Properly establish cross dependenies across maven artifacts

Also removes antlr dependency from `dev.cel:runtime` artifact

Fixes: #566
See also grpc/grpc-java#12640
PiperOrigin-RevId: 871541021

Author: l46kok

.github/workflows/cross_artifact_dependencies_check.sh

@@ -0,0 +1,83 @@
+#!/bin/bash
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+set -o pipefail
+
+TARGETS=(
+  "//publish:cel"
+  "//publish:cel_common"
+  "//publish:cel_compiler"
+  "//publish:cel_runtime"
+  "//publish:cel_protobuf"
+  "//publish:cel_v1alpha1"
+)
+
+echo "------------------------------------------------"
+echo "Checking for duplicates..."
+echo "------------------------------------------------"
+
+JDK8_FLAGS="--java_language_version=8 --java_runtime_version=8"
+bazel build $JDK8_FLAGS "${TARGETS[@]}" || { echo "Bazel build failed"; exit 1; }
+
+(
+  for target in "${TARGETS[@]}"; do
+    # Locate the jar
+    jar_path=$(bazel cquery "$target" --output=files 2>/dev/null | grep '\-project.jar$')
+
+    if [[ -z "$jar_path" ]]; then
+      echo "Error: Could not find -project.jar for target $target" >&2
+      exit 1
+    fi
+
+    # Fix relative paths if running from a subdir.
+    if [[ ! -f "$jar_path" ]]; then
+        if [[ -f "../../$jar_path" ]]; then
+           jar_path="../../$jar_path"
+        else
+           echo "Error: File not found at $jar_path" >&2
+           exit 1
+        fi
+    fi
+
+    echo "Inspecting: $target" >&2
+
+    # Extract classes and append the target name to the end of the line
+    # Format: dev/cel/expr/Expr.class //publish:cel_compiler
+    jar tf "$jar_path" | grep "\.class$" | awk -v tgt="$target" '{print $0, tgt}'
+  done
+) | awk '
+  # $1 is the Class Name, $2 is the Target Name
+  seen[$1] {
+    print "❌ DUPLICATE FOUND: " $1
+    print "   Present in: " seen[$1]
+    print "   And in:     " $2
+    dupe=1
+    next
+  }
+  { seen[$1] = $2 }
+
+  END { if (dupe) exit 1 }
+'
+
+EXIT_CODE=$?
+
+if [ $EXIT_CODE -eq 0 ]; then
+  echo "✅ Success: No duplicate classes found."
+else
+  echo "⛔ Failure: Duplicate classes (or missing jars) detected."
+fi
+
+exit $EXIT_CODE
+

.github/workflows/unwanted_deps.sh

@@ -36,10 +36,14 @@ checkUnwantedDeps '//publish:cel_runtime' '@cel_spec'
 checkUnwantedDeps '//publish:cel_runtime' 'protobuf_java_util'
 checkUnwantedDeps '//publish:cel' 'protobuf_java_util'
 
+# cel_runtime shouldn't depend on antlr
+checkUnwantedDeps '//publish:cel_runtime' '@maven//:org_antlr_antlr4_runtime'
+
 # cel_runtime shouldn't depend on the protobuf_lite runtime
 checkUnwantedDeps '//publish:cel_runtime' '@maven_android//:com_google_protobuf_protobuf_javalite'
 checkUnwantedDeps '//publish:cel' '@maven_android//:com_google_protobuf_protobuf_javalite'
 
-# cel_runtime_android shouldn't depend on the full protobuf runtime
+# cel_runtime_android shouldn't depend on the full protobuf runtime or antlr
 checkUnwantedDeps '//publish:cel_runtime_android' '@maven//:com_google_protobuf_protobuf_java'
+checkUnwantedDeps '//publish:cel_runtime_android' '@maven//:org_antlr_antlr4_runtime'
 exit 0

