Make it easy for libraries to ship their own BugCheckers

[kelvinou01]

Background

At Palantir, we're increasingly reliant on error-prone to automatically mitigate common correctness/safety pitfalls — it is an effective force multiplier for small infra teams. Two patterns that have emerged are

1. Libraries shipping their own BugCheckers to enforce correct use of their APIs (see this internal library)
2. Dedicated code quality repos which enforce correct use of APIs of other libraries (see gradle-guide-error-prone, baseline-error-prone).

Currently, there is considerable friction for libraries to ship their own error-prones. A library has to create a new error-prone project, create a Gradle plugin which applies the SuppressibleErrorPronePlugin, and add the error-prone jar as a dependency. Consumers of the library are trusted that alongside using the library, they will also apply the -error-prone plugin to enforce good behavior.

Desired behavior

Library authors shouldn't have to ship a gradle plugin. As long as the library consumer has suppressible-error-prone applied, the library's BugCheckers should be automatically ran during compilation.

[kelvinou01]

As discussed in person, we still want people to publish a separate jar for error-prones. Because adding too much stuff to annotation classpath has caused many problems in the past, e.g. using two different versions of the same dependencies (?)

Another reason is that using javaVersions { javaCompiler } + jvmModuleArgs (required for authoring checks) means we don't have --release. We want to limit any potential runtime errors to the error-prone module, so they happen at error-prone runtime (i.e. compile time)

One potential solution is

• A library ships both the my-library jar and an my-library-error-prone jar
• Consumers which apply SuppressibleErrorPronePlugin will also bring in ApplyLibraryErrorPrones plugin
• The ApplyLibraryErrorProne plugin will see "oh, you have my-library. now do variant reselection to find the dependency with shipsErrorProne=true". This will get the my-library-error-prone jar. Then add this dep to the errorprone configuration

[kelvinou01]

As discussed in person, we'll have to start publishing GMM for attributes to work. Problem is, GCV currently dumps everything in versions.locks into every variant's GMM/maven constraints. Maven ignores those constraints but GMM does not. This could artificially constrain versions in consumers for deps not even related to the variant under resolution.

[kelvinou01]

Also, GCV's constraints (in POM) aren't being read. This has also been the source of many problems