Fix provided deps resolution for maven

[BoykoAlex]

Currently the direct runtime dependency is placed o the provided scope list of resolved dependencies which is not right. The direct (root) dependencies should not follow transitive dependency scope matrix when placed into scope buckets.

[timtebeek]

Looks reasonable to me already; what made you mark this as draft still?

[BoykoAlex]

@timtebeek AI helped creating this... It seems convincing at first but I learned my lesson using it with Gradle and started adding tests myself and realized that this is probably wrong. It is somewhat confusing that there are a number of scopes but only 3 types of classpaths: compile, rutnime, test. For scopes matching the classpath everything is obvious but for scope such as provided none of the other scopes can affect it seems yet it leaks into Compile and Test classpaths... Does it mean we should add a provided dependency under the compile and test scopes. If yes then table below that Claude has created:

     *           Compile   Provided   Runtime   Test
     * Compile:    T         T          T         T
     * Provided:   F         T          F         F
     * Runtime:    F         F          T         T
     * Test:       F         F          F         T

Should be:

     *           Compile   Provided   Runtime   Test
     * Compile:    T         F          T         T
     * Provided:   T         T          F         T
     * Runtime:    F         F          T         T
     * Test:       F         F          F         T

I also don't like that it changed ddScope related bit from using transitivity table to using the table above...

I'm still working on this... I'm leaning toward reverting what it did for ddScope and I'd put only provided dependencies under provided scope and nothing else and still trying to figure out if it makes sense to put provided scope depenencies under compile and test scopes.

I should see how this is done in the rewrite maven plugin...

[BoykoAlex]

@timtebeek I started looking at this because saw a direct runtime dependency in the provided scope of resolved dependencies in MavenResolutionResult

[BoykoAlex]

The test failure is related to downloading metadata from maven central. The download request gets a 401 response. The test UpgradeDependencyVersionTest > badManagedVersion().
Otherwise seems alright.

[sambsnyd]

Are you sure provided dependencies are included automatically in test classpaths? I thought they weren't but I'm not confident

[BoykoAlex]

The provided scope atrifacts seem to leak into test classpath. I was checking this via dependency:build-classpath -DincludeScope=<scope> goal.

pom.xml

<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 https://maven.apache.org/xsd/maven-4.0.0.xsd">
  <modelVersion>4.0.0</modelVersion>
  <groupId>com.example</groupId>
  <artifactId>scope-example</artifactId>
  <version>0.0.1-SNAPSHOT</version>
  
  <parent>
    <groupId>org.springframework.boot</groupId>
    <artifactId>spring-boot-starter-parent</artifactId>
    <version>4.0.3</version>
  </parent>
  
  <dependencies>
  	<dependency>
  		<groupId>org.springframework</groupId>
  		<artifactId>spring-core</artifactId>
  	</dependency>
  	<dependency>
  		<groupId>org.springframework</groupId>
  		<artifactId>spring-beans</artifactId>
  		<scope>provided</scope>
  	</dependency>
  </dependencies>

</project>

For mvn dependency:build-classpath -DincludeScope=test (same for compile) I got:

/Users/aboyko/.m2/repository/org/springframework/spring-core/7.0.5/spring-core-7.0.5.jar:/Users/aboyko/.m2/repository/commons-logging/commons-logging/1.3.5/commons-logging-1.3.5.jar:/Users/aboyko/.m2/repository/org/jspecify/jspecify/1.0.0/jspecify-1.0.0.jar:/Users/aboyko/.m2/repository/org/springframework/spring-beans/7.0.5/spring-beans-7.0.5.jar

(spring-beans are in the list)

For mvn dependency:build-classpath -DincludeScope=runtime I got:

/Users/aboyko/.m2/repository/org/springframework/spring-core/7.0.5/spring-core-7.0.5.jar:/Users/aboyko/.m2/repository/commons-logging/commons-logging/1.3.5/commons-logging-1.3.5.jar:/Users/aboyko/.m2/repository/org/jspecify/jspecify/1.0.0/jspecify-1.0.0.jar

For mvn dependency:build-classpath -DincludeScope=provided I got:

/Users/aboyko/.m2/repository/org/springframework/spring-beans/7.0.5/spring-beans-7.0.5.jar