gnodet commented on PR #26330: URL: https://github.com/apache/camel/pull/26330#issuecomment-5731192927
## Update: switched to `pilot:dependencies` This PR now uses [`pilot:dependencies`](https://github.com/maveniverse/pilot) (bytecode-level analysis) instead of `maven-dependency-plugin:analyze-only`. ### What changed - **`pom.xml`**: The `dep-check` profile now configures `eu.maveniverse.maven.plugins:pilot-plugin:0.3.0` in `pluginManagement` with the same ignore-lists. The mojo is invoked explicitly (not lifecycle-bound) since it requires compiled classes to be present first. - **`.github/workflows/dep-check.yml`**: Two-step workflow — `test-compile` first, then `pilot:dependencies`. - **`docs/main/modules/contributing/pages/building.adoc`**: Updated usage docs. ### Usage ```shell # Full reactor — report mode (non-blocking, default) mvn test-compile eu.maveniverse.maven.plugins:pilot-plugin:0.3.0:dependencies -Pdep-check -Dlicense.skip -Dquickly # Single module cd components/camel-jetty mvn test-compile eu.maveniverse.maven.plugins:pilot-plugin:0.3.0:dependencies -Pdep-check # Fail on findings (enforcement) mvn test-compile eu.maveniverse.maven.plugins:pilot-plugin:0.3.0:dependencies -Pdep-check -Dpilot.action=check # Fix mode (rewrites pom.xml — verify the result builds before committing) mvn test-compile eu.maveniverse.maven.plugins:pilot-plugin:0.3.0:dependencies -Pdep-check -Dpilot.action=fix ``` ### Sample report (selected compiled modules, `--skipTestScope`) Running against `camel-api`, `camel-core-model`, `camel-core-engine`, `camel-support`, `camel-http`, `camel-jetty`, `camel-ftp`: **`camel-api`** — ✅ No dependency issues found. **`camel-core-model`** — findings: ``` Used transitive dependencies (should be declared): - org.slf4j:slf4j-api - jakarta.xml.bind:jakarta.xml.bind-api - org.apache.camel:camel-util-json ``` **`camel-core-engine`** — findings: ``` Unused declared dependencies (can be removed): - jakarta.xml.bind:jakarta.xml.bind-api - org.apache.camel:camel-management-api Used transitive dependencies (should be declared): - org.slf4j:slf4j-api - org.apache.camel:camel-core-model - org.apache.camel:camel-util-json ``` **`camel-jetty`** — findings: ``` Unused declared dependencies (can be removed): - org.eclipse.jetty.ee10:jetty-ee10-servlet - org.eclipse.jetty:jetty-security - org.eclipse.jetty.ee10:jetty-ee10-servlets - org.eclipse.jetty:jetty-client Used transitive dependencies (should be declared): - org.apache.camel:camel-api - org.slf4j:slf4j-api - org.apache.camel:camel-http-base - org.apache.camel:camel-attachments - jakarta.activation:jakarta.activation-api - jakarta.servlet:jakarta.servlet-api - org.eclipse.jetty:jetty-io ``` ### On `fix` mode The `fix` action is available but **not yet validated end-to-end** across the full reactor. Pilot will rewrite pom.xml files in place — the resulting build must be verified before any auto-fix PR is opened. The Jetty findings above (unused `jetty-security`, used-transitive `jetty-io`) are a good candidate for a small proof-of-concept fix. --- _Hermes Agent (Claude Sonnet 4.6) on behalf of Guillaume Nodet_ -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
