Azure-sdk-for-java: What maven repository is version 3.2.0-beta.1 of azure-spring-boot-starter-active-directory hosted on?

[spencergibb]

Query/Question
What maven repository is version 3.2.0-beta.1 of azure-spring-boot-starter-active-directory hosted on?

I tried the following but it didn't work.
https://pkgs.dev.azure.com/azure-sdk/public/_packaging/azure-sdk-for-java/maven/v1

Why is this not a Bug or a feature Request?
Probably a small documentation issue.

Setup (please complete the following information if applicable):

• OS: [e.g. iOS]
• IDE : [e.g. IntelliJ]
• Version of the Library used

Information Checklist
Kindly make sure that you have added all the following information above and checkoff the required fields otherwise we will treat the issuer as an incomplete report

• [ ] Query Added
• [ ] Setup information Added

[seanli1988]

3.2.0-beta.1 has not been released. We will release it in late February. Once it's released you can find it here:
https://mvnrepository.com/artifact/com.azure.spring/azure-spring-boot-starter-active-directory

[chenrujun]

Hi, @spencergibb

1. master branch is under developing. In master branch, the version is 3.2.0-beta.1.
2. The latest released branch is 3.1.0. So please use 3.1.0.
3. You can check the release information in changelog: https://github.com/Azure/azure-sdk-for-java/blob/master/sdk/spring/azure-spring-boot-starter-active-directory/CHANGELOG.md
4. If you want to read README about a released version, you can checkout related tag, for example: https://github.com/Azure/azure-sdk-for-java/tree/azure-spring-boot-starter-active-directory_3.1.0/sdk/spring/azure-spring-boot-starter-active-directory

[spencergibb]

Thanks, I guess I just think it's odd not to have a snapshot as what mentioned in master.

[brunoborges]

@chenrujun @JonathanGiles

I think there is an important point here to discuss and understand: should a version like 3.2.0-beta.1 be in a pom.xml and not be released in Maven Central? The common practice is that a non-released version is *-SNAPSHOT.

[chenrujun]

@brunoborges

a version like 3.2.0-beta.1 be in a pom.xml and not be released in Maven Central?

No. All versions written in changelog with a specific date have already released in Maven Central.

Example:

1. https://github.com/Azure/azure-sdk-for-java/blob/master/sdk/spring/azure-spring-boot-starter-cosmos/CHANGELOG.md#300-beta1-2020-11-18
2. https://repo.maven.apache.org/maven2/com/azure/spring/azure-spring-boot-starter-cosmos/3.0.0-beta.1/

[spencergibb]

I guess bruno was pointing out it's very odd for maven projects to have a non snapshot version in docs and pom.xml in an active development branch.

[chenrujun]

@spencergibb I agree that it's odd.
@mitchdenny Can we use snapshot in developing branch (master)?

[brunoborges]

@chenrujun to be more specific, it is a best and common practice that pom.xml files have a -SNAPSHOT suffix in the <version> element of development branches. A version with "beta" is expected to be in Maven Central, and that is what caused the confusion in @spencergibb, and also in myself.

I checked about 4 projects in the Azure SDK repository, and all four have a <version> with a beta.1 suffix instead of a -SNAPSHOT. Is this the pattern across all Azure SDK projects?

[chenrujun]

@brunoborges

Is this the pattern across all Azure SDK projects?

In this repo, we use bata.n instead of -SNAPSHOT for master branch.

Refs: https://github.com/Azure/azure-sdk-for-java/blob/master/eng/versioning/version_client.txt

But I don't know why.

Hi, @mitchdenny , could you please explain this?

[mitchdenny]

From an EngSys perspective we've made the decision not support SNAPSHOTS. This goes both for consuming or releasing them. We prefer instead to use explicit version numbers so we can always reason over the dependency graph at any given point in time and know what version of a package we are using.

Best practice is highly debatable. The problem with consuming a SNAPSHOT is that you don't actually know what you are ingesting into your build. At best it can lead to unreliable builds/tests, and at worst it can be a great supply chain attack vector.

[spencergibb]

So you don't deploy development versions anywhere? To try it you have build it yourself?

[mitchdenny]

You can grab nightly builds here: https://dev.azure.com/azure-sdk/public/_packaging?_a=feed&feed=azure-sdk-for-java

[weshaggard]

There is some more information about our versioning strategy https://azure.github.io/azure-sdk/policies_releases.html#java-1.

[brunoborges]

@weshaggard I see the following in the document: Beta packages are published directly to the Maven central registry.

So, if a project has a pom.xml with a given version in beta, shouldn't that version be in Central?

[spencergibb]

Nightly builds but no snapshots is super strange. That thwarts maven resolution rules

[spencergibb]

So back to my original query. How to use the version documented in the readme. At least document how to do that and how to find the latest release

[chenrujun]

@spencergibb

How to use the version documented in the readme.

You can build by yourself:

mvn clean install -pl .\sdk\spring\azure-spring-boot-starter-active-directory\ -am

At least document how to do that and how to find the latest release

It make sense. We'll add it. Thank you for your suggestion.

[weshaggard]

@weshaggard Wes Haggard FTE I see the following in the document: Beta packages are published directly to the Maven central registry.

The beta versions will eventually get published to maven central. There is always the version under development that has not yet been published to maven but will eventually. If you need the latest dev version you should use the alpha versions from our dev feed see information at https://github.com/Azure/azure-sdk-for-java/blob/master/CONTRIBUTING.md#dev-feed. For your example you can see the alpha versions of azure-spring-boot-starter-active-directory at https://dev.azure.com/azure-sdk/public/_packaging?_a=package&feed=azure-sdk-for-java&package=com.azure.spring%3Aazure-spring-boot-starter-active-directory&protocolType=maven&version=3.2.0-alpha.20210217.0&view=versions.

Nightly builds but no snapshots is super strange. That thwarts maven resolution rules

We chose this option because of a number of reasons but in general based on our experience SNAPSHOT builds are super unreliable. While we understand that goes against some of the Java ecosystem support we felt it is better overall for our project. We already have enough reliability issues with Maven as it is but after we removed the use of SNAPSHOT versions our builds have been much more reliable.

[weshaggard]

I've added some updates to our docs in #19330 to help capture some of this discussion.