From fcedbcec5bfff3786d0b8868bbec2e38bbfdbec0 Mon Sep 17 00:00:00 2001
From: James Nord <jtnord@users.noreply.github.com>
Date: Wed, 13 Nov 2019 16:53:29 +0000
Subject: [PATCH 1/3] Use BOM from Jenkins (#229)

* Use BOM from Jenkins

* Remove dependencies duplicated from jenkins-bom.

* Moved some more entries from dependencyManagement to bom.

* Created no-jenkins-bom profile to capture the 'old' dependencyManagement.

* Add some missing dependencies when not using Jenkins BOM.

* Reset jenkins.version to 2.190-SNAPSHOT.

* Update pom.xml

Co-Authored-By: Tim Jacomb <t.jacomb@kainos.com>

* Use jenkins.version 2.195 now that it includes the BOM.

* java.level=8 for compatibility with animal-sniffer-annotations@1.18

* Put default no-bom jenkins.version back to 2.138.4

use-jenkins-bom profile sets jenkins.version=2.195 as minimum bom-capable version.

* Add some Core BOM info & links to README.

* Update pom.xml

Co-Authored-By: Oleg Nenashev <o.v.nenashev@gmail.com>

* Match test jenkins.version to java.level.
---
 README.md                        |  13 +++
 pom.xml                          | 174 +++++++++++++++++++++++++------
 src/it/beta-just-testing/pom.xml |   4 +-
 3 files changed, 156 insertions(+), 35 deletions(-)

diff --git a/README.md b/README.md
index ae554cfc6f..e199af0962 100644
--- a/README.md
+++ b/README.md
@@ -210,3 +210,16 @@ By default, the setup wizard (Jenkins >= 2.0) is skipped when using `hpi:run`. I
 
     mvn -Dhudson.Main.development=false hpi:run
 
+## Jenkins Core BOM
+
+Since version 2.195, Jenkins provides a [Maven Bill Of Materials (BOM)](https://maven.apache.org/guides/introduction/introduction-to-dependency-mechanism.html#Importing_Dependencies)
+that centrally defines versions of various libraries used by Jenkins Core.
+The default behaviour of `plugin-pom` is to _not_ use the BOM, but when jenkins.version>=2.195 (and plugin-pom>=4.0) you can switch on Jenkins BOM support by setting the Maven property `use-jenkins-bom`.
+For example:
+
+`mvn -Djenkins.version=2.195 -Duse-jenkins-bom package`
+
+This will import the BOM for Jenkins 2.195
+
+For more information, see the [Dependency Management](https://jenkins.io/doc/developer/plugin-development/dependency-management/) section of the
+[plugin development guide](https://jenkins.io/doc/developer/plugin-development/).
diff --git a/pom.xml b/pom.xml
index f26691fc98..9883c50a51 100644
--- a/pom.xml
+++ b/pom.xml
@@ -83,7 +83,6 @@
     <!-- By default we do not create *-tests.jar. Set to false to allow other plugins to depend on test utilities in yours, using <classifier>tests</classifier>. -->
     <no-test-jar>true</no-test-jar>
 
-    <slf4jVersion>1.7.25</slf4jVersion>
     <node.version>4.0.0</node.version>
     <npm.version>2.13.1</npm.version>
     <yarn.version>0.23.0</yarn.version>
@@ -96,11 +95,13 @@
     <maven-scm.version>1.11.2</maven-scm.version>
     <!-- To skip the wizard by default in hpi:run. It should not impact other goals. -->
     <hudson.Main.development>true</hudson.Main.development>
-    <access-modifier.version>1.16</access-modifier.version>
+
     <!-- May be used to select timestamped snapshots: -->
+    <access-modifier.version>1.16</access-modifier.version>
     <access-modifier-annotation.version>${access-modifier.version}</access-modifier-annotation.version>
     <access-modifier-checker.version>${access-modifier.version}</access-modifier-checker.version>
-    <animal.sniffer.version>1.17</animal.sniffer.version>
+    <animal.sniffer.version>1.18</animal.sniffer.version>
+
     <!-- To opt in to @Restricted(Beta.class) APIs, set to true: -->
     <useBeta>false</useBeta>
     <incrementals.url>https://repo.jenkins-ci.org/incrementals/</incrementals.url>
@@ -111,17 +112,6 @@
 
