Can owlbot-java use the formatter defined in pom.xml?

[suztomo]

We can eliminate the discrepancy between the two if owlbot-java uses the formatter defined in the project:

• https://github.com/googleapis/java-shared-config/blob/main/pom.xml#L239
• https://github.com/googleapis/synthtool/blob/master/docker/owlbot/java/bin/format_source.sh#L36 (the version is set at https://github.com/googleapis/synthtool/blob/master/docker/owlbot/java/Dockerfile#L29)

[chingor13]

We do not want to run any mvn commands in the post-processor that use code from the repository. owl-bot runs in a privileged (albeit limited) environment and you can craft a pom.xml such that it loads malicious plugins that run arbitrary code.

For this reason, we included the java formatter jar in the post-processor image and ran it directly.

[suztomo]

@chingor13 Thank you for the background. That's a good principle worth written down somewhere (my todo).