Maven Enforcer Plugin and Blue-Green Deployment Artifact Consistency

Answer

The most effective Enforcer rule for detecting unplanned changes in the transitive dependency hierarchy is dependencyConvergence. It fails the build when any artifact is resolved to more than one version, thereby catching version drift between blue and green builds.

Confirmed facts

• dependencyConvergence works out‑of‑the‑box with any Maven project.
• When you already maintain a centralized BOM (or dependencyManagement) that defines the baseline versions, the rule only needs to verify that no resolved version deviates from that BOM.
• If you want to restrict the allowed version range for specific libraries, combine dependencyConvergence with requireUpperBoundDeps (or bannedDependencies) to lock upper bounds.

Steps to enforce parity across blue and green profiles

1. Place identical Enforcer configuration in <pluginManagement> of the parent POM:

<plugin>
    <groupId>org.apache.maven.plugins</groupId>
    <artifactId>maven-enforcer-plugin</artifactId>
    <version>3.4.1</version>
    <executions>
        <execution>
            <id>enforce-dependencies</id>
            <goals><goal>enforce</goal></goals>
            <phase>verify</phase>
            <configuration>
                <rules>
                    <dependencyConvergence/>
                    
                    <requireUpperBoundDeps/>
                </rules>
            </configuration>
        </execution>
    </executions>
</plugin>

2. Activate separate profiles (e.g., -Pblue and -Pgreen) that import the same BOM or dependencyManagement section. Ensure the profiles do not alter version definitions.
3. Run the build with mvn verify -Pblue and mvn verify -Pgreen. The Enforcer will fail if any transitive version differs between the two runs.
4. For verification, compare the resolved trees: mvn dependency:tree -DoutputFile=blue.txt -Pblue and the same for green, then diff blue.txt green.txt.

Missing diagnostic detail

Do you already maintain a centralized BOM or dependencyManagement section that defines the baseline versions for all transitive dependencies? If not, you will need to create one before the Enforcer rules can guarantee strict parity.