[MNG-8450] Report BOM import warnings only at declaration sites

[goutamadwant]

Fixes #10179

Summary

Report conflicting BOM import warnings once at the model that declares the imports instead of repeating them for every inheriting child.

Implementation

• Preserve each imported dependency-management source's declaration location.
• Deduplicate warnings by declaration location and message within one top-level build.
• Route warnings to the declaring reactor model's problem collector.
• Use concurrent constant-time lookup for parallel model building.
• Reset diagnostic state between top-level builds and during reactor-root fallback.
• Preserve warnings from independent declarations and non-reactor parents.

Verification

• mvn --batch-mode verify
• Full maven-impl verification: 613 tests passed, 4 skipped
• Focused model-builder verification: 27 tests passed
• Coverage includes serial and parallel reactors, CI-friendly versions, child-activated parent profiles, repeated model-builder sessions, independent declarations, and non-reactor parents

Following this checklist to help us incorporate your contribution quickly and easily:

• This pull request addresses one issue without unrelated changes.
• The description explains what the change does, how, and why.
• The commit has a meaningful subject and DCO sign-off.
• Unit tests cover the behavioral changes.
• mvn verify passes.
• The Core IT suite has been run successfully.
• I hereby declare this contribution to be licenced under the Apache License Version 2.0, January 2004
• In any other case, please file an Apache Individual Contributor License Agreement.

[gnodet]

✅ Well-Designed Warning Deduplication

Solid fix for BOM import warning spam. The deduplication-by-declaration-site approach is clean, thread safety is correctly handled (ConcurrentHashMap.newKeySet() for dedup, ConcurrentHashMap for reactor collector lookup, CopyOnWriteArrayList/AtomicInteger/LongAdder in ProblemCollector.Impl), and state lifecycle is well-managed (deriveTopLevel() creates fresh dedup sets, loadFromRoot clears on reactor-root fallback).

Test coverage is thorough — serial and parallel builds, reactor and non-reactor parents, independent declarations, profile-activated imports, and repeated session builds.

Minor polish suggestions (non-blocking):

1. Fully-qualified Collectors — DefaultModelBuilderTest.java uses java.util.stream.Collectors fully qualified in two places while java.util.stream.Stream is already imported. Adding the import would be consistent.

2. Javadoc on ImportWarningKey — The new record at DefaultModelBuilder.java:684 would benefit from a brief comment explaining its role in deduplication.

3. Dual-key rationale in registerReactorProblemCollector — source.getLocation() (path form) and source.getPath().toUri().toString() (URI form) are registered as two separate keys. The dual-key approach works as a safety net, but a brief comment explaining the rationale would help future maintainers.

4. Anonymous collector extraction — The anonymous ModelProblemCollector in deduplicatingImportProblemCollector() delegates 7 methods. Consider extracting it as a named inner class for readability.

Note: The "Core IT suite has been run successfully" checkbox in the PR description is unchecked — maintainers may want confirmation before merging.

📋 PR Metadata

Aspect	Current	Suggested
Labels	(none)	enhancement
Milestone	(none)	4.1.0

🔀 Backport Status

✅ Not needed — the V40 warning was introduced in Maven 4.0, so this fix correctly targets master only.

This review was generated by an AI agent and may contain inaccuracies. Please verify all suggestions before applying.

Claude Code on behalf of Guillaume Nodet