quarkus: Maven regression in 1.4.1.Final vs 1.3.2.Final - ${revision} and custom repository defined in settings.xml

Describe the bug In Quarkus 1.4.1.Final, test dependencies resolved during Quarkus test execution are always retrieved from “central”, ignoring custom repository, if ${revision} placeholder is used for version as defined in Maven documentation and a custom repository is defined in settings.xml as defined in Maven documentation

Note that this bug does not occur if the custom repository is defined in pom.xml. However, ignoring repositories defined in settings.xml is an issue and should be resolved. Additionally, it is not possible to configure credentials in pom.xml, so any private repository that requires authentication will not function even with this workaround.

Expected behavior All dependencies, including those resolved by Quarkus test runner, should be resolved using repositories defined in standard Maven configuration.

Actual behavior Dependencies resolved during Quarkus test execution ignore settings.xml and instead all pull from the default repository of “central”.

To Reproduce Full reproduction details and test case are located at https://github.com/jeffhubLR/quarkus-1.4.1-maven-regression

Environment (please complete the following information):

• Output of uname -a or ver: Darwin xxxxx 19.4.0 Darwin Kernel Version 19.4.0: Wed Mar 4 22:28:40 PST 2020; root:xnu-6153.101.6~15/RELEASE_X86_64 x86_64
• Output of java -version: openjdk version “11.0.6” 2020-01-14 OpenJDK Runtime Environment AdoptOpenJDK (build 11.0.6+10) OpenJDK 64-Bit Server VM AdoptOpenJDK (build 11.0.6+10, mixed mode)
• GraalVM version (if different from Java): Not needed for replication
• Quarkus version or git rev: Quarkus 1.4.1.Final and Quarkus 1.3.2.Final
• Build tool (ie. output of mvnw --version or gradlew --version): Regression occurs regardless of using mvnw or direct mvn.

./mvnw --version: Apache Maven 3.6.3 (cecedd343002696d0abb50b32b541b8a6ba2883f) Maven home: /Users/jeff.hubbach/.m2/wrapper/dists/apache-maven-3.6.3-bin/1iopthnavndlasol9gbrbg6bf2/apache-maven-3.6.3 Java version: 11.0.6, vendor: AdoptOpenJDK, runtime: /Library/Java/JavaVirtualMachines/adoptopenjdk-11.jdk/Contents/Home Default locale: en_US, platform encoding: UTF-8 OS name: “mac os x”, version: “10.15.4”, arch: “x86_64”, family: “mac”

mvn --version: Apache Maven 3.6.3 (cecedd343002696d0abb50b32b541b8a6ba2883f) Maven home: /usr/local/Cellar/maven/3.6.3_1/libexec Java version: 11.0.6, vendor: AdoptOpenJDK, runtime: /Library/Java/JavaVirtualMachines/adoptopenjdk-11.jdk/Contents/Home Default locale: en_US, platform encoding: UTF-8 OS name: “mac os x”, version: “10.15.4”, arch: “x86_64”, family: “mac”

Additional context Sections copied from demonstration repository README.md:

Background

1. Maven ${revision}

   Since 3.5.0-beta-1, maven has supported using a ${revision} placeholder for the version in pom files.

   https://maven.apache.org/maven-ci-friendly.html

   This is often used in CI systems to be able to inject version at build time via mvn -Drevision=1.2.3 package

2. Companies frequently require all dependencies to be pulled through an internal Maven repository that also proxies upstream. One easy way to accomplish this is by providing a settings.xml file that specifies that repository. For the purpose of this demonstration, we just override the name but leave the repository as Maven Central.

Expectation

All dependencies should be retrieved from “get-all-from-here” repository. If at any point we see dependencies pulled from “central”, that proves our Maven configuration is not being honored.

Actual Result

On Quarkus 1.4.1.Final with a custom repository defined and <version> replaced with ${revision}, dependencies downloaded during Quarkus test execution are pulled from “central” rather than the expected configured repository.