aws-sdk-java-v2: Publishing order to Maven Central seems wrong
Describe the bug
Every time there is an SDK release to Maven Central, people who depend on latest
version will have a broken build since during the release the order of releasing the artifacts is wrong.
If there are artifacts A and B and A depends on B then B should be published first then A. This is not the case with the AWS SDK.
Here’s a real life example with Micrometer’s build which depends on software.amazon.awssdk:cloudwatch
which depends on software.amazon.awssdk:sdk-core
(latest
). Since cloudwatch:2.20.34
was published first, the build system is looking for its dependency sdk-core:2.20.34
which is not in Maven Central yet:
* What went wrong:
Execution failed for task ':micrometer-registry-cloudwatch2:compileJava'.
> Could not resolve all files for configuration ':micrometer-registry-cloudwatch2:compileClasspath'.
> Could not find sdk-core-2.20.34.jar (software.amazon.awssdk:sdk-core:2.20.34).
Searched in the following locations:
https://repo.maven.apache.org/maven2/software/amazon/awssdk/sdk-core/2.20.34/sdk-core-2.20.34.jar
Expected Behavior
Not having a state in Maven Central that is incomplete/broken in terms of dependencies. Take dependency ordering into consideration when publishing to Maven Central so that people’s builds will not be broken (or stage everything first and release one).
Current Behavior
Right now during releases, Maven Central is incomplete/broken in terms of dependencies. Dependency ordering is not taken into consideration when publishing to Maven Central and people’s builds are broken.
Reproduction Steps
This is tricky since this only happens during releases (though they are quite frequent in case of the AWS SDK) but during a release, try to build a project that has a dependency from the AWS SDK that has another dependency which is published later than the one you depend on.
Example, try to build a project with this (repo is mavenCentral()
):
implementation 'software.amazon.awssdk:cloudwatch:latest.release'
This will fail between software.amazon.awssdk:cloudwatch
is already published but software.amazon.awssdk:sdk-core
hasn’t been. This can take quite a long time actually.
Possible Solution
Take dependency ordering into consideration when publishing to Maven Central so that people’s builds will not be broken (or stage everything first and release one).
Additional Information/Context
Example CircleCI workflow and Build Scan result.
AWS Java SDK version used
irrelevant (release.latest) but this is happening right now with 2.20.34
JDK version used
irrelevant (openjdk 20 2023-03-21)
Operating System and version
irrelevant (MacOS 13.2.1)
About this issue
- Original URL
- State: open
- Created a year ago
- Comments: 29 (9 by maintainers)
I’m not sure the publishing order is related or not,
sdk-core
2.20.34 seems to be something wrong anyway.sdk-core-2.20.34.jar
is listed in https://repo.maven.apache.org/maven2/software/amazon/awssdk/sdk-core/2.20.34/, but it links to “404 Not Found”Though this maybe a problem of Maven Central side, all of your sdk 2.20.34 which eventually depends on
sdk-core
2.20.34, seems to trigger a build failure. Such as:cloudWatch
2.20.34, depends onaws-query-protocol
2.20.34 and it depends onsdk-core
2.20.34.s3
2.20.34, depends onaws-xml-protocol
2.20.34 and it depends onsdk-core
2.20.34.I don’t have records to back up my claims; it’s anecdotal, but we’ve seen the same issue for at least a year. Previously I shrugged it off as being an isolated incident, but it seems to be a pattern.
I think 2.20.34 was only partially released, which is a different issue to this one. I raised https://github.com/aws/aws-sdk-java-v2/issues/3866