Properly establish cross dependenies across maven artifacts

Fixes: #566
See also grpc/grpc-java#12640
PiperOrigin-RevId: 871541021

Author: l46kok

.github/workflows/cross_artifact_dependencies_check.sh

@@ -0,0 +1,83 @@
+#!/bin/bash
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o pipefail
+
+TARGETS=(
+  "//publish:cel"
+  "//publish:cel_common"
+  "//publish:cel_compiler"
+  "//publish:cel_runtime"
+  "//publish:cel_protobuf"
+  "//publish:cel_v1alpha1"
+)
+
+echo "------------------------------------------------"
+echo "Checking for duplicates..."
+echo "------------------------------------------------"
+
+bazel build "${TARGETS[@]}" || { echo "Bazel build failed"; exit 1; }
+
+
+(
+  for target in "${TARGETS[@]}"; do
+    # Locate the jar
+    jar_path=$(bazel cquery "$target" --output=files 2>/dev/null | grep '\-project.jar$')
+
+    if [[ -z "$jar_path" ]]; then
+      echo "Error: Could not find -project.jar for target $target" >&2
+      exit 1
+    fi
+
+    # Fix relative paths if running from a subdir.
+    if [[ ! -f "$jar_path" ]]; then
+        if [[ -f "../../$jar_path" ]]; then
+           jar_path="../../$jar_path"
+        else
+           echo "Error: File not found at $jar_path" >&2
+           exit 1
+        fi
+    fi
+
+    echo "Inspecting: $target" >&2
+
+    # Extract classes and append the target name to the end of the line
+    # Format: dev/cel/expr/Expr.class //publish:cel_compiler
+    jar tf "$jar_path" | grep "\.class$" | awk -v tgt="$target" '{print $0, tgt}'
+  done
+) | awk '
+  # $1 is the Class Name, $2 is the Target Name
+  seen[$1] {
+    print "❌ DUPLICATE FOUND: " $1
+    print "   Present in: " seen[$1]
+    print "   And in:     " $2
+    dupe=1
+    next
+  }
+  { seen[$1] = $2 }
+
+  END { if (dupe) exit 1 }
+'
+
+EXIT_CODE=$?
+
+if [ $EXIT_CODE -eq 0 ]; then
+  echo "✅ Success: No duplicate classes found."
+else
+  echo "⛔ Failure: Duplicate classes (or missing jars) detected."
+fi
+
+exit $EXIT_CODE
+

.github/workflows/workflow.yml

@@ -15,6 +15,29 @@ concurrency:
     cancel-in-progress: true
 
 jobs:
+  Static-Checks:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - run: echo "🎉 The job was automatically triggered by a ${{ github.event_name }} event."
+      - run: echo "🐧 Job is running on a ${{ runner.os }} server!"
+      - run: echo "🔎 The name of your branch is ${{ github.ref }} and your repository is ${{ github.repository }}."
+      - name: Check out repository code
+        uses: actions/checkout@v6
+      - name: Setup Bazel
+        uses: bazel-contrib/setup-bazel@0.18.0
+        with:
+            # Avoid downloading Bazel every time.
+            bazelisk-cache: true
+            # Store build cache per workflow.
+            disk-cache: ${{ github.workflow }}
+            # Share repository cache between workflows.
+            repository-cache: true
+      - name: Unwanted Dependencies
+        run: .github/workflows/unwanted_deps.sh
+      - name: Cross Artifact Duplicate Classes Check
+        run: .github/workflows/cross_artifact_dependencies_check.sh
+      - run: echo "🍏 This job's status is ${{ job.status }}."
   Bazel-Tests:
     runs-on: ubuntu-latest
     timeout-minutes: 30
@@ -25,7 +48,7 @@ jobs:
       - name: Check out repository code
         uses: actions/checkout@v6
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.14.0
+        uses: bazel-contrib/setup-bazel@0.18.0
         with:
             # Avoid downloading Bazel every time.
             bazelisk-cache: true
@@ -41,13 +64,33 @@ jobs:
         # Exclude codelab exercises as they are intentionally made to fail
         # Exclude maven conformance tests. They are only executed when there's version change.
         run: bazelisk test ... --deleted_packages=//codelab/src/test/codelab --test_output=errors --test_tag_filters=-conformance_maven --build_tag_filters=-conformance_maven
+      - run: echo "🍏 This job's status is ${{ job.status }}."
 
-      # -- Start of Maven Conformance Tests (Ran only when there's version changes) --
-      - name: Get changed file
+  # -- Start of Maven Conformance Tests (Ran only when there's version changes) --
+  Maven-Conformance:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - run: echo "🎉 The job was automatically triggered by a ${{ github.event_name }} event."
+      - run: echo "🐧 Job is running on a ${{ runner.os }} server!"
+      - run: echo "🔎 The name of your branch is ${{ github.ref }} and your repository is ${{ github.repository }}."
+      - name: Check out repository code
+        uses: actions/checkout@v6
+      - name: Get changed files
         id: changed_file
         uses: tj-actions/changed-files@v46
         with:
           files: publish/cel_version.bzl
+      - name: Setup Bazel
+        if: steps.changed_file.outputs.any_changed == 'true'
+        uses: bazel-contrib/setup-bazel@0.18.0
+        with:
+            # Avoid downloading Bazel every time.
+            bazelisk-cache: true
+            # Store build cache per workflow.
+            disk-cache: ${{ github.workflow }}
+            # Share repository cache between workflows.
+            repository-cache: true
       - name: Verify Version Consistency
         if: steps.changed_file.outputs.any_changed == 'true'
         run: |
@@ -72,8 +115,4 @@ jobs:
       - name: Run Conformance Maven Test on Version Change
         if: steps.changed_file.outputs.any_changed == 'true'
         run: bazelisk test //conformance/src/test/java/dev/cel/conformance:conformance_maven --test_output=errors
-      # -- End of Maven Conformance Tests --
-
-      - name: Unwanted Dependencies
-        run: .github/workflows/unwanted_deps.sh
       - run: echo "🍏 This job's status is ${{ job.status }}."

common/src/main/java/dev/cel/common/internal/BUILD.bazel

@@ -7,6 +7,7 @@ package(
     ],
     default_visibility = [
         "//common/internal:__pkg__",
+        "//publish:__pkg__",
     ],
 )
 

common/src/main/java/dev/cel/common/types/BUILD.bazel

@@ -7,6 +7,7 @@ package(
     ],
     default_visibility = [
         "//common/types:__pkg__",
+        "//publish:__pkg__",
     ],
 )
 

common/src/main/java/dev/cel/common/values/BUILD.bazel

@@ -7,6 +7,7 @@ package(
     ],
     default_visibility = [
         "//common/values:__pkg__",
+        "//publish:__pkg__",
     ],
 )