[8.19] [CI] Native module checker CLI should ignore optional transitive dependencies (#226277) (#226430)

# Backport

This will backport the following commits from `main` to `8.19`:
- [[CI] Native module checker CLI should ignore optional transitive
dependencies (#226277)](#226277)

<!--- Backport version: 9.6.6 -->

### Questions ?
Please refer to the [Backport tool
documentation](https://github.com/sorenlouv/backport)

<!--BACKPORT [{"author":{"name":"Alex
Szabo","email":"[email protected]"},"sourceCommit":{"committedDate":"2025-07-03T13:35:03Z","message":"[CI]
Native module checker CLI should ignore optional transitive dependencies
(#226277)\n\n## Summary\nThe native module usage checker CLI is used to
prevent natively compiled\nmodules to be part of the production
builds.\n\nSince transitive optional dependencies are not installed in
production\nbuilds, it's not necessary to alert on these native modules
appearing\nwhen
optional.","sha":"cec1a92c27954ff93dedc580d3e71454bf8c6bf2","branchLabelMapping":{"^v9.2.0$":"main","^v(\\d+).(\\d+).\\d+$":"$1.$2"}},"sourcePullRequest":{"labels":["Team:Operations","release_note:skip","backport:version","v9.1.0","v8.19.0","v9.2.0","v8.18.4","v9.0.4"],"title":"[CI]
Native module checker CLI should ignore optional transitive
dependencies","number":226277,"url":"https://github.com/elastic/kibana/pull/226277","mergeCommit":{"message":"[CI]
Native module checker CLI should ignore optional transitive dependencies
(#226277)\n\n## Summary\nThe native module usage checker CLI is used to
prevent natively compiled\nmodules to be part of the production
builds.\n\nSince transitive optional dependencies are not installed in
production\nbuilds, it's not necessary to alert on these native modules
appearing\nwhen
optional.","sha":"cec1a92c27954ff93dedc580d3e71454bf8c6bf2"}},"sourceBranch":"main","suggestedTargetBranches":["9.1","8.19","8.18","9.0"],"targetPullRequestStates":[{"branch":"9.1","label":"v9.1.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"8.19","label":"v8.19.0","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"main","label":"v9.2.0","branchLabelMappingKey":"^v9.2.0$","isSourceBranch":true,"state":"MERGED","url":"https://github.com/elastic/kibana/pull/226277","number":226277,"mergeCommit":{"message":"[CI]
Native module checker CLI should ignore optional transitive dependencies
(#226277)\n\n## Summary\nThe native module usage checker CLI is used to
prevent natively compiled\nmodules to be part of the production
builds.\n\nSince transitive optional dependencies are not installed in
production\nbuilds, it's not necessary to alert on these native modules
appearing\nwhen
optional.","sha":"cec1a92c27954ff93dedc580d3e71454bf8c6bf2"}},{"branch":"8.18","label":"v8.18.4","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"},{"branch":"9.0","label":"v9.0.4","branchLabelMappingKey":"^v(\\d+).(\\d+).\\d+$","isSourceBranch":false,"state":"NOT_CREATED"}]}]
BACKPORT-->

Co-authored-by: Alex Szabo <[email protected]>

Author: kibanamachine

packages/kbn-check-prod-native-modules-cli/check_prod_native_modules.ts

@@ -107,7 +107,7 @@ async function checkProdNativeModules(log: ToolingLog) {
 
   try {
     // Gets all production dependencies based on package.json and then searches across transient dependencies using lock file
-    const rawProductionDependencies = findProductionDependencies(log, await readYarnLock());
+    const rawProductionDependencies = findProductionDependencies(log, await readYarnLock(), true);
 
     // Converts rawProductionDependencies into a simple Map of production dependencies
     const productionDependencies: Map<string, boolean> = new Map();

packages/kbn-check-prod-native-modules-cli/integration_tests/__fixtures__/with_optional_native_modules/node_modules/optional-native-module/binding.gyp

