Add support to Bomr for aligning dependency versions

Closes gh-34114

Author: wilkinsona

buildSrc/src/main/java/org/springframework/boot/build/bom/BomExtension.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -62,6 +62,7 @@
 import org.springframework.boot.build.bom.Library.LibraryVersion;
 import org.springframework.boot.build.bom.Library.Module;
 import org.springframework.boot.build.bom.Library.ProhibitedVersion;
+import org.springframework.boot.build.bom.Library.VersionAlignment;
 import org.springframework.boot.build.bom.bomr.version.DependencyVersion;
 import org.springframework.boot.build.mavenplugin.MavenExec;
 import org.springframework.util.FileCopyUtils;
@@ -113,8 +114,12 @@ public void library(String name, String version, Action<LibraryHandler> action)
 		LibraryHandler libraryHandler = objects.newInstance(LibraryHandler.class, (version != null) ? version : "");
 		action.execute(libraryHandler);
 		LibraryVersion libraryVersion = new LibraryVersion(DependencyVersion.parse(libraryHandler.version));
+		VersionAlignment versionAlignment = (libraryHandler.alignWithVersion != null)
+				? new VersionAlignment(libraryHandler.alignWithVersion.from, libraryHandler.alignWithVersion.managedBy,
+						this.project, this.libraries, libraryHandler.groups)
+				: null;
 		addLibrary(new Library(name, libraryHandler.calendarName, libraryVersion, libraryHandler.groups,
-				libraryHandler.prohibitedVersions, libraryHandler.considerSnapshots));
+				libraryHandler.prohibitedVersions, libraryHandler.considerSnapshots, versionAlignment));
 	}
 
 	public void effectiveBomArtifact() {
@@ -220,6 +225,8 @@ public static class LibraryHandler {
 
 		private String calendarName;
 
+		private AlignWithVersionHandler alignWithVersion;
+
 		@Inject
 		public LibraryHandler(String version) {
 			this.version = version;
@@ -251,6 +258,11 @@ public void prohibit(Action<ProhibitedHandler> action) {
 					handler.endsWith, handler.contains, handler.reason));
 		}
 
+		public void alignWithVersion(Action<AlignWithVersionHandler> action) {
+			this.alignWithVersion = new AlignWithVersionHandler();
+			action.execute(this.alignWithVersion);
+		}
+
 		public static class ProhibitedHandler {
 
 			private String reason;
@@ -368,6 +380,22 @@ public void setClassifier(String classifier) {
 
 		}
 
+		public static class AlignWithVersionHandler {
+
+			private String from;
+
+			private String managedBy;
+
+			public void from(String from) {
+				this.from = from;
+			}
+
+			public void managedBy(String managedBy) {
+				this.managedBy = managedBy;
+			}
+
+		}
+
 	}
 
 	public static class UpgradeHandler {

buildSrc/src/main/java/org/springframework/boot/build/bom/CheckBom.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -35,6 +35,7 @@
 import org.springframework.boot.build.bom.Library.Group;
 import org.springframework.boot.build.bom.Library.Module;
 import org.springframework.boot.build.bom.Library.ProhibitedVersion;
+import org.springframework.boot.build.bom.Library.VersionAlignment;
 import org.springframework.boot.build.bom.bomr.version.DependencyVersion;
 
 /**
@@ -69,6 +70,7 @@ private void checkLibrary(Library library, List<String> errors) {
 		List<String> libraryErrors = new ArrayList<>();
 		checkExclusions(library, libraryErrors);
 		checkProhibitedVersions(library, libraryErrors);
+		checkVersionAlignment(library, libraryErrors);
 		if (!libraryErrors.isEmpty()) {
 			errors.add(library.getName());
 			for (String libraryError : libraryErrors) {
@@ -148,4 +150,28 @@ private void checkProhibitedVersions(Library library, List<String> errors) {
 		}
 	}
 
+	private void checkVersionAlignment(Library library, List<String> errors) {
+		VersionAlignment versionAlignment = library.getVersionAlignment();
+		if (versionAlignment == null) {
+			return;
+		}
+		Set<String> alignedVersions = versionAlignment.resolve();
+		if (alignedVersions.size() == 1) {
+			String alignedVersion = alignedVersions.iterator().next();
+			if (!alignedVersion.equals(library.getVersion().getVersion().toString())) {
+				errors.add("Version " + library.getVersion().getVersion() + " is misaligned. It should be "
+						+ alignedVersion + ".");
+			}
+		}
+		else {
+			if (alignedVersions.isEmpty()) {
+				errors.add("Version alignment requires a single version but none were found.");
+			}
+			else {
+				errors.add("Version alignment requires a single version but " + alignedVersions.size() + " were found: "
+						+ alignedVersions + ".");
+			}
+		}
+	}
+
 }

buildSrc/src/main/java/org/springframework/boot/build/bom/Library.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -16,12 +16,22 @@
 
 package org.springframework.boot.build.bom;
 
