Skip to content

Conversation

ppalaga
Copy link
Contributor

@ppalaga ppalaga commented Sep 11, 2025

@aloubyansky this just adds a bunch of TODOs and questions about the various configuration options which I kindly ask you to address.

Comment on lines +62 to +64
* * ensure that "but should not be added as project artifacts" is still true
* * If it is not true, add an option to make it configurable.
* * If there is any chance to rename it, additionalBoms would be a better name
Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

These 3 points are addressed in #383

@ppalaga
Copy link
Contributor Author

ppalaga commented Sep 12, 2025

I think it would be good to discuss the terminology a bit. Here are some initial ideas:

Root artifacts - I heart this from you @aloubyansky and I like the term. Those are artifacts whose transitive dependencies are to be tracked. There are several ways how the set of root artifacts can be defined/selected:

  1. By filtering from the Initial universe of artifacts "BOM driven". The filters are given by include and exclude patterns. This is very powerful and practical.
  2. By Enumerating some specific GAVs
  3. Union of 1. and 2.
  4. ?

Initial universe of artifacts - I kinda miss this term in the docs and I think it would be useful to introduce it. The term Universe comes from the set theory which I generally find a good place to steal terminology from.
The Initial universe of artifacts has to be defined for BOM driven filtering. Enumerating specific GAVs does not require it.
The Initial universe of artifacts is defined by one ("Project BOM", "Own BOM", "Primary BOM") or more (primary plus "additional", "secondary" or "non-project") BOMs.

It is currently not clear to me, whether pointing domino at a source tree

A. Defines the initial universe per se or
B. Helps to specify the initial BOM
C. Defines the set of root artifacts and the filtering and BOMs are not relevant at all

@ppalaga
Copy link
Contributor Author

ppalaga commented Sep 12, 2025

It is currently not clear to me, whether pointing domino at a source tree

A. Defines the initial universe per se or
B. Helps to specify the initial BOM
C. Defines the set of root artifacts and the filtering and BOMs are not relevant at all

I must say I currently find only B. useful - i.e. if the root BOM is only specified as g:a then the version could be read from the current source tree.
I think we could save us some implementation complexity if we do not do anything else. I would even not bother doing anything for Gradle.
If the user installs the artifacts locally by building the source tree, then Domino should be able to operate on Local Maven repository where all relevant pom.xml files can be found, no?

* <p>
* See {@link ProjectDependencyConfig} for interactions with other configuration options.
*
* Does the source tree have to be built before running the analysis?
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

No, it doesn't have to be built.

@aloubyansky
Copy link
Member

All domino does is resolves dependency graphs and walks them. For that it needs to know the root nodes and possibly version constraints that should be enforced.

The notion of a project BOM is just a convenience to determine the root nodes in some cases.

Project directory is used only to determine the root nodes that should be processed and initialize the Maven resolver with the workspace POMs, so the dependencies are resolvable w/o building the project.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants