Require force_version for root module artifact to take precedence (#1423)

This addresses concerns raised by owners of popular bazel modules that their inputs to the default namespace would be overridden by accident.

Author: shs96c

MODULE.bazel

@@ -876,6 +876,11 @@ dev_maven.install(
     lock_file = "//tests/custom_maven_install:root_wins_install.json",
     resolver = "maven",
 )
+dev_maven.amend_artifact(
+    name = "root_wins",
+    coordinates = "io.netty:netty-buffer",
+    force_version = True,
+)
 
 bazel_dep(name = "root_wins_layer", version = "0.0.0", dev_dependency = True)
 local_path_override(

examples/bzlmod/MODULE.bazel

@@ -16,6 +16,7 @@ maven = use_extension("@rules_jvm_external//:extensions.bzl", "maven")
 maven.artifact(
     artifact = "guava",
     exclusions = ["com.google.code.findbugs:jsr305"],
+    force_version = True,
     group = "com.google.guava",
     version = "31.1-jre",
 )

examples/bzlmod/maven_install.json

@@ -1,10 +1,9 @@
 {
   "__AUTOGENERATED_FILE_DO_NOT_MODIFY_THIS_FILE_MANUALLY": "THERE_IS_NO_DATA_ONLY_ZUUL",
-  "__INPUT_ARTIFACTS_HASH": -1307306091,
-  "__RESOLVED_ARTIFACTS_HASH": -1663972293,
+  "__INPUT_ARTIFACTS_HASH": -909275114,
+  "__RESOLVED_ARTIFACTS_HASH": 2025923254,
   "conflict_resolution": {
-    "com.google.errorprone:error_prone_annotations:2.5.1": "com.google.errorprone:error_prone_annotations:2.18.0",
-    "com.google.guava:guava:31.1-jre": "com.google.guava:guava:32.0.1-jre"
+    "com.google.errorprone:error_prone_annotations:2.5.1": "com.google.errorprone:error_prone_annotations:2.18.0"
   },
   "artifacts": {
     "biz.aQute.bnd:biz.aQute.bnd.util": {
@@ -156,10 +155,10 @@
     },
     "com.google.guava:guava": {
       "shasums": {
-        "jar": "bd7fa227591fb8509677d0d1122cf95158f3b8a9f45653f58281d879f6dc48c5",
-        "sources": "9105dfc522fb440b39ff8da07cc56aacf65a9f765044c7803a9f32e36e05a22b"
+        "jar": "a42edc9cab792e39fe39bb94f3fca655ed157ff87a8af78e1d6ba5b07c4a00ab",
+        "sources": "8ab1853cdaf936ec88be80c17302b7c20abafbd4f54d4fb54d7011c529e3a44a"
       },
-      "version": "32.0.1-jre"
+      "version": "31.1-jre"
     },
     "com.google.guava:guava-testlib": {
       "shasums": {
@@ -858,7 +857,6 @@
       "org.checkerframework:checker-compat-qual"
     ],
     "com.google.guava:guava": [
-      "com.google.code.findbugs:jsr305",
       "com.google.errorprone:error_prone_annotations",
       "com.google.guava:failureaccess",
       "com.google.guava:listenablefuture",

private/extensions/maven.bzl

@@ -261,26 +261,36 @@ def _find_duplicate_artifacts_across_submodules(non_root_artifacts, root_maven_m
     return duplicates
 
 def _deduplicate_artifacts_with_root_priority(name, root_artifacts, non_root_artifacts):
-    """Deduplicate artifacts, giving priority to root module artifacts."""
+    """Deduplicate artifacts, giving priority to root module artifacts with force_version set."""
 
-    # Collect maven modules from root artifacts (handle mixed types)
-    root_maven_modules = []
+    # Collect maven modules from root artifacts that have force_version = True
+    root_maven_modules_with_force_version = []
+    for artifact in root_artifacts:
+        if getattr(artifact, "force_version", False):
+            maven_module = _get_maven_module(artifact)
+            if maven_module not in root_maven_modules_with_force_version:
+                root_maven_modules_with_force_version.append(maven_module)
+
+    # Collect all maven modules from root artifacts (for duplicate detection)
+    all_root_maven_modules = []
     for artifact in root_artifacts:
         maven_module = _get_maven_module(artifact)
-        if maven_module not in root_maven_modules:
-            root_maven_modules.append(maven_module)
+        if maven_module not in all_root_maven_modules:
+            all_root_maven_modules.append(maven_module)
 
     # Find duplicates across sub-modules that aren't overridden by root
     duplicate_submodule_artifacts = _find_duplicate_artifacts_across_submodules(
         non_root_artifacts,
-        root_maven_modules,
+        all_root_maven_modules,
     )
 
-    # Filter non-root artifacts that conflict with root artifacts
+    # Filter non-root artifacts that conflict with root artifacts that have force_version = True
     filtered_non_root = []
     for artifact in non_root_artifacts:
         maven_module = _get_maven_module(artifact)
-        if not maven_module in root_maven_modules:
+
+        # Only exclude if root module has force_version = True for this coordinate
+        if not maven_module in root_maven_modules_with_force_version:
             filtered_non_root.append(artifact)
 
     # Log detailed warning for duplicate sub-module artifacts
@@ -293,7 +303,7 @@ def _deduplicate_artifacts_with_root_priority(name, root_artifacts, non_root_art
                 warning_parts.append(maven_module)
 
         print("WARNING: The following coordinates from `%s` appear in multiple sub-modules with potentially different versions. " % name +
-              "Consider adding one of these to your root module to ensure consistent versions:\n\t%s" %
+              "Consider adding one of these to your root module to ensure consistent versions and setting `force_version = True` on that artifact:\n\t%s" %
               "\n\t".join(sorted(warning_parts)))
 
     return root_artifacts + filtered_non_root

tests/custom_maven_install/root_wins_install.json

@@ -1,6 +1,6 @@
 {
   "__AUTOGENERATED_FILE_DO_NOT_MODIFY_THIS_FILE_MANUALLY": "THERE_IS_NO_DATA_ONLY_ZUUL",
-  "__INPUT_ARTIFACTS_HASH": -1723917414,
+  "__INPUT_ARTIFACTS_HASH": -935842665,
   "__RESOLVED_ARTIFACTS_HASH": -1272363274,
   "artifacts": {
     "io.netty:netty-buffer": {