vlsi opened a new pull request, #6846: URL: https://github.com/apache/jmeter/pull/6846
`verifyReleaseDependencies` compared exact jar file names and byte sizes with `expected_release_jars.csv`. Every dependency update changed both, so on `-SNAPSHOT` versions the task only logged the difference to keep Renovate pull requests green. A new transitive dependency or a jar that grew passed pull request CI and surfaced only in a release build. The expected file is now `src/dist/src/dist/expected_release_artifacts.txt`: `group:artifact[:classifier]` coordinates without versions, plus `total-size-limit` for the sum of the jar sizes. A version update that keeps the module set and stays under the limit leaves the file as is, so the task fails on every version, `-SNAPSHOT` included. `-PupdateExpectedJars` rewrites the list and sets the limit to the current size plus 5 MiB, rounded up to a whole MiB, so the limit moves only when someone runs the update and commits the result. A Renovate pull request that brings in a new module, or pushes the release past the limit, now fails CI and needs a human to accept it. `--write-verification-metadata` no longer updates the file: Renovate runs it on every dependency update, and it would reset the limit each time. The total limit does not catch a single jar that grows by less than 5 MiB, for instance a library that starts shading a dependency. Catching that would need per-jar sizes in the file again, which would change on every update. ## User-visible changes - `check` fails when the release gains or loses an external module, or when the external jars exceed `total-size-limit`, on `-SNAPSHOT` versions too. - The failure message lists the added and removed modules, the size overflow, the ten largest jars, the `dependencyInsight` command that shows where a module comes from, and `./gradlew :src:dist:verifyReleaseDependencies -PupdateExpectedJars` to accept the change. - A module that resolves to two jars fails the task, since the version-less list would not notice the second jar. ## Verification Build scripts have no tests in this repository, so I checked it by hand with `-Prelease`. The task passes on the regenerated file, and a second `-PupdateExpectedJars` run produces the same file. With one module removed from the file, a bogus module added, and the limit lowered, the task reports all three in one message. A missing or non-numeric `total-size-limit` fails with a message that names the file. The regenerated list has 166 modules, the same count as the old CSV on master. 🤖 Generated with [Claude Code](https://claude.com/claude-code) -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
