From 2644ab73e4d73d7d7ccb6935537a92dd31b626b3 Mon Sep 17 00:00:00 2001
From: James Nord <jtnord@users.noreply.github.com>
Date: Thu, 9 Mar 2023 11:51:48 +0000
Subject: [PATCH 1/3] Adds test case for #705

dependencyManagement can be used to manage the transitive dependency
versions not only direct ones, and this impacts what can end up in the
resulting hpi file.

By not including the depMgmt section then any downtream consumer will
see the un managed versions of the dependencies which will differ from
what they should see
---
 src/it/incrementals-and-plugin-bom/pom.xml       |  3 ++-
 .../incrementals-and-plugin-bom/postbuild.groovy | 16 ++++++++++++++++
 2 files changed, 18 insertions(+), 1 deletion(-)

diff --git a/src/it/incrementals-and-plugin-bom/pom.xml b/src/it/incrementals-and-plugin-bom/pom.xml
index 692048a441..8e24af634d 100644
--- a/src/it/incrementals-and-plugin-bom/pom.xml
+++ b/src/it/incrementals-and-plugin-bom/pom.xml
@@ -15,6 +15,7 @@
         <revision>1.0</revision>
         <changelist>-SNAPSHOT</changelist>
         <jenkins.version>2.361.4</jenkins.version>
+        <bom.version>1580.v47b_429a_c853a</bom.version>
     </properties>
 
     <repositories>
@@ -34,7 +35,7 @@
             <dependency>
                 <groupId>io.jenkins.tools.bom</groupId>
                 <artifactId>bom-2.361.x</artifactId>
-                <version>1580.v47b_429a_c853a</version>
+                <version>${bom.version}</version>
                 <scope>import</scope>
                 <type>pom</type>
             </dependency>
diff --git a/src/it/incrementals-and-plugin-bom/postbuild.groovy b/src/it/incrementals-and-plugin-bom/postbuild.groovy
index d213f568db..a04cf50408 100644
--- a/src/it/incrementals-and-plugin-bom/postbuild.groovy
+++ b/src/it/incrementals-and-plugin-bom/postbuild.groovy
@@ -1,3 +1,19 @@
 assert new File(basedir, '../../local-repo/io/jenkins/plugins/incrementals-and-plugin-bom/1.0-SNAPSHOT/incrementals-and-plugin-bom-1.0-SNAPSHOT.hpi').file
 assert new File(basedir, '../../local-repo/io/jenkins/plugins/incrementals-and-plugin-bom/1.0-rc1234.deadbeef5678/incrementals-and-plugin-bom-1.0-rc1234.deadbeef5678.hpi').file
+String pomXml = new File(basedir, '../../local-repo/io/jenkins/plugins/incrementals-and-plugin-bom/1.0-rc1234.deadbeef5678/incrementals-and-plugin-bom-1.0-rc1234.deadbeef5678.pom').text
+assert pomXml.contains('version>1.0-rc1234.deadbeef5678</version>')
+// https://github.com/jenkinsci/plugin-pom/issues/705
+// line endings need normalising
+assert pomXml.replace("\r\n", "\n").contains('''
+  <dependencyManagement>
+    <dependencies>
+      <dependency>
+        <groupId>io.jenkins.tools.bom</groupId>
+        <artifactId>bom-2.361.x</artifactId>
+        <version>1580.v47b_429a_c853a</version>
+        <type>pom</type>
+        <scope>import</scope>
+      </dependency>
+    </dependencies>
+  </dependencyManagement>'''.replace("\r\n", "\n"))
 return true

From 30885c8c6189ef160274c678ed0c0c1047ed9f6d Mon Sep 17 00:00:00 2001
From: James Nord <jtnord@users.noreply.github.com>
Date: Thu, 9 Mar 2023 12:50:13 +0000
Subject: [PATCH 2/3] do not flatten with OSS mode

the OSS mode despite saying it keeps everything "repositories and
pluginRepositories" does not and it throws away the dependencyManagement

this creates our own descriptor that dies the same as the oss mode
currently but additionally keeps the dependencyManagement section

