Want artifact traceability without giving up the SNAPSHOT qualifier

Question

Background. My org uses Maven, Bamboo and Artifactory to support a continuous integration process. We rely on Maven's SNAPSHOT qualifier to help manage storage in Artifactory (rotate out old SNAPSHOT builds) and also to help keep cross-team integrations current (Maven checks for updates to SNAPSHOT dependencies automatically on each build).

Problem. One of the challenges we're having is around correctly promoting builds from environment to environment while continuing to use SNAPSHOT. Say that a tester deploys version 1.8.2-SNAPSHOT to a functional test environment, and it's at rev 1400 in Subversion. Let's say also that it passes functional test. By the time a tester decides to pull 1.8.2-SNAPSHOT from Artifactory into the performance testing environment, a developer could have committed a change to Subversion, so the actual binary in Artifactory is at a different rev. How do we ensure that the rev doesn't change out from under us when using SNAPSHOT builds?

Constraints. We obviously don't want to deploy different builds unknowingly. We also don't want to rebuild from source as we want to test the exact binary in performance test that we tested in functional test.

Approaches we've considered. The thought is that we want to stamp the versions with a fourth component, like 1.8.2.1400, where the fourth component is a Subversion rev. (As a side question, is there a Maven plugin or something else that does that automatically?) But if we do that, then essentially we lose the SNAPSHOT feature since Maven and Artifactory think that these are different versions.

We are using Scrum, so we deploy to the test environments very early (like day two or so). I don't think it makes sense to remove the SNAPSHOT qualifier that early in the dev cycle because we lose the SNAPSHOT benefits again.

Would appreciate knowing how other orgs solve this issue.

Goethe

Answer 1

Just to circle back on this one, I wanted to share what we are doing.

Basically we deploy snapshot builds like 1.8.2-SNAPSHOT into the development environment. No other teams need to use these builds, so it is fine to leave -SNAPSHOT on them.

But any build that we deploy to a test environment (e.g. functional test, system test) or else production must include the revision; e.g., 1.8.2.1400. We call these "quads". The reason for insisting upon quads in test is that we can attach issues (features, bugfixes, etc.) to specific revisions so the testers know what to test. For production it's really just because we want to deploy exactly the same artifact that we tested, so that means we're deploying a quad.

Anyway hope that information is useful to somebody.

Goethe

Answer 2

if you enable "uniqueVersion" for you snapshot builds, every snapshot deployed will have a unique id. you can use that to ensure you are deploying the correctly promote builds across environments.

and, as a side note, you can use the buildnumber-maven-plugin to add subversion buildnumbers to artifacts.

Sikh

Yeah, but doesn't that prevent the Maven repo from harvesting old snapshots? – Goethe

Oh, and thanks for the reference to the buildnumber-maven-plugin. – Goethe

@Willie - yeah, that's true. assuming you only use snapshots for a short amount of time (few weeks or so), you could configure your repo cleanup to keep snapshots for a given amount of time which spans their usefulness. – Sikh

Answer 3

Rather than embed the build number of VCS revision in the artifact's version, we embed the CI build number in the META-INF/MANIFEST-MF file .

See for instance Using Hudson environment variables to identify your builds . Although the article is applicable to Jenkins/Hudson I believe it is trivial to port to Bamboo.

Dane

I see. Yeah, we talked about doing that as well, since it is easier to recover the VCS rev from the CI build number than it is to do the reverse. Was that your main motivation or did you have other ideas? – Goethe

My motivation was to be to know what version I'm testing against. I never considered embedding anything in the artifact version number, since that is not directly available to the user - which was my main goal - and seemed harder to accomplish. – Dane