged=$diff_rc >> "$GITHUB_OUTPUT" hence hasChanged will be null or undefined which is falsy, unless other sub-modules detect changes.

This is an output for recent test build on kh branch with latest changes.

Error:  Failed to execute goal org.apache.maven.plugins:maven-dependency-plugin:3.6.0:copy (default-cli) on project ozone-cambodia-aggregator: Unable to find/resolve artifact.: Could not find artifact com.ozonehis:ozone-cambodia-aggregator:txt:null:1.7.0-SNAPSHOT -> [Help 1]
Error:  
Error:  To see the full stack trace of the errors, re-run Maven with the -e switch.
Error:  Re-run Maven using the -X switch to enable full debug logging.
Error:  
Error:  For more information about the errors and possible solutions, please read the following articles:
Error:  [Help 1] http://cwiki.apache.org/confluence/display/MAVEN/MojoExecutionException
Error:  
Error:  After correcting the problems, you can resume the build with the command
Error:    mvn <args> -rf :ozone-cambodia-aggregator
Remote dependency file is not found at '/tmp/ozone-cambodia-aggregator-1.7.0-SNAPSHOT-null object or invalid expression.txt'. Creating an empty one and continue.
Compare both dependency reports...
File ./target/ozone-cambodia-aggregator-1.7.0-SNAPSHOT-null object or invalid expression.txt does not exist.
/home/runner/work/ozone-distro-cambodia/ozone-distro-cambodia

[corneliouzbett]

Of course, we will still need to monitor this. I will need to test across other projects using this workflow before merging.

[rbuisson]

There is a edge case where the dependency report may not be present on the remote yet (first time deploying this project with the dep report enabled). In such case, we may want to consider that "no remote report" = "trigger a rebuild/redeploy".

[corneliouzbett]

This is handled by this block:

    # If no dependency report was fetched, create an empty one.
    if [ ! -f "$absolutePath" ]; then
        echo "Remote dependency file is not found at '${absolutePath}'. Creating an empty one and continue."
        touch "${absolutePath}"
    else
        echo "Remote dependency file saved at '${absolutePath}'."
    fi

This means that if the remote dependency report is missing, an empty file is created to represent the remote dependencies. When this empty file is compared with the compiled dependency report (which is expected to contain actual dependency information), the diff command will likely indicate differences unless the compiled report is also empty. Thus, changes detected = rebuild + redeploy

[corneliouzbett]

In the case of Oz Kh, the root project does not generate any dependency report at all. I want to make sure that this won't trigger a false positive and rebuild/redeploy the distro every time the check runs.

That wouldn't happen because the comparison between the remote dependency report and the compiled dependency report only occurs if the compiled dependency report exists. If it doesn't we skip the comparison and echo the file doesn't exist.