   <dependencyManagement>
     <dependencies>
-      <!-- static analysis -->
-      <dependency>
-        <groupId>com.github.spotbugs</groupId>
-        <artifactId>spotbugs-annotations</artifactId>
-        <version>3.1.12</version>
-      </dependency>
-      <dependency>
-        <groupId>net.jcip</groupId>
-        <artifactId>jcip-annotations</artifactId>
-        <version>1.0</version>
-      </dependency>
       <dependency>
         <groupId>org.jenkins-ci.main</groupId>
         <artifactId>jenkins-core</artifactId>
@@ -149,6 +139,7 @@
         <artifactId>junit</artifactId>
         <version>4.12</version>
       </dependency>
+      <!-- JTN tidy this up? -->
       <dependency> <!-- used in JTH and jenkins core > 2.x -->
         <groupId>javax.servlet</groupId>
         <artifactId>javax.servlet-api</artifactId>
@@ -183,20 +174,6 @@
         <version>1.0</version>
         <type>signature</type>
       </dependency>
-      <!-- mark logging dependencies as provided by war -->
-      <dependency>
-        <groupId>commons-logging</groupId>
-        <artifactId>commons-logging</artifactId>
-        <version>1.2</version>
-        <scope>provided</scope><!-- by jcl-over-slf4j -->
-      </dependency>
-      <dependency>
-        <groupId>log4j</groupId>
-        <artifactId>log4j</artifactId>
-        <version>1.2.17</version>
-        <scope>provided</scope><!-- by log4j-over-slf4j -->
-      </dependency>
-
       <!--
       Recommended versions of Mockito and PowerMock for build with Java 11 (JENKINS-55098)
       The versions require Java 8 as a minimum baseline, but they can be downgraded in plugins if needed.
@@ -223,6 +200,7 @@
       </dependency>
     </dependencies>
   </dependencyManagement>
+
   <dependencies>
     <!-- static analysis -->
     <dependency>
@@ -286,7 +264,6 @@
     <dependency>
       <groupId>org.slf4j</groupId>
       <artifactId>slf4j-api</artifactId>
-      <version>${slf4jVersion}</version>
       <scope>provided</scope>
       <!-- mark the API as optional so it is not packaged in the HPI but available during compile -->
       <optional>true</optional>
@@ -295,25 +272,21 @@
     <dependency>
       <groupId>org.slf4j</groupId>
       <artifactId>log4j-over-slf4j</artifactId>
-      <version>${slf4jVersion}</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.slf4j</groupId>
       <artifactId>jcl-over-slf4j</artifactId>
-      <version>${slf4jVersion}</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.slf4j</groupId>
       <artifactId>slf4j-jdk14</artifactId>
-      <version>${slf4jVersion}</version>
       <scope>test</scope>
     </dependency>
     <dependency>
       <groupId>org.kohsuke</groupId>
       <artifactId>access-modifier-annotation</artifactId>
-      <version>${access-modifier-annotation.version}</version>
       <scope>provided</scope>
       <exclusions> <!-- provided by Jenkins core -->
         <exclusion>
@@ -328,6 +301,7 @@
       <scope>provided</scope>
     </dependency>
   </dependencies>
+
   <build>
     <!--
       Since new versions need to overwrite old versions, it's better
@@ -866,6 +840,140 @@
   </distributionManagement>
 