+import java.util.ArrayList;
 import java.util.Collections;
+import java.util.HashMap;
+import java.util.HashSet;
 import java.util.List;
 import java.util.Locale;
+import java.util.Map;
+import java.util.Set;
 
 import org.apache.maven.artifact.versioning.DefaultArtifactVersion;
 import org.apache.maven.artifact.versioning.VersionRange;
+import org.gradle.api.Project;
+import org.gradle.api.artifacts.Configuration;
+import org.gradle.api.artifacts.Dependency;
+import org.gradle.api.artifacts.dsl.DependencyHandler;
+import org.gradle.api.artifacts.result.DependencyResult;
 
 import org.springframework.boot.build.bom.bomr.version.DependencyVersion;
 
@@ -47,6 +57,8 @@ public class Library {
 
 	private final boolean considerSnapshots;
 
+	private final VersionAlignment versionAlignment;
+
 	/**
 	 * Create a new {@code Library} with the given {@code name}, {@code version}, and
 	 * {@code groups}.
@@ -57,9 +69,10 @@ public class Library {
 	 * @param groups groups in the library
 	 * @param prohibitedVersions version of the library that are prohibited
 	 * @param considerSnapshots whether to consider snapshots
+	 * @param versionAlignment version alignment, if any, for the library
 	 */
 	public Library(String name, String calendarName, LibraryVersion version, List<Group> groups,
-			List<ProhibitedVersion> prohibitedVersions, boolean considerSnapshots) {
+			List<ProhibitedVersion> prohibitedVersions, boolean considerSnapshots, VersionAlignment versionAlignment) {
 		this.name = name;
 		this.calendarName = (calendarName != null) ? calendarName : name;
 		this.version = version;
@@ -68,6 +81,7 @@ public Library(String name, String calendarName, LibraryVersion version, List<Gr
 				: name.toLowerCase(Locale.ENGLISH).replace(' ', '-') + ".version";
 		this.prohibitedVersions = prohibitedVersions;
 		this.considerSnapshots = considerSnapshots;
+		this.versionAlignment = versionAlignment;
 	}
 
 	public String getName() {
@@ -98,6 +112,10 @@ public boolean isConsiderSnapshots() {
 		return this.considerSnapshots;
 	}
 
+	public VersionAlignment getVersionAlignment() {
+		return this.versionAlignment;
+	}
+
 	/**
 	 * A version or range of versions that are prohibited from being used in a bom.
 	 */
@@ -280,4 +298,99 @@ public String getArtifactId() {
 
 	}
 
+	/**
+	 * Version alignment for a library.
+	 */
+	public static class VersionAlignment {
+
+		private final String from;
+
+		private final String managedBy;
+
+		private final Project project;
+
+		private final List<Library> libraries;
+
+		private final List<Group> groups;
+
+		private Set<String> alignedVersions;
+
+		VersionAlignment(String from, String managedBy, Project project, List<Library> libraries, List<Group> groups) {
+			this.from = from;
+			this.managedBy = managedBy;
+			this.project = project;
+			this.libraries = libraries;
+			this.groups = groups;
+		}
+
+		public Set<String> resolve() {
+			if (this.managedBy == null) {
+				throw new IllegalStateException("Version alignment without managedBy is not supported");
+			}
+			if (this.alignedVersions != null) {
+				return this.alignedVersions;
+			}
+			Library managingLibrary = this.libraries.stream()
+				.filter((candidate) -> this.managedBy.equals(candidate.getName()))
+				.findFirst()
+				.orElseThrow(() -> new IllegalStateException("Managing library '" + this.managedBy + "' not found."));
+			Map<String, String> versions = resolveAligningDependencies(managingLibrary);
+			Set<String> versionsInLibrary = new HashSet<>();
+			for (Group group : this.groups) {
+				for (Module module : group.getModules()) {
+					String version = versions.get(group.getId() + ":" + module.getName());
+					if (version != null) {
+						versionsInLibrary.add(version);
+					}
+				}
+				for (String plugin : group.getPlugins()) {
+					String version = versions.get(group.getId() + ":" + plugin);
+					if (version != null) {
+						versionsInLibrary.add(version);
+					}
+				}
+			}
+			this.alignedVersions = versionsInLibrary;
+			return this.alignedVersions;
+		}
+
+		private Map<String, String> resolveAligningDependencies(Library manager) {
+			DependencyHandler dependencyHandler = this.project.getDependencies();
+			List<Dependency> boms = manager.getGroups()
+				.stream()
+				.flatMap((group) -> group.getBoms()
+					.stream()
+					.map((bom) -> dependencyHandler
+						.platform(group.getId() + ":" + bom + ":" + manager.getVersion().getVersion())))
+				.toList();
+			List<Dependency> dependencies = new ArrayList<>();
+			dependencies.addAll(boms);
+			dependencies.add(dependencyHandler.create(this.from));
+			Configuration alignmentConfiguration = this.project.getConfigurations()
+				.detachedConfiguration(dependencies.toArray(new Dependency[0]));
+			Map<String, String> versions = new HashMap<>();
+			for (DependencyResult dependency : alignmentConfiguration.getIncoming()
+				.getResolutionResult()
+				.getAllDependencies()) {
+				versions.put(dependency.getFrom().getModuleVersion().getModule().toString(),
+						dependency.getFrom().getModuleVersion().getVersion());
+			}
+			return versions;
+		}
+
+		String getFrom() {
+			return this.from;
+		}
+
+		String getManagedBy() {
+			return this.managedBy;
+		}
+
+		@Override
+		public String toString() {
+			return "version from dependencies of " + this.from + " that is managed by " + this.managedBy;
+		}
+
+	}
+
 }

