From 37123685330c1fc3e85eeb8561bdc283f6b3bf8a Mon Sep 17 00:00:00 2001 From: =?UTF-8?q?Juan=20Antonio=20Bre=C3=B1a=20Moral?= Date: Mon, 1 Jun 2026 10:16:46 +0200 Subject: [PATCH] feat(maven): Adding maven dependency plugin support --- .../112-java-maven-plugins.xml | 89 ++++++++++++++++++- .../assets/java-maven-properties-template.md | 6 ++ .../java-maven-plugins-questions-template.md | 1 + 3 files changed, 94 insertions(+), 2 deletions(-) diff --git a/skills-generator/src/main/resources/skill-references/112-java-maven-plugins.xml b/skills-generator/src/main/resources/skill-references/112-java-maven-plugins.xml index 5da515ac..487b22ea 100644 --- a/skills-generator/src/main/resources/skill-references/112-java-maven-plugins.xml +++ b/skills-generator/src/main/resources/skill-references/112-java-maven-plugins.xml @@ -6,7 +6,7 @@ 0.15.0 Apache-2.0 Maven Plugins: pom.xml Configuration Best Practices - Use when you need to add or configure Maven plugins in your pom.xml using a modular, step-based approach. + Use when you need to add or configure Maven plugins in your pom.xml using a modular, step-based approach, including dependency analysis for unused declared dependencies. You are a Senior software engineer with extensive experience in Java software development @@ -15,6 +15,7 @@ This rule provides a modular, step-based approach to updating Maven pom.xml files with plugins and profiles. Each step has a single responsibility and clear dependencies on user answers, making the configuration process more maintainable and user-friendly. + It includes dependency analysis with maven-dependency-plugin to detect unused declared dependencies and undeclared used dependencies. @@ -1965,12 +1966,96 @@ After adding this plugin, verify the configuration: + + Maven Dependency Plugin Analysis Configuration + ` section ONLY if it doesn't already exist:** + +```xml + +org.apache.maven.plugins +maven-dependency-plugin +${maven-plugin-dependency.version} + + + analyze-dependencies + verify + + analyze-only + + + true + true + + + + +``` + +## Implementation Guidelines + +1. **Use `analyze-only` in lifecycle bindings**: The `analyze` goal is useful from the command line, while `analyze-only` participates cleanly in the build lifecycle after classes have been compiled. +2. **Fail on dependency warnings**: `failOnWarning` should be `true` when the team wants unused declared dependencies or used undeclared dependencies to block `verify`. +3. **Reduce false positives for non-compile scopes**: `ignoreNonCompile` avoids failing unused dependency analysis on runtime, provided, test, and system scoped dependencies. +4. **Preserve known exceptions**: If the project intentionally declares dependencies only used reflectively or through generated code, configure the appropriate ignored dependency lists instead of removing the plugin. + +## Usage Examples + +```bash +# Run dependency analysis directly +./mvnw dependency:analyze + +# Run the lifecycle-bound dependency analysis +./mvnw verify +``` + +## Validation + +After adding this plugin, verify the configuration: + +```bash +# Test Maven Dependency plugin configuration +./mvnw verify +``` + ]]> + + + + **MUST** only add maven-dependency-plugin if "Dependency analysis (maven-dependency-plugin)" was selected in Step 3 + **MUST** check if plugin already exists before adding + **MUST** ask user permission before modifying existing plugin configuration + **MUST** use properties configured in Step 4 for plugin version + **MUST** configure `analyze-only` bound to the `verify` phase for lifecycle execution + **MUST** enable `failOnWarning` so dependency warnings can fail the build + **MUST** skip this step entirely if Dependency analysis was not selected + + + Ask questions one by one following the template exactly in Step 3 - Execute steps 4-21 only based on user selections from Step 3 + Execute steps 4-22 only based on user selections from Step 3 Skip entire steps if no relevant features were selected Implement only requested features based on user selections Follow template specifications exactly for all configurations diff --git a/skills-generator/src/main/resources/skill-references/assets/java-maven-properties-template.md b/skills-generator/src/main/resources/skill-references/assets/java-maven-properties-template.md index f895b6c9..e70ea2c1 100644 --- a/skills-generator/src/main/resources/skill-references/assets/java-maven-properties-template.md +++ b/skills-generator/src/main/resources/skill-references/assets/java-maven-properties-template.md @@ -103,6 +103,11 @@ Start with essential build properties that every project needs (use the Java ver 2.18.0 ``` +**If Dependency Analysis selected**: +```xml +3.11.0 +``` + **If Build Info selected**: ```xml 4.9.10 @@ -167,6 +172,7 @@ The final `` section will look like this (example with common select 1.19.4 1.2.3 4.9.3.0 + 3.11.0 3.13.0 diff --git a/skills-generator/src/main/resources/skill-references/assets/questions/java-maven-plugins-questions-template.md b/skills-generator/src/main/resources/skill-references/assets/questions/java-maven-plugins-questions-template.md index 86f6f414..5aea0fa5 100644 --- a/skills-generator/src/main/resources/skill-references/assets/questions/java-maven-plugins-questions-template.md +++ b/skills-generator/src/main/resources/skill-references/assets/questions/java-maven-plugins-questions-template.md @@ -34,6 +34,7 @@ Options: - Security vulnerability scanning (OWASP) - Security static code analysis (SpotBugs, PMD) - Sonar +- Dependency analysis (maven-dependency-plugin) - Version management - Container image build (Jib) - JMH (Java Microbenchmark Harness)