potiuk commented on PR #12421: URL: https://github.com/apache/maven/pull/12421#issuecomment-4885683417
Thanks Elliotte — both good catches, and exactly the react-to-the-draft input the v0 is asking for. **Missing rows (line 52):** you're right, the table isn't exhaustive — it was seeded to the code-executing / release-path plugins, ordered by criticality. `maven-war-plugin` and `maven-ear-plugin` are the same class as #12 `assembly` (fork/write archives), so they belong; I'll add them. **"Are non-plugins in scope?"** — yes, as *components in the model*. `maven-filtering`, `maven-shared-utils`, and `maven-archiver` sit on the build/release path and inherit the same arbitrary-code / supply-chain surface, so the model should reason about them — I'll add a "shared libraries" block. Doxia I'd flag for a PMC call: the whole stack (site rendering, macro execution) is a big surface, arguably its own model — happy to pull the core doxia repos into the table, or keep site-rendering as a §3 pointer to a separate doxia model. Your read? One distinction that drives next steps: the §2 table is what the *model reasons about*; the list of repos we actually run the scan against is a separate, PMC-confirmed set (Sylwester pinned a branch-level list). Adding a table row doesn't auto-enroll that repo for scanning — that's the PMC's scope call. So I'll expand the table per the above; separately, tell me (or Sylwester) which of war/ear/filtering/shared-utils/archiver/doxia the PMC wants *scanned* and I'll fold them into the submission scope. None of this blocks merge — the table can keep growing after v0 lands. But since you're in it, I'll push the war/ear + shared-libs rows so you can react to concrete entries. — Jarek -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
