Boo...I though Sonatype was supposed to catch this sort of thing. https://issues.sonatype.org/browse/OSSRH-24828

More motivation for another quick-flip release.

I am not sure how your build works totally but typically you can catch this with using the Maven release plugin (can be a PITA.. I know).

Alternatively for a more lightweight check you could add the enforcer plugin invocation to your release profile.

http://maven.apache.org/enforcer/enforcer-rules/requireReleaseDeps.html

Thank you for the suggestions, @mosabua!

Our release is rather complicated (almost a dozen different artifacts, submodules, etc) so the release plugin may not work for us. Adding a lightweight plugin to check it probably will work out better.

@mkristian what do you think?

If we just need to solve the problem, a grep of pom.rb for SNAPSHOT would have caught this. Could that go into whatever scripts you have for deploying.

It appears we do have this plugin in the root poms, but perhaps it's not properly getting enabled for a non-snapshot release:

/pom.rb

    unless model.version =~ /-SNAPSHOT/
       #rules[:requireReleaseDeps] = { :message => 'No Snapshots Allowed!' }
    end
    plugin :enforcer, '1.4' do
      execute_goal :enforce, :rules => rules
    end

@chrisseaton I certainly wouldn't consider it a solution if we have to add more manual steps...and it's probably not a very good solution if we have to add something to @enebo's scripts when we should be shrinking them.

This really should be automated by either Maven itself or by Sonatype OSSRH. It's never correct for a maven-central jar to be released with snapshot deps.

You really just have to figure out there is no "-SNAPSHOT" version string. The "Maven way" to work around this is to use the release plugin or the enforcer rule. It seems you are already using it but the usage of the requireReleaseDeps rule is deactivated if I see this correctly from the snippet.

@mosabua Yes, this rule should end up being enabled when we switch to a non-SNAPSHOT release version for JRuby itself, but that doesn't appear to be triggering.

@mosabua Sorry, I understand what you were saying...we have the rules commented out. We'll see if we can set up a better version of this that uses Maven profiles instead.

I modified the "release" profile to enable (unconditionally) the enforcer, and that appears to work without breaking non-release SNAPSHOT builds of JRuby.

I'll go with this but still need buy-in from @mkristian and @enebo.

diff --git a/pom.rb b/pom.rb
index 50c8e69..065be87 100644
--- a/pom.rb
+++ b/pom.rb
@@ -122,12 +122,6 @@ project 'JRuby', 'https://github.com/jruby/jruby' do
     plugin :jar, '2.6'

     rules = { :requireMavenVersion => { :version => '[3.3.0,)' } }
-    unless model.version =~ /-SNAPSHOT/
-       #rules[:requireReleaseDeps] = { :message => 'No Snapshots Allowed!' }
-    end
-    plugin :enforcer, '1.4' do
-      execute_goal :enforce, :rules => rules
-    end

     plugin :compiler, '3.3'
     plugin :shade, '2.4.3'
@@ -276,6 +270,9 @@ project 'JRuby', 'https://github.com/jruby/jruby' do
   end

   profile 'release' do
+    plugin :enforcer, '1.4' do
+      execute_goal :enforce, :rules => { requireReleaseDeps: { :message => 'No Snapshots Allowed!' } }
+    end
     modules [ 'truffle', 'test', 'maven' ]
     properties 'invoker.skip' => true
   end

Output:

...
[INFO] --- maven-enforcer-plugin:1.4:enforce (enforce-maven) @ jruby-core ---
[INFO] 
[INFO] --- maven-enforcer-plugin:1.4:enforce (default) @ jruby-core ---
[WARNING] Rule 0: org.apache.maven.plugins.enforcer.RequireReleaseDeps failed with message:
No Snapshots Allowed!
Found Banned Dependency: com.github.jnr:jnr-constants:jar:0.9.3-SNAPSHOT
Use 'mvn dependency:tree' to locate the source of the banned dependencies.
[INFO] ------------------------------------------------------------------------
[INFO] Reactor Summary:
[INFO] 
[INFO] JRuby .............................................. SUCCESS [  1.515 s]
[INFO] JRuby Core ......................................... FAILURE [  1.257 s]
[INFO] JRuby Lib Setup .................................... SKIPPED
...

I have released jnr-constants 0.9.3 to central, so we can fix our dep once it propagates.

I've also committed my patch (plus the mistakenly-removed maven version constraint) and pushed to the test_enforcer branch.

I am glad it works @headius and I could provide some help.

This issue is fixed by getting jnr-constants 0.9.3 release out and using it in the build in 1ed8422. After review, we will also merge in #4137 to hopefully prevent this happening again.

@headius the release plugin does not work with our pom.rb and did cause strange problems in the beginning using maven for jruby. so I think you guys have found the best solution :)