NPE on requireReleaseDeps with non-matching includes

Overview

When a requireReleaseDeps rule is configured with an <include> pattern that does not match any artifacts in the module, it results in a NullPointerException. Stacktrace attached in stacktrace.txt.

Minimal test case

To reproduce, use attached pom.enforcer-npe.xml and run:

mvn -f pom.enforcer-npe.xml -X validate

Actual Results: The build fails with NullPointerException

Expected Results: The build succeeds because there is no SNAPSHOT version of a matching artifact that violates the requireReleaseDeps rule.

Workarounds:

If the <include> entry matches no artifacts because there is no such dependency in the project, the workaround is simple: remove the unnecessary <includes>. (This is the scenario presented in the minimal test case above.)

Another scenario is that the maven-enforcer-plugin configuration is in the parent module of a multi-module project where some child modules have a dependency on 'testgroup:testartifact' and others do not. The parent module is configured to disallow SNAPSHOT versions of that artifact. If the parent module or one of the child modules do not have that dependency, then the <include> fails to match during validation and the NPE happens. This is more complicated to work around - the configuration must be copied to each module and adjusted based on each individual module's dependencies.