gnodet commented on PR #26330: URL: https://github.com/apache/camel/pull/26330#issuecomment-5666048718
Converting to draft while we investigate a better approach. `maven-dependency-plugin:analyze-only` works on classpath class presence, which produces significant noise on a framework like Camel. Testing it on `camel-bean` showed several false positives: `camel-api`, `camel-util`, and `slf4j-api` all flagged as "used undeclared" when they are in fact correctly pulled in transitively via `camel-support` — the plugin just can't distinguish that. A better alternative is [`pilot:dependencies`](https://github.com/maveniverse/pilot) from Maveniverse, which uses ASM bytecode analysis with member-level granularity and is SPI/ServiceLoader-aware — exactly what Camel needs. On the same module it correctly attributed all transitive deps and produced zero false positives. Two issues currently block using it in CI: - [maveniverse/pilot#144](https://github.com/maveniverse/pilot/issues/144): `action=check` is not headless — requires a PTY, hangs in a non-interactive shell - [maveniverse/pilot#145](https://github.com/maveniverse/pilot/issues/145): requires Java 22+, Camel CI uses JDK 21 Will update the PR to use `pilot:dependencies -Dpilot.action=check` once those are resolved. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