buildSrc/src/main/java/org/springframework/boot/build/bom/bomr/MultithreadedLibraryUpdateResolver.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -20,6 +20,7 @@
 import java.util.Collections;
 import java.util.List;
 import java.util.Map;
+import java.util.concurrent.CompletableFuture;
 import java.util.concurrent.ExecutionException;
 import java.util.concurrent.ExecutorService;
 import java.util.concurrent.Executors;
@@ -57,11 +58,16 @@ public List<LibraryWithVersionOptions> findLibraryUpdates(Collection<Library> li
 		LOGGER.info("Looking for updates using {} threads", this.threads);
 		ExecutorService executorService = Executors.newFixedThreadPool(this.threads);
 		try {
-			return librariesToUpgrade.stream()
-				.map((library) -> executorService.submit(
-						() -> this.delegate.findLibraryUpdates(Collections.singletonList(library), librariesByName)))
-				.flatMap(this::getResult)
-				.toList();
+			return librariesToUpgrade.stream().map((library) -> {
+				if (library.getVersionAlignment() == null) {
+					return executorService.submit(() -> this.delegate
+						.findLibraryUpdates(Collections.singletonList(library), librariesByName));
+				}
+				else {
+					return CompletableFuture.completedFuture(
+							this.delegate.findLibraryUpdates(Collections.singletonList(library), librariesByName));
+				}
+			}).flatMap(this::getResult).toList();
 		}
 		finally {
 			executorService.shutdownNow();

buildSrc/src/main/java/org/springframework/boot/build/bom/bomr/StandardLibraryUpdateResolver.java

@@ -1,5 +1,5 @@
 /*
- * Copyright 2012-2023 the original author or authors.
+ * Copyright 2012-2024 the original author or authors.
  *
  * Licensed under the Apache License, Version 2.0 (the "License");
  * you may not use this file except in compliance with the License.
@@ -23,6 +23,7 @@
 import java.util.LinkedHashMap;
 import java.util.List;
 import java.util.Map;
+import java.util.Set;
 import java.util.SortedSet;
 import java.util.function.BiPredicate;
 import java.util.stream.Collectors;
@@ -33,6 +34,7 @@
 import org.springframework.boot.build.bom.Library;
 import org.springframework.boot.build.bom.Library.Group;
 import org.springframework.boot.build.bom.Library.Module;
+import org.springframework.boot.build.bom.Library.VersionAlignment;
 import org.springframework.boot.build.bom.bomr.version.DependencyVersion;
 
 /**
@@ -65,7 +67,7 @@ public List<LibraryWithVersionOptions> findLibraryUpdates(Collection<Library> li
 			}
 			LOGGER.info("Looking for updates for {}", library.getName());
 			long start = System.nanoTime();
-			List<VersionOption> versionOptions = getVersionOptions(library, librariesByName);
+			List<VersionOption> versionOptions = getVersionOptions(library);
 			result.add(new LibraryWithVersionOptions(library, versionOptions));
 			LOGGER.info("Found {} updates for {}, took {}", versionOptions.size(), library.getName(),
 					Duration.ofNanos(System.nanoTime() - start));
@@ -77,8 +79,21 @@ protected boolean isLibraryExcluded(Library library) {
 		return library.getName().equals("Spring Boot");
 	}
 
-	protected List<VersionOption> getVersionOptions(Library library, Map<String, Library> libraries) {
-		return determineResolvedVersionOptions(library);
+	protected List<VersionOption> getVersionOptions(Library library) {
+		VersionOption option = determineAlignedVersionOption(library);
+		return (option != null) ? List.of(option) : determineResolvedVersionOptions(library);
+	}
+
+	private VersionOption determineAlignedVersionOption(Library library) {
+		VersionAlignment versionAlignment = library.getVersionAlignment();
+		if (versionAlignment != null) {
+			Set<String> alignedVersions = versionAlignment.resolve();
+			if (alignedVersions != null && alignedVersions.size() == 1) {
+				return new VersionOption.AlignedVersionOption(
+						DependencyVersion.parse(alignedVersions.iterator().next()), versionAlignment);
+			}
+		}
+		return null;
 	}
 
 	private List<VersionOption> determineResolvedVersionOptions(Library library) {