| [ee4j-build] Maven re-releases |
Folks,Re-releasing Maven artifacts (or overwrite) has been a common practice within EE4J projects. I believe this is mainly due to the release scripts and Jenkins jobs that make it too easy to re-run the release for a particular version.
This is a bad Maven practice and should be avoided as much as possible. We should only do this for very specific use cases where a version gap is not acceptable. E.g. an API with a final version has a bug, we can re-release it while it is still in OSSRH staging.
Releasing a project with a final version where a gap is not acceptable should be done with extra caution. This means the integration has been tested before hand very carefully. If there is a development cycle, intermediate versions (e.g. 1.0-bXX or whatever qualifier fits) can be used, in such case a version gap is acceptable and maven releases may be done carelessly.
Re-releasing something already integrated in other projects can creates issues that are not associated with a git commit. (i.e the build could start failing without a change). This is like having the drawbacks of external snapshots without the benefits. Note that it also forces purging various Maven caches and mirrors which can be quite tricky.
There is also the issue of the retention period of OSSRH staging. Staging repositories will be automatically deleted after 1 month. This used to be 2 weeks but we got Sonatype to extend it to 1 month. This is unfortunately very impractical. IMO this calls for Eclipse to engage with Sonatype in order to have our own dedicated nexus gateway, similar to maven.java.net.
The retention period is also why some projects have been re-released. AFAIK the current workaround is to re-run the release job with the same version. If the release is triggered off of a development branch (e.g. EE4J_8) then the re-released artifacts may have different content.
Even if triggered from the release tag the artifacts will have a different fingerprints. While it's not as big of an issue, this may have bad side effects with things that are re-bundled (e.g. GlassFish zip distributions). Instead of rebuilding the Maven artifacts that are missing, we should provide a way to re-release existing artifacts. E.g. archive the artifacts on Jenkins and have a way to re-stage them to OSSRH.
Thanks, Romain