cytoscape/cytoscape#35: Move source:aggregate into a 'sources' profile, use HTTPS repos

[chrtannus]

Part of the multi-repository fix for cytoscape/cytoscape#35. Main description and full verification: cytoscape/cytoscape#36.

⚠️ Must merge together with cytoscape/cytoscape-impl and cytoscape/cytoscape-app-developer.

Changes

Move source:aggregate into a sources profile. api/pom.xml bound maven-source-plugin's aggregate goal to the package phase of api-parent. That goal forks a generate-sources lifecycle over every module, and a forked lifecycle resolves dependencies from the local repository rather than the reactor — so at api-parent, module 2 of 122, it looked for event-api before the reactor had built it. Any build whose version was not already in ~/.m2 died there, which is every build right after a version bump.

Not a circular dependency: the module graph is acyclic and the reactor order was already correct. Also note -Dmaven.source.skip=true does not help — the fork is planned before the skip flag is evaluated.

The aggregated sources JAR is still needed by the app-developer kit, so it moves to a sources profile used as a second pass:

mvn clean install -DskipTests
mvn install -Psources -DskipTests

Use HTTPS for Maven repositories. The remaining http:// URLs in .travis.settings.xml become https://; Maven 3.8.1+ blocks plain http. Repository ids are unchanged, so cached artifacts stay valid.

Verification

Verified as part of the full seven-repository build on develop against a genuinely empty local repository with no settings file: 122 SUCCESS / 0 FAILURE on both passes, zero blocked-mirror errors. Details in cytoscape/cytoscape#36.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Build Improvements

  • Updated artifact repository connections to use secure HTTPS endpoints.
  • Source archive generation is now optional, helping streamline standard builds.
  • Added guidance for generating aggregated source archives, including the required build steps and repository considerations.

• Documentation

  • Clarified how to enable optional source packaging and the conditions required for successful generation.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 048b9085-c8cf-4108-8fdd-e8ae41a96a21

📥 Commits

Reviewing files that changed from the base of the PR and between 8fbed90 and eae84bf.

📒 Files selected for processing (2)

• .travis.settings.xml
• pom.xml

---

📝 Walkthrough

Walkthrough

The PR changes Maven repository URLs from HTTP to HTTPS and moves aggregate source generation from the default build into an opt-in sources profile.

Changes

Build configuration

Layer / File(s)	Summary
Secure Maven repository URLs .travis.settings.xml	Cytoscape snapshots, releases, third-party artifacts, and Maven Central use HTTPS URLs.
Opt-in source aggregation pom.xml	The aggregate source execution runs in the sources profile during package. The POM documents the required two-pass invocation and repository limitation.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to eae84

This change moves source aggregation into an explicit build profile and updates repository URLs to HTTPS; no actionable merge-blocking risk remains after normal checks and review.

Possibly related issues

• cytoscape/cytoscape#35 — The PR moves aggregate source generation into an opt-in profile and updates repository URLs to HTTPS.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly identifies both main changes: moving source aggregation into a profile and updating Maven repository URLs to HTTPS.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch fix/35-build-from-root

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}