   <profiles>
+    <profile>
+      <!--
+       The 'no-jenkins-bom' profile captures the properties & dependencies when _not_ using the Jenkins BOM:
+        https://github.com/jenkinsci/jenkins/blob/master/bom/pom.xml
+       When the BOM is not being used, this profile is adding back the <dependencyManagement/> entries that were
+       moved to the BOM.
+       The profile is enabled by default; if you _are_ using the Jenkins BOM then disable this profile by defining the
+       'use-jenkins-bom' system property.
+      -->
+      <id>no-jenkins-bom</id>
+      <activation>
+        <property>
+          <name>!use-jenkins-bom</name>
+        </property>
+      </activation>
+      <properties>
+        <slf4jVersion>1.7.26</slf4jVersion>        
+      </properties>
+      <dependencyManagement>
+        <dependencies>
+          <dependency>
+            <groupId>com.github.spotbugs</groupId>
+            <artifactId>spotbugs-annotations</artifactId>
+            <version>3.1.12</version>
+          </dependency>
+          <dependency>
+            <groupId>net.jcip</groupId>
+            <artifactId>jcip-annotations</artifactId>
+            <version>1.0</version>
+          </dependency>
+          <!-- mark logging dependencies as provided by war -->
+          <dependency>
+            <groupId>commons-logging</groupId>
+            <artifactId>commons-logging</artifactId>
+            <version>1.2</version>
+            <scope>provided</scope><!-- by jcl-over-slf4j -->
+          </dependency>
+          <dependency>
+            <groupId>log4j</groupId>
+            <artifactId>log4j</artifactId>
+            <version>1.2.17</version>
+            <scope>provided</scope><!-- by log4j-over-slf4j -->
+          </dependency>
+          <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-api</artifactId>
+            <version>${slf4jVersion}</version>
+            <!-- TODO: should this optional be in dependencyManagement too??? -->
+            <scope>provided</scope>
+            <!-- mark the API as optional so it is not packaged in the HPI but available during compile -->
+            <optional>true</optional>
+          </dependency>
+          <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>log4j-over-slf4j</artifactId>
+            <version>${slf4jVersion}</version>
+            <scope>test</scope>
+          </dependency>
+          <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>jcl-over-slf4j</artifactId>
+            <version>${slf4jVersion}</version>
+            <scope>test</scope>
+          </dependency>
+          <dependency>
+            <groupId>org.slf4j</groupId>
+            <artifactId>slf4j-jdk14</artifactId>
+            <version>${slf4jVersion}</version>
+            <scope>test</scope>
+          </dependency>
+        </dependencies>
+      </dependencyManagement>
+      <dependencies>
+        <!-- make slf4j bindings to java.util.logging available during tests -->
+        <dependency>
+          <groupId>org.slf4j</groupId>
+          <artifactId>log4j-over-slf4j</artifactId>
+          <version>${slf4jVersion}</version>
+          <scope>test</scope>
+        </dependency>
+        <dependency>
+          <groupId>org.slf4j</groupId>
+          <artifactId>jcl-over-slf4j</artifactId>
+          <version>${slf4jVersion}</version>
+          <scope>test</scope>
+        </dependency>
+        <dependency>
+          <groupId>org.slf4j</groupId>
+          <artifactId>slf4j-jdk14</artifactId>
+          <version>${slf4jVersion}</version>
+          <scope>test</scope>
+        </dependency>
+        <dependency>
+          <groupId>org.kohsuke</groupId>
+          <artifactId>access-modifier-annotation</artifactId>
+          <version>${access-modifier-annotation.version}</version>
+          <scope>provided</scope>
+          <exclusions> <!-- provided by Jenkins core -->
+            <exclusion>
+              <groupId>org.jenkins-ci</groupId>
+              <artifactId>annotation-indexer</artifactId>
+              </exclusion>
+          </exclusions>
+        </dependency>
+      </dependencies>
+    </profile>
+    <!--
+       This profile can be activated by plugins that _are_ using the Jenkins BOM, by setting the system property
+       'use-jenkins-bom'. A convenient way to do this is by adding the command line parameter '-Duse-jenkins-bom'
+       'in ${maven.projectBasedir}/.mvn/maven.config'.
+       This profile imports the jenkins BOM at ${jenkins.version} to properly align dependencies.
+      -->
+    <profile>
+      <id>use-jenkins-bom</id>
+      <activation>
+        <property>
+          <name>use-jenkins-bom</name>
+        </property>
+      </activation>
+      <properties>
+        <jenkins.version>2.195</jenkins.version>
+      </properties>
+      <dependencyManagement>
+        <dependencies>
+          <dependency>
+            <groupId>org.jenkins-ci.main</groupId>
+            <artifactId>jenkins-bom</artifactId>
+            <version>${jenkins.version}</version>
+            <type>pom</type>
+            <scope>import</scope>
+          </dependency>
+        </dependencies>
+      </dependencyManagement>
+    </profile>
     <profile>
       <id>uninherited-java.level</id>
       <activation>
diff --git a/src/it/beta-just-testing/pom.xml b/src/it/beta-just-testing/pom.xml
index 64d3d093d2..f837065afb 100644
--- a/src/it/beta-just-testing/pom.xml
+++ b/src/it/beta-just-testing/pom.xml
@@ -13,8 +13,8 @@
     <version>1.0-SNAPSHOT</version>
     <packaging>pom</packaging>
     <properties>
-        <jenkins.version>2.7.3</jenkins.version>
-        <java.level>7</java.level>
+        <jenkins.version>2.60.3</jenkins.version>
+        <java.level>8</java.level>
         <maven-hpi-plugin.disabledTestInjection>true</maven-hpi-plugin.disabledTestInjection>
     </properties>
     <repositories>