.github/workflows/workflow.yml

@@ -15,6 +15,29 @@ concurrency:
     cancel-in-progress: true
 
 jobs:
+  Static-Checks:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - run: echo "🎉 The job was automatically triggered by a ${{ github.event_name }} event."
+      - run: echo "🐧 Job is running on a ${{ runner.os }} server!"
+      - run: echo "🔎 The name of your branch is ${{ github.ref }} and your repository is ${{ github.repository }}."
+      - name: Check out repository code
+        uses: actions/checkout@v6
+      - name: Setup Bazel
+        uses: bazel-contrib/setup-bazel@0.18.0
+        with:
+            # Avoid downloading Bazel every time.
+            bazelisk-cache: true
+            # Store build cache per workflow.
+            disk-cache: ${{ github.workflow }}
+            # Share repository cache between workflows.
+            repository-cache: true
+      - name: Unwanted Dependencies
+        run: .github/workflows/unwanted_deps.sh
+      - name: Cross Artifact Duplicate Classes Check
+        run: .github/workflows/cross_artifact_dependencies_check.sh
+      - run: echo "🍏 This job's status is ${{ job.status }}."
   Bazel-Tests:
     runs-on: ubuntu-latest
     timeout-minutes: 30
@@ -25,7 +48,7 @@ jobs:
       - name: Check out repository code
         uses: actions/checkout@v6
       - name: Setup Bazel
-        uses: bazel-contrib/setup-bazel@0.14.0
+        uses: bazel-contrib/setup-bazel@0.18.0
         with:
             # Avoid downloading Bazel every time.
             bazelisk-cache: true
@@ -41,13 +64,33 @@ jobs:
         # Exclude codelab exercises as they are intentionally made to fail
         # Exclude maven conformance tests. They are only executed when there's version change.
         run: bazelisk test ... --deleted_packages=//codelab/src/test/codelab --test_output=errors --test_tag_filters=-conformance_maven --build_tag_filters=-conformance_maven
+      - run: echo "🍏 This job's status is ${{ job.status }}."
 
-      # -- Start of Maven Conformance Tests (Ran only when there's version changes) --
-      - name: Get changed file
+  # -- Start of Maven Conformance Tests (Ran only when there's version changes) --
+  Maven-Conformance:
+    runs-on: ubuntu-latest
+    timeout-minutes: 30
+    steps:
+      - run: echo "🎉 The job was automatically triggered by a ${{ github.event_name }} event."
+      - run: echo "🐧 Job is running on a ${{ runner.os }} server!"
+      - run: echo "🔎 The name of your branch is ${{ github.ref }} and your repository is ${{ github.repository }}."
+      - name: Check out repository code
+        uses: actions/checkout@v6
+      - name: Get changed files
         id: changed_file
         uses: tj-actions/changed-files@v46
         with:
           files: publish/cel_version.bzl
+      - name: Setup Bazel
+        if: steps.changed_file.outputs.any_changed == 'true'
+        uses: bazel-contrib/setup-bazel@0.18.0
+        with:
+            # Avoid downloading Bazel every time.
+            bazelisk-cache: true
+            # Store build cache per workflow.
+            disk-cache: ${{ github.workflow }}
+            # Share repository cache between workflows.
+            repository-cache: true
       - name: Verify Version Consistency
         if: steps.changed_file.outputs.any_changed == 'true'
         run: |
@@ -72,8 +115,4 @@ jobs:
       - name: Run Conformance Maven Test on Version Change
         if: steps.changed_file.outputs.any_changed == 'true'
         run: bazelisk test //conformance/src/test/java/dev/cel/conformance:conformance_maven --test_output=errors
-      # -- End of Maven Conformance Tests --
-
-      - name: Unwanted Dependencies
-        run: .github/workflows/unwanted_deps.sh
       - run: echo "🍏 This job's status is ${{ job.status }}."

common/BUILD.bazel

@@ -79,6 +79,12 @@ cel_android_library(
     exports = ["//common/src/main/java/dev/cel/common:cel_source_android"],
 )
 
+java_library(
+    name = "cel_source_helper",
+    visibility = ["//:internal"],
+    exports = ["//common/src/main/java/dev/cel/common:cel_source_helper"],
+)
+
 java_library(
     name = "cel_ast",
     exports = ["//common/src/main/java/dev/cel/common:cel_ast"],
@@ -108,9 +114,6 @@ java_library(
     visibility = [
         "//:internal",
         # TODO: Remove references to the following clients
-        "//java/com/google/abuse/admin/notebook/compiler/checkedtypes:__pkg__",
-        "//java/com/google/paymentfraud/v2/util/featurereplay/common/risklogrecordio:__pkg__",
-        "//java/com/google/payments/consumer/growth/treatmentconfig/management/backend/service/config/utils:__pkg__",
     ],
     exports = ["//common/src/main/java/dev/cel/common:cel_descriptor_util"],
 )

common/internal/BUILD.bazel

@@ -11,6 +11,11 @@ java_library(
     exports = ["//common/src/main/java/dev/cel/common/internal"],
 )
 
