Tidy up

[cstamas]

Removal of Ant left some remnants, clean them up.

[cstamas]

ping @odisseus

[manandbytes]

cache: 'maven' would enable caching of Maven artifacts

[cstamas]

The cache: 'maven' would cache local repository, and usually this is not what you want. But I agree, we can use this "low hanging fruit" until come up with better cache.

[manandbytes]

The cache: 'maven' would cache local repository, and usually this is not what you want. But I agree, we can use this "low hanging fruit" until come up with better cache.

Now Maven does not download anything and this is what I want:

Cache hit for: setup-java-Linux-x64-maven-3ddbf759ed683e90355f47106d5267473ecc42a2c13648ab09a57287f5d9dfa9
...
Cache restored successfully
Cache restored from key: setup-java-Linux-x64-maven-3ddbf759ed683e90355f47106d5267473ecc42a2c13648ab09a57287f5d9dfa9

[cstamas]

That's right, with pre-populated local repository it will pick up everything (even corruption) from previous build. This is why caching local repository is wrong.

Maven caching without re-using local repository is much better:
https://maveniverse.eu/blog/2025/09/16/maven-local-repository/
and
https://maveniverse.eu/docs/mimir/

[cstamas]

Or in other words: building with empty local repository AND still downloading nothing is what CI should do, as otherwise it is prone to same issues as your workstation, and leads to issues "works for me (on my workstation)" but fails on my colleagues workstation (and endless scratching heads why).

[cstamas]

Thanks @manandbytes and @odisseus for helping!
Will merge once @ianopolous or @vorburger take a peek and approve.

[ianopolous]

Is there a way to include hashes in the pom for dependencies so we are not vulnerable to third party tampering?

[cstamas]

Yes, not in the pom but it is possible to lock down key deps.
See:

• https://maven.apache.org/resolver/expected-checksums.html
• https://github.com/cstamas/tc-demo

[ianopolous]

That was a large factor of why I had vendored dependencies. To rule out a class of supply chain attack.

[cstamas]

Related https://maveniverse.eu/blog/2025/12/06/lockfiles/

[cstamas]

Let's go baby steps :)
SHA512 for key deps (POMs and JARs) added but as is here, is fragile (fail if missing=false), this means if POM is modified and dependency changes to other GAV no sha512 will be validated. Other solution is failIfMissing=true and record whole build SHA512 checksums, but for that we need more for Maven build, at least make build reproducible....

[ianopolous]

Nice!