gnodet commented on PR #26330: URL: https://github.com/apache/camel/pull/26330#issuecomment-5700970631
Thanks for this PR! I wanted to bring up an alternative worth considering before we wire in `maven-dependency-plugin:analyze` — [maveniverse/pilot](https://github.com/maveniverse/pilot) (`pilot:dependencies`) covers the same ground (used-undeclared, unused-declared) but uses bytecode-level analysis rather than the class-index heuristics that `dependency:analyze` relies on. This tends to produce significantly fewer false positives on a large multi-module project like Camel. The mojo supports three actions: - `report` — prints findings, always exits 0 (safe to add to CI as a non-blocking check) - `check` — same output, exits non-zero if issues are found (enforcing gate) - `fix` — modifies pom.xml in-place to apply suggested fixes Before committing to either tool at scale, it would be worth doing a dry run across the full reactor to see what each one actually reports on Camel. A `check` pass with pilot (`action=check`) would let us see the full picture without modifying anything — and we'd quickly learn whether the results are actionable or full of noise. Once there's confidence in the output quality, we could run `fix` to apply the bulk of the changes and then use `check` as the CI gate going forward. Worth exploring before landing the `dep-check` profile? _Guillaume Nodet_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