Whilst we could have used resolveCiFriendliesOnly which is probably a
better solution so that the poms behave better regardless of if they are
deployed from CI or local snapshots this keeps the changes to published
poms minimal
---
 pom.xml | 20 +++++++++++++++++++-
 1 file changed, 19 insertions(+), 1 deletion(-)

diff --git a/pom.xml b/pom.xml
index d34fc1360c..b96c014859 100644
--- a/pom.xml
+++ b/pom.xml
@@ -1313,7 +1313,25 @@
                 </goals>
                 <phase>process-resources</phase>
                 <configuration>
-                  <flattenMode>oss</flattenMode>
+                  <!-- flattenMode:oss does not keep dependecnyMangement or will promote all transitive dependencies to direct ones, changing resolution order -->
+                  <pomElements>
+                    <dependencyManagement>interpolate</dependencyManagement>
+                    <!-- from https://github.com/mojohaus/flatten-maven-plugin/blob/flatten-maven-plugin-1.3.0/src/main/java/org/codehaus/mojo/flatten/FlattenMode.java#L100 -->
+                    <ciManagement>expand</ciManagement>
+                    <contributors>expand</contributors>
+                    <distributionManagement>expand</distributionManagement>
+                    <inceptionYear>expand</inceptionYear>
+                    <issueManagement>expand</issueManagement>
+                    <mailingLists>expand</mailingLists>
+                    <organization>expand</organization>
+                    <prerequisites>expand</prerequisites>
+                    <name>expand</name>
+                    <description>expand</description>
+                    <url>expand</url>
+                    <scm>expand</scm>
+                    <developers>expand</developers>
+                    <repositories>expand</repositories>
+                  </pomElements>
                   <outputDirectory>${project.build.directory}</outputDirectory>
                   <flattenedPomFilename>${project.artifactId}-${project.version}.pom</flattenedPomFilename>
                 </configuration>

From d8e7f3a474b45c975f50371b33f0643b01269d17 Mon Sep 17 00:00:00 2001
From: James Nord <jtnord@users.noreply.github.com>
Date: Thu, 9 Mar 2023 17:12:42 +0000
Subject: [PATCH 3/3] switch to expand and adapt test case accordingly

as discussed with @jglick as the intention of the flatten plugin here is to have
a self contained pom - this will switch to expand which will also have the benefit
of picking up any <dependencyManagement> configured in the parent(s).
---
 pom.xml                                        |  4 ++--
 .../postbuild.groovy                           | 18 ++++++------------
 2 files changed, 8 insertions(+), 14 deletions(-)

diff --git a/pom.xml b/pom.xml
index b96c014859..593c546d4f 100644
--- a/pom.xml
+++ b/pom.xml
@@ -1313,9 +1313,9 @@
                 </goals>
                 <phase>process-resources</phase>
                 <configuration>
-                  <!-- flattenMode:oss does not keep dependecnyMangement or will promote all transitive dependencies to direct ones, changing resolution order -->
+                  <!-- flattenMode:oss does not keep dependencyMangement or will promote all transitive dependencies to direct ones, changing resolution order -->
                   <pomElements>
-                    <dependencyManagement>interpolate</dependencyManagement>
+                    <dependencyManagement>expand</dependencyManagement>
                     <!-- from https://github.com/mojohaus/flatten-maven-plugin/blob/flatten-maven-plugin-1.3.0/src/main/java/org/codehaus/mojo/flatten/FlattenMode.java#L100 -->
                     <ciManagement>expand</ciManagement>
                     <contributors>expand</contributors>
diff --git a/src/it/incrementals-and-plugin-bom/postbuild.groovy b/src/it/incrementals-and-plugin-bom/postbuild.groovy
index a04cf50408..231763ac64 100644
--- a/src/it/incrementals-and-plugin-bom/postbuild.groovy
+++ b/src/it/incrementals-and-plugin-bom/postbuild.groovy
@@ -4,16 +4,10 @@ String pomXml = new File(basedir, '../../local-repo/io/jenkins/plugins/increment
 assert pomXml.contains('version>1.0-rc1234.deadbeef5678</version>')
 // https://github.com/jenkinsci/plugin-pom/issues/705
 // line endings need normalising
-assert pomXml.replace("\r\n", "\n").contains('''
-  <dependencyManagement>
-    <dependencies>
-      <dependency>
-        <groupId>io.jenkins.tools.bom</groupId>
-        <artifactId>bom-2.361.x</artifactId>
-        <version>1580.v47b_429a_c853a</version>
-        <type>pom</type>
-        <scope>import</scope>
-      </dependency>
-    </dependencies>
-  </dependencyManagement>'''.replace("\r\n", "\n"))
+assert pomXml.matches('(?s).*<dependencyManagement>\\s*<dependencies>'
+// something from the parent pom dependencyManagement
++ '.*<dependency>\\s*<groupId>javax.servlet</groupId>\\s*<artifactId>javax.servlet-api</artifactId>\\s*<version>3.1.0</version>\\s*</dependency>'
+// something from the bom
++ '.*<dependency>\\s*<groupId>io.jenkins.plugins</groupId>\\s*<artifactId>caffeine-api</artifactId>\\s*<version>2.9.3-65.v6a_47d0f4d1fe</version>\\s*</dependency>'
++ '.*</dependencies>\\s*</dependencyManagement>.*')
 return true