phanikumv commented on code in PR #69582:
URL: https://github.com/apache/airflow/pull/69582#discussion_r3542230649


##########
java-sdk/bom/build.gradle.kts:
##########
@@ -48,3 +53,45 @@ publishing {
         }
     }
 }
+
+// What the BOM currently constrains (group org.apache.airflow).
+val bomArtifacts =
+    configurations["api"].dependencyConstraints
+        .filter { it.group == "org.apache.airflow" }
+        .map { it.name }
+        .toSet()
+
+val publishedArtifacts =
+    rootProject.subprojects
+        .filter { it.path != project.path }
+        .flatMap { sub ->
+            evaluationDependsOn(sub.path)
+            sub.extensions.findByType(PublishingExtension::class.java)
+                ?.publications
+                ?.withType(MavenPublication::class.java)
+                ?.filter { it.groupId == "org.apache.airflow" }
+                ?.map { it.artifactId }
+                ?: emptyList()
+        }
+        .toSet()
+
+val verifyBomCoverage by tasks.registering {
+    group = "verification"
+    description = "Fail if airflow-sdk-bom does not constrain the same set of 
published Java SDK artifacts."
+    doLast {
+        val missing = (publishedArtifacts - bomArtifacts).sorted()
+        val stale = (bomArtifacts - publishedArtifacts).sorted()
+        if (missing.isNotEmpty() || stale.isNotEmpty()) {
+            throw GradleException(
+                buildString {
+                    appendLine("airflow-sdk-bom is out of sync with the 
published Java SDK artifacts:")
+                    if (missing.isNotEmpty()) appendLine("  published but 
missing from the BOM: $missing")
+                    if (stale.isNotEmpty()) appendLine("  listed in the BOM 
but not published: $stale")
+                    append("Update constraints in bom/build.gradle.kts to 
match.")
+                },
+            )
+        }
+    }
+}
+
+tasks.named("check") { dependsOn(verifyBomCoverage) }

Review Comment:
   `verifyBomCoverage` runs as a dependency of `check`, but the Java SDK CI job 
runs `./gradlew test` (ci-amd.yml / ci-arm.yml), and `test` doesn't trigger 
`check`. 
   
   So this guard won't fire on a PR that adds a published module and forgets 
the BOM ,but CI stays green. It does still catch it on `./gradlew build` 
locally and at the release "Build from source" step, so the release itself is 
protected. 
   
   If we want the earlier signal, switching the CI job to `./gradlew check` (or 
adding `verifyBomCoverage` to the test job) would close the gap.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: [email protected]

For queries about this service, please contact Infrastructure at:
[email protected]

Reply via email to