Fix scope for some git plugin transitive dependencies getting pulled as 'compile' instead of 'test'

[Vlatombe]

hpi plugin bug?

[jglick]

Typically this is not a mojo bug but a POM mistake; it means that the dependency would also have been pulled in from some other source, and the currently visible test-scoped dependency trail is merely the closest to root. For example, mvn dependency:tree after

diff --git a/pom.xml b/pom.xml
index f7099517..65c1e9c6 100644
--- a/pom.xml
+++ b/pom.xml
@@ -154,12 +154,24 @@
       <groupId>org.jenkins-ci.plugins</groupId>
       <artifactId>git</artifactId>
       <scope>test</scope>
+      <exclusions>
+          <exclusion>
+              <groupId>joda-time</groupId>
+              <artifactId>joda-time</artifactId>
+          </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>org.jenkins-ci.plugins</groupId>
       <artifactId>git</artifactId>
       <classifier>tests</classifier>
       <scope>test</scope>
+      <exclusions>
+          <exclusion>
+              <groupId>joda-time</groupId>
+              <artifactId>joda-time</artifactId>
+          </exclusion>
+      </exclusions>
     </dependency>
     <dependency>
       <groupId>org.jenkins-ci.plugins</groupId>

gives

[INFO] +- org.jenkinsci.plugins:pipeline-model-extensions:jar:1.3.7:compile (optional) 
[INFO] |  +- org.jenkinsci.plugins:pipeline-model-api:jar:1.3.7:compile
[INFO] |  |  +- com.fasterxml.jackson.datatype:jackson-datatype-json-org:jar:2.9.8:compile
[INFO] |  |  |  \- org.json:json:jar:20171018:compile
[INFO] |  |  \- com.github.fge:json-schema-validator:jar:2.0.4:compile
[INFO] |  |     +- com.github.fge:json-schema-core:jar:1.0.4:compile
[INFO] |  |     |  \- org.mozilla:rhino:jar:1.7R4:compile
[INFO] |  |     +- javax.mail:mailapi:jar:1.4.3:compile
[INFO] |  |     +- joda-time:joda-time:jar:2.1:compile

[jglick]

Therefore the better fix is to decide which trail you want to use, and add <exclusions> for the other(s). There is also a mojo bug contributing to this: JENKINS-58771

[jglick]

Be sure to test this live, not just mvn hpi:run.

[Vlatombe]

Didn't see any problem. Looking at the git blame for this, I see this was added back in the day where jackson was packaged directly in the plugin.