Plugin POM inheritance

[Basil Crow]

Should jenkinsci/plugin-pom be made to inherit from jenkinsci/pom?
jenkinsci/plugin-pom duplicates a large amount of material from
jenkinsci/pom, and inheriting it instead would greatly ease
maintenance by allowing the duplicate material to be deleted. There
are only a few things in jenkinsci/pom that we do _not_ want to be
inherited by plugins:

- Top-level URL: This can simply be deleted from jenkinsci/pom after
verifying that all core components have it.

- Mailing lists, issue management, and CI management: These can simply
be moved to jenkinsci/jenkins or deleted.

- A managed dependency on a specific version of SpotBugs annotations:
this is inappropriate for plugins because they get their copy of
SpotBugs annotations via their Jenkins core dependency. This can
simply be deleted from jenkinsci/pom and inlined into core and core
components (if needed).

- FindSecBugs. Similarly, this can simply be deleted from
jenkinsci/pom and inlined into core and core components (if needed).

Altogether I think such a change, while not trivial, is likely
feasible. Does anyone have any opinions about whether or not we should
do this?

[Jesse Glick]

On Thu, Jan 19, 2023 at 6:19 PM Basil Crow <m...@basilcrow.com> wrote:

I think such a change, while not trivial, is likely feasible.

+1, thanks for reviewing & classifying the bits we would not want to inherit (or which are obsolete).

[Basil Crow]

Unfortunately the benefits of this idea are severely diminished
because Maven does not really support profile inheritance:

http://www.dashbay.com/2011/03/maven-profile-inheritance/
https://issues.apache.org/jira/browse/MNG-5127

So while we could deduplicate properties, managed dependencies, and
Maven plugin configuration that takes place outside a profile (around
200 lines of duplicate code), we would not be able to deduplicate
Maven plugin configuration that takes place inside a profile (about
250 lines of duplicate code). And there are other downsides: increased
complexity, more involved functional testing, and slower propagation
of updates, to say nothing of the effort it would take to implement.
Altogether I doubt the benefits are worth the costs.