+java_library(
+    name = "code_point_stream",
+    exports = ["//common/src/main/java/dev/cel/common/internal:code_point_stream"],
+)
+
 java_library(
     name = "comparison_functions",
     exports = ["//common/src/main/java/dev/cel/common/internal:comparison_functions"],

common/src/main/java/dev/cel/common/BUILD.bazel

@@ -21,7 +21,6 @@ COMPILER_COMMON_SOURCES = [
 
 # keep sorted
 SOURCE_SOURCES = [
-    "CelSourceHelper.java",
     "Source.java",
 ]
 
@@ -234,6 +233,7 @@ java_library(
     tags = [
     ],
     deps = [
+        ":cel_source_helper",
         ":source",
         ":source_location",
         "//:auto_value",
@@ -250,6 +250,7 @@ cel_android_library(
     tags = [
     ],
     deps = [
+        ":cel_source_helper_android",
         ":source_android",
         ":source_location_android",
         "//:auto_value",
@@ -260,6 +261,30 @@ cel_android_library(
     ],
 )
 
+java_library(
+    name = "cel_source_helper",
+    srcs = ["CelSourceHelper.java"],
+    tags = [
+    ],
+    deps = [
+        ":source_location",
+        "//common/annotations",
+        "//common/internal",
+        "@maven//:com_google_guava_guava",
+    ],
+)
+
+cel_android_library(
+    name = "cel_source_helper_android",
+    srcs = ["CelSourceHelper.java"],
+    deps = [
+        ":source_location_android",
+        "//common/annotations",
+        "//common/internal:internal_android",
+        "@maven_android//:com_google_guava_guava",
+    ],
+)
+
 java_library(
     name = "cel_ast",
     srcs = ["CelAbstractSyntaxTree.java"],

common/src/main/java/dev/cel/common/formats/BUILD.bazel

@@ -71,6 +71,7 @@ java_library(
     ],
     deps = [
         "//:auto_value",
+        "//common:cel_source_helper",
         "//common:source",
         "//common:source_location",
         "//common/internal",

common/src/main/java/dev/cel/common/internal/BUILD.bazel

@@ -7,14 +7,14 @@ package(
     ],
     default_visibility = [
         "//common/internal:__pkg__",
+        "//publish:__pkg__",
     ],
 )
 
 # keep sorted
 INTERNAL_SOURCES = [
     "BasicCodePointArray.java",
     "CelCodePointArray.java",
-    "CodePointStream.java",
     "Constants.java",
     "EmptyCodePointArray.java",
     "Latin1CodePointArray.java",
@@ -34,6 +34,19 @@ CEL_DESCRIPTOR_POOL_SOURCES = [
     "DefaultDescriptorPool.java",
 ]
 
+java_library(
+    name = "code_point_stream",
+    srcs = ["CodePointStream.java"],
+    tags = [
+    ],
+    deps = [
+        ":internal",
+        "//common/annotations",
+        "@maven//:com_google_guava_guava",
+        "@maven//:org_antlr_antlr4_runtime",
+    ],
+)
+
 java_library(
     name = "internal",
     srcs = INTERNAL_SOURCES,
@@ -48,7 +61,6 @@ java_library(
         "@maven//:com_google_errorprone_error_prone_annotations",
         "@maven//:com_google_guava_guava",
         "@maven//:com_google_protobuf_protobuf_java",
-        "@maven//:org_antlr_antlr4_runtime",
     ],
 )
 
@@ -65,7 +77,6 @@ cel_android_library(
         "//common/values:values_android",
         "@maven//:com_google_errorprone_error_prone_annotations",
         "@maven//:com_google_guava_guava",
-        "@maven//:org_antlr_antlr4_runtime",
         "@maven_android//:com_google_guava_guava",
         "@maven_android//:com_google_protobuf_protobuf_javalite",
     ],

common/src/main/java/dev/cel/common/types/BUILD.bazel

@@ -7,6 +7,7 @@ package(
     ],
     default_visibility = [
         "//common/types:__pkg__",
+        "//publish:__pkg__",
     ],
 )
 

common/src/main/java/dev/cel/common/values/BUILD.bazel

@@ -7,6 +7,7 @@ package(
     ],
     default_visibility = [
         "//common/values:__pkg__",
+        "//publish:__pkg__",
     ],
 )