Add a consistency check task for defined versions

Author: jjohannes

gradle/plugins/src/main/kotlin/org.example.gradle.check.dependency-versions.gradle.kts

@@ -0,0 +1,16 @@
+import org.example.gradle.tasks.JavaVersionConsistencyCheck
+
+plugins { id("java-platform") }
+
+tasks.register<JavaVersionConsistencyCheck>("checkVersionConsistency") {
+    group = JavaBasePlugin.VERIFICATION_GROUP
+    definedVersions = provider {
+        configurations["api"].dependencyConstraints.associate { "${it.group}:${it.name}" to it.version!! }
+    }
+    aggregatedClasspath = provider { configurations["mainRuntimeClasspath"].incoming.resolutionResult.allComponents }
+    reportFile = layout.buildDirectory.file("reports/version-consistency.txt")
+}
+
+tasks.named("qualityCheck") { dependsOn(tasks.named("checkVersionConsistency")) }
+
+tasks.named("qualityGate") { dependsOn(tasks.named("checkVersionConsistency")) }

gradle/plugins/src/main/kotlin/org.example.gradle.feature.use-all-catalog-versions.gradle.kts

@@ -1,4 +1,7 @@
-plugins { id("org.gradle.java-platform") }
+plugins {
+    id("org.gradle.java-platform")
+    id("org.example.gradle.base.lifecycle")
+}
 
 // Allow upgrading (transitive) versions via catalog by adding constraints
 dependencies.constraints {

gradle/plugins/src/main/kotlin/org/example/gradle/tasks/JavaVersionConsistencyCheck.kt

@@ -0,0 +1,59 @@
+package org.example.gradle.tasks
+
+import org.gradle.api.DefaultTask
+import org.gradle.api.artifacts.component.ModuleComponentIdentifier
+import org.gradle.api.artifacts.result.ResolvedComponentResult
+import org.gradle.api.file.RegularFileProperty
+import org.gradle.api.provider.ListProperty
+import org.gradle.api.provider.MapProperty
+import org.gradle.api.provider.SetProperty
+import org.gradle.api.tasks.Input
+import org.gradle.api.tasks.OutputFile
+import org.gradle.api.tasks.TaskAction
+
+/** Check that all versions declared in a java-platform build.gradle.kts file are actually used. */
+abstract class JavaVersionConsistencyCheck : DefaultTask() {
+
+    /** The versions declared in the build.gradle.kts file. */
+    @get:Input abstract val definedVersions: MapProperty<String, String>
+
+    /** The aggregated classpath of all modules using the versions to resolve their dependencies. */
+    @get:Input abstract val aggregatedClasspath: SetProperty<ResolvedComponentResult>
+
+    /**
+     * List of versions to ignore. This may be needed if versions for components that are not part of the runtime module
+     * path of the applications are managed.
+     */
+    @get:Input abstract val excludes: ListProperty<String>
+
+    /** The report TXT file that will contain the issues found. */
+    @get:OutputFile abstract val reportFile: RegularFileProperty
+
+    @TaskAction
+    fun compare() {
+        var issues = ""
+        definedVersions.get().forEach { (id, version) ->
+            val resolved =
+                aggregatedClasspath.get().find {
+                    val resolvedId = it.id
+                    resolvedId is ModuleComponentIdentifier && resolvedId.moduleIdentifier.toString() == id
+                }
+            if (resolved == null) {
+                if (!excludes.get().contains(id)) {
+                    issues += "Not used: $id:$version\n"
+                }
+            } else {
+                val resolvedVersion = resolved.moduleVersion?.version
+                if (resolvedVersion != version) {
+                    issues += "Wrong version: $id (declared=$version; used=$resolvedVersion)\n"
+                }
+            }
+        }
+
+        reportFile.get().asFile.writeText(issues)
+
+        if (!issues.isEmpty()) {
+            throw RuntimeException(issues)
+        }
+    }
+}

gradle/versions/build.gradle.kts

@@ -1,7 +1,7 @@
 plugins {
     id("org.example.gradle.base.dependency-rules")
-    id("org.example.gradle.base.lifecycle")
     id("org.example.gradle.feature.use-all-catalog-versions")
+    id("org.example.gradle.check.dependency-versions")
     id("org.example.gradle.check.format-gradle")
 }
 
@@ -16,3 +16,9 @@ dependencies.constraints {
     api(libs.resteasy.core) { version { reject("[5.0.0.Final,)") } }
     api(libs.solr.solrj) { version { reject("[8.0.0,)") } } // API changes in 8 require production code changes
 }
+
+tasks.checkVersionConsistency {
+    excludes.add("org.junit.jupiter:junit-jupiter-api") // testing only
+    excludes.add("org.assertj:assertj-core") // testing only
+    excludes.add("com.google.code.findbugs:jsr305") // test fixtures only
+}