From cd144ee9b5cf2f6513463a1114b864356e24020b Mon Sep 17 00:00:00 2001
From: Oleg Nenashev <o.v.nenashev@gmail.com>
Date: Wed, 13 Nov 2019 18:14:08 +0100
Subject: [PATCH 2/3] [maven-release-plugin] prepare release plugin-3.52

---
 pom.xml | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/pom.xml b/pom.xml
index 9883c50a51..a26883bbff 100644
--- a/pom.xml
+++ b/pom.xml
@@ -28,7 +28,7 @@
 
   <groupId>org.jenkins-ci.plugins</groupId>
   <artifactId>plugin</artifactId>
-  <version>3.52-SNAPSHOT</version>
+  <version>3.52</version>
   <packaging>pom</packaging>
 
   <name>Jenkins Plugin Parent POM</name>
@@ -39,7 +39,7 @@
     <connection>scm:git:ssh://git@github.com/jenkinsci/plugin-pom.git</connection>
     <developerConnection>scm:git:ssh://git@github.com/jenkinsci/plugin-pom.git</developerConnection>
     <url>https://github.com/jenkinsci/plugin-pom</url>
-    <tag>HEAD</tag>
+    <tag>plugin-3.52</tag>
   </scm>
 
   <properties>
@@ -844,7 +844,7 @@
       <!--
        The 'no-jenkins-bom' profile captures the properties & dependencies when _not_ using the Jenkins BOM:
         https://github.com/jenkinsci/jenkins/blob/master/bom/pom.xml
-       When the BOM is not being used, this profile is adding back the <dependencyManagement/> entries that were
+       When the BOM is not being used, this profile is adding back the <dependencyManagement /> entries that were
        moved to the BOM.
        The profile is enabled by default; if you _are_ using the Jenkins BOM then disable this profile by defining the
        'use-jenkins-bom' system property.

From 3830052414b86138f516ed6ddf4998f614743615 Mon Sep 17 00:00:00 2001
From: Oleg Nenashev <o.v.nenashev@gmail.com>
Date: Wed, 13 Nov 2019 18:14:27 +0100
Subject: [PATCH 3/3] [maven-release-plugin] prepare for next development
 iteration

---
 pom.xml | 4 ++--
 1 file changed, 2 insertions(+), 2 deletions(-)

diff --git a/pom.xml b/pom.xml
index a26883bbff..085309ef8a 100644
--- a/pom.xml
+++ b/pom.xml
@@ -28,7 +28,7 @@
 
   <groupId>org.jenkins-ci.plugins</groupId>
   <artifactId>plugin</artifactId>
-  <version>3.52</version>
+  <version>3.53-SNAPSHOT</version>
   <packaging>pom</packaging>
 
   <name>Jenkins Plugin Parent POM</name>
@@ -39,7 +39,7 @@
     <connection>scm:git:ssh://git@github.com/jenkinsci/plugin-pom.git</connection>
     <developerConnection>scm:git:ssh://git@github.com/jenkinsci/plugin-pom.git</developerConnection>
     <url>https://github.com/jenkinsci/plugin-pom</url>
-    <tag>plugin-3.52</tag>
+    <tag>HEAD</tag>
   </scm>
 
   <properties>