Plugin 7.41.0 published with dependency on missing rewrite-bom:8.91.0

[aeolus]

What version of OpenRewrite are you using?

I am using:

• Gradle plugin org.openrewrite.rewrite v7.41.0
• Published implementation artifact org.openrewrite:plugin:7.41.0
• The plugin metadata requires org.openrewrite:rewrite-bom:8.91.0

How are you running OpenRewrite?

I am using the Gradle plugin via the Gradle Plugin Portal.

plugins {
    id("org.openrewrite.rewrite") version "7.41.0"
}

What is the smallest, simplest way to reproduce the problem?

Create a minimal Gradle project:

// settings.gradle.kts
pluginManagement {
    repositories {
        gradlePluginPortal()
        mavenCentral()
    }
}

dependencyResolutionManagement {
    repositories {
        mavenCentral()
    }
}

// build.gradle.kts
plugins {
    id("org.openrewrite.rewrite") version "7.41.0"
}

Then run:

./gradlew help --refresh-dependencies

Or inspect the published metadata directly:

  curl -fsSL https://plugins.gradle.org/m2/org/openrewrite/plugin/7.41.0/plugin-7.41.0.pom
  curl -fsSL https://plugins.gradle.org/m2/org/openrewrite/plugin/7.41.0/plugin-7.41.0.module
  curl -I https://repo.maven.apache.org/maven2/org/openrewrite/rewrite-bom/8.91.0/rewrite-bom-8.91.0.pom

The published plugin-7.41.0.pom imports:

  <dependencyManagement>
    <dependencies>
      <dependency>
        <groupId>org.openrewrite</groupId>
        <artifactId>rewrite-bom</artifactId>
        <version>8.91.0</version>
        <type>pom</type>
        <scope>import</scope>
      </dependency>
    </dependencies>
  </dependencyManagement>

The published plugin-7.41.0.module also requires:

  {
    "group": "org.openrewrite",
    "module": "rewrite-bom",
    "version": {
      "requires": "8.91.0"
    }
  }

However, Maven Central returns 404 for:

https://repo.maven.apache.org/maven2/org/openrewrite/rewrite-bom/8.91.0/rewrite-bom-8.91.0.pom

Maven Central metadata currently reports 8.90.4 as latest/release:

https://repo.maven.apache.org/maven2/org/openrewrite/rewrite-bom/maven-metadata.xml

What did you expect to see?

The Gradle plugin should resolve successfully from the Gradle Plugin Portal and Maven Central.

The published plugin metadata should reference an available rewrite-bom version, for example 8.90.4, or rewrite-
bom:8.91.0 should be published to Maven Central.

What did you see instead?

The plugin metadata for org.openrewrite:plugin:7.41.0 references org.openrewrite:rewrite-bom:8.91.0, but that
artifact is not available from Maven Central.

This can break dependency resolution for users who resolve the plugin from the Gradle Plugin Portal with Maven
Central as the repository for OpenRewrite artifacts.

What is the full stack trace of any errors you encountered?

The direct artifact check returns 404:

HTTP/2 404
x-amz-error-code: NoSuchKey
x-amz-error-detail-key: maven2/org/openrewrite/rewrite-bom/8.91.0/rewrite-bom-8.91.0.pom
x-amz-error-message: The specified key does not exist.

Are you interested in contributing a fix to OpenRewrite?

I’m happy to help verify a fixed plugin release or corrected publication metadata

[timtebeek]

Hi! Thanks for reaching out. We've had to make changes following the recently announced publishing limits for Maven Central. With ~80+ modules released twice a month we were far above their limits, and could not rely on exemptions to deliver our software.

As a result we now publish to https://artifacts.codegenomeproject.org/maven/, where the full catalog can be browsed at https://codegenomeproject.org/recipes/. This artifact repository requires a (free) token.

We did not intend for the last version of the rewrite-gradle-plugin available via the Gradle plugin portal to depend on artifacts in CGP. That's the cause of the issue you're seeing now, and sorry about that. The previous version would still work for now, or you can download new versions from CodeGenomeProject going forward.

Hope that helps you there! I'll keep the issue open for a while such that it's easier for others to spot the same.

[Siedlerchr]

Sorry, but requiring a token for downloads in a massive open source is impractical! We can do that on CI, yes, but we cannot require every contributor of our large open source project to sign up for a token at some random website just to get the build working.
Please at least provide an alternative without requiring a token.

[koppor]

We did not intend for the last version of the rewrite-gradle-plugin available via the Gradle plugin portal to depend on artifacts in CGP.

That means, the issue won't happen in the future 😅

[hatzlj]

same problem as in openrewrite/rewrite-recipe-bom#68