What are your versioning semantics for repeatable builders? What’s your governance for stable, snapshot and release? How do you have version range semantic governance for automatic updates? How do you handle splitting knowledge across different builds and using dependencies (and transitive dependencies) to combine this, and have versioning semantics and governance work across those transitive dependencies. This is complex stuff to do right.
We’ve gone for a solution that addresses the widest set of requirements we have had over the years, and provides it in a commonly understood way.
We did what you proposed in 5x, and it just ended in endless questions and complaints from people who wanted something with enterprise semantics. Our main aim for now was to have a single solution, that addressed the widest set of requirements, which embedded Maven provides. We do plan to progress beyond this, which I’ll come back to in a moment.
For now if you look through the api examples it shows how to do a lot of stuff manually, like loading jars from disk and updating versions - all without maven. It wouldn’t take much for you to disk scan for new jars, load it into the repository and call updateToVersion - as long as you don’t use SNAPSHOT, RELEASE or LATEST in your versioning semantics. And of course don’t want dependency resolving.
We’ve avoided providing this, because stunted solutions without enough thought and planning end up growing beyond original expectation and require support and maintenance, and before you know it you are back with the 5x knowledge-agent. So I want to make sure anything we do grows out and compliments what we have already.
At the moment kie-ci uses maven to both resolve dependencies and updates and then apply them. In the future we might look at ways of splitting this, especially as I want to move to a more “pushed” based deployment, which would not require maven or anything else installed on the client side. Any resolving or governance is determined else where and the results pushed to the kie-ci server to apply. In our case this would be some maven based service that would result in the push, but you could do your own simple disk scanner and your own push.
This is a myth i’ve heard repeated “you shouldn’t put maven on a production box”. There is no reason for this, it’s a massively tested piece of software with high levels of reliability. Nothing is installed, as it uses embedded maven and aether, which is just another project library jar on your class path. The only issues are that it doesn’t play nicely in an OSGi environment, due to plexus, although we’ve managed to work around this. The complexity is hidden from the user, so this again is a non issue.
They can, and you can see this from the api examples, that demonstrate how to do this manually. But as per above, when you automate this, at an enterprise level it may require everything I listed in my first paragraph. For now we prefer people to roll their own - rather than lock us into a stunted solution.