3rd party dependency management

[justinwyer]

As discussed in this weeks team meeting the requirements for managing 3rd party dependencies are:

1. Regardless of the state of the upstream project source remains accessible.
2. Process should be transparent for users (can be managed by richgit.sh if required).

I recommend we fork (or import to github if upstream project uses another SCM, we may need to update occasionally) the upstream project. At a point in RF development we tag the our fork and this tag is added/updated as a git submodule to the revelent RF project. This fits our git workflow well.

We should have a wiki page dedicated to this as well as notes in the sandbox project.

[lfryc]

Hi Justin,

this is great idea, I think git submodules will work for us,

I would suggest to create new organization richfaces-thirdparty to allow migrate non-Git repositories there and do not pollute richfaces organization repositories much.

15:21:16 <wyer> balunasj, sub module works with non git repos too so that is good

You have mentioned [1] that it is possible to add non-git repositories via git submodules when we discussed it previously.

I'm not sure how does it work.

[1] http://transcripts.jboss.org/meeting/irc.freenode.org/richfaces/2011/richfaces.2011-08-03-15.06.log.html

[justinwyer]

Hi Lukas yeah I thought it could point to external non git repos, but I was wrong (thinking of something else). Regardless we would still need to bring source into github if its not there to be forked to ensure continuity of the 3rd party source regardless of what occurs in that project.

[lfryc]

Hey Justin,

sure, we would need to clone repository also if it is hosted in Git,

since Git Submodules don't store the referenced repos, they are just storing information where they can be found,

so it will not assure these repos will be accessible in future.

[lfryc]

There are also some Git extensions for cloning non-Git SCM repos like SVN, Mercurial, which can help us with process of cloning.

[bleathem]

This is great - Lukas I like the idea of creating a sperate github "organisation" to host these.  There is no telling how many repose we will have to fork over time.

We'll have to fit this in to our development/release process.  So we don't forget to update and tag the forks when we upgrade the components.  I suppose it would be ideal if our build used the forkes directly, to make sure we are in fact updating and tagging appropriately.  Something with the maven shade plugin perhaps?

[lfryc]

Just to be sure - we are talking about JavaScript dependencies only.

These we are able to re-package as Maven dependencies, but not sure we are able to make Maven work together with their build systems.

Btw, there is list of third-party dependencies: http://community.jboss.org/wiki/RichFacesDependencies