@@ -0,0 +1,7 @@
+{
+  "name": "with-optional-native-modules-project",
+  "version": "1.0.0",
+  "dependencies": {
+    "package-x": "^2.0.0"
+  }
+}

packages/kbn-check-prod-native-modules-cli/integration_tests/__fixtures__/with_optional_native_modules/node_modules/optional-native-module/package.json

@@ -0,0 +1,11 @@
+optional-native-module@^1.0.0:
+  version "1.0.0"
+  resolved "https://registry.yarnpkg.com/optional-native-module/-/optional-native-module-1.0.0.tgz"
+  integrity sha1-example789
+
+package-x@^2.0.0:
+  version "2.0.0"
+  resolved "https://registry.yarnpkg.com/package-x/-/package-x-2.0.0.tgz"
+  optionalDependencies:
+    optional-native-module "^1.0.0"
+  integrity sha1-example456

packages/kbn-check-prod-native-modules-cli/integration_tests/__fixtures__/with_optional_native_modules/node_modules/package-x/package.json

@@ -149,4 +149,34 @@ describe('checkProdNativeModules', () => {
       'Production native modules were detected and logged above'
     );
   });
+
+  it('should ignore optional dependencies when checking for native modules', async () => {
+    // Use a fixture with optional dependencies
+    const withOptionalNativeModulesDir = path.join(fixturesDir, 'with_optional_native_modules');
+    const withOptionalNativeModulesPkgJsonPath = path.join(
+      withOptionalNativeModulesDir,
+      'package.json'
+    );
+    jest.spyOn(process, 'cwd').mockReturnValue(withOptionalNativeModulesDir);
+    // eslint-disable-next-line @typescript-eslint/no-var-requires
+    jest.replaceProperty(require('@kbn/repo-info'), 'REPO_ROOT', withOptionalNativeModulesDir);
+
+    const withOptionalNativeModulesPkgJson = JSON.parse(
+      fs.readFileSync(withOptionalNativeModulesPkgJsonPath, 'utf8')
+    );
+
+    jest.replaceProperty(
+      // eslint-disable-next-line @typescript-eslint/no-var-requires
+      require('@kbn/repo-info'),
+      'kibanaPackageJson',
+      withOptionalNativeModulesPkgJson
+    );
+
+    const result = await checkProdNativeModules(mockLog);
+
+    expect(result).toBe(false);
+    expect(mockLog.success).toHaveBeenCalledWith(
+      'No production native modules installed were found'
+    );
+  });
 });

packages/kbn-check-prod-native-modules-cli/integration_tests/__fixtures__/with_optional_native_modules/package.json

@@ -17,11 +17,15 @@ import { YarnLock } from './yarn_lock';
  * dependencies listed in package.json and then traversing deeply into the transitive
  * dependencies as declared by the yarn.lock file.
  */
-export function findProductionDependencies(log: SomeDevLog, yarnLock: YarnLock) {
+export function findProductionDependencies(
+  log: SomeDevLog,
+  yarnLock: YarnLock,
+  ignoreOptional = false
+) {
   const resolved = new Map<string, { name: string; version: string }>();
 
   // queue of dependencies entries, we will add the transitive dependencies to
-  // this queue as we itterate
+  // this queue as we iterate
   const depQueue = Object.entries(kibanaPackageJson.dependencies);
 
   for (const [name, versionRange] of depQueue) {
@@ -40,10 +44,9 @@ export function findProductionDependencies(log: SomeDevLog, yarnLock: YarnLock)
 
     resolved.set(key, { name, version: pkg.version });
 
-    const allDepsEntries = [
-      ...Object.entries(pkg.dependencies || {}),
-      ...Object.entries(pkg.optionalDependencies || {}),
-    ];
+    const allDepsEntries = Object.entries(pkg.dependencies || {}).concat(
+      ignoreOptional ? [] : Object.entries(pkg.optionalDependencies || {})
+    );
 
     for (const [childName, childVersionRange] of allDepsEntries) {
       depQueue.push([childName, childVersionRange]);