Fix SNAPSHOT uploads for Artifactory repositories

[sugarmanz]

What is the goal of this PR?

Fix SNAPSHOT uploads for Artifactory repositories. Due to the order of upload, Artifactory would expand the SNAPSHOT differently for the POM and JAR artifacts, resulting in mismatched artifacts:

You can see that the POM version SNAPSHOT resolved to 20210916.163241-1 and the JAR version SNAPSHOT resolved to 20210916.163242-2. Furthermore, the POM checksum uploads would fail as they would be attempted to upload for the latest SNAPSHOT, 20210916.163242-2, which wouldn't exist:

Target file to set checksum on doesn't exist: MySnapshotRepo:com/example/bazel/plugin/0.0.9canary13-SNAPSHOT/plugin-0.0.9canary13-20210916.163242-2.pom

What are the changes implemented in this PR?

Uploading the JAR artifact first fixes this issue and didn't affect uploads to release repositories.

[lolski]

Thank you @sugarmanz ! The PR looks sensible.

I would like to understand the issue a bit more: is the issue caused by the fact we upload the POM first before the JAR, instead of the other way around? If that's the case, does every maven repository implementation impose this particular ordering?

[sugarmanz]

Hey @lolski! The issue is indeed caused by uploading the POM first before the JAR. That being said, I've struggled to find explicit documentation on this matter for Artifactory. I have a meeting with our Artifactory team to see if they have any more knowledge than I and can update here with any findings, or lack-thereof.

In terms of whether this is affects other Maven repository managers, I'm not entirely sure as I really only was trying to upload to an Artifactory repo. I'll pull down the latest Nexus docker and test it out though. If there are any other repository managers you'd like me to test out, let me know!

[sugarmanz]

I did verify that on Nexus, ordering does not matter. i.e. both master and the PR branch works for uploading snapshot artifacts to a Nexus repository.

[lolski]

I did verify that on Nexus, ordering does not matter.

@sugarmanz right. So are you saying that the issue affects Artifactory only, and not Nexus?

[sugarmanz]

@sugarmanz right. So are you saying that the issue affects Artifactory only, and not Nexus?

Correct.

[lolski]

PR merged. Thank you for your contribution @sugarmanz !