Merge pull request #753 from square/rick/dependency-guard

Add the dependency-guard plugin

Author: RBusarow

.buildscript/binary-validation.gradle

@@ -15,4 +15,3 @@ apiValidation {
   ignoredProjects += project('samples').subprojects.collect { it.name }
   ignoredProjects += project('benchmarks').subprojects.collect { it.name }
 }
-

.buildscript/configure-maven-publish.gradle

@@ -1,4 +1,6 @@
 apply plugin: 'com.vanniktech.maven.publish'
+// track all runtime classpath dependencies for anything we ship
+apply plugin: 'dependency-guard'
 
 group = GROUP
 version = VERSION_NAME

.github/workflows/kotlin.yml

@@ -78,7 +78,7 @@ jobs :
           gradle-dependencies-cache-key : |
             gradle/libs.versions.toml
           arguments : |
-            test apiCheck artifactsCheck lint ktlintCheck jmhJar --no-daemon --stacktrace --continue
+            test apiCheck artifactsCheck dependencyGuard lint ktlintCheck jmhJar --no-daemon --stacktrace --continue
           concurrent : true
           gradle-build-scan-report : false
           gradle-distribution-sha-256-sum-warning : false

build.gradle.kts

@@ -28,6 +28,7 @@ buildscript {
 plugins {
   base
   `artifacts-check`
+  `dependency-guard`
 }
 
 // See https://stackoverflow.com/questions/25324880/detect-ide-environment-with-gradle

buildSrc/build.gradle.kts

@@ -12,6 +12,9 @@ repositories {
 dependencies {
   compileOnly(gradleApi())
 
+  implementation(libs.android.gradle.plugin)
+  implementation(libs.dropbox.dependencyGuard)
+  implementation(libs.kotlin.gradle.plugin)
   implementation(libs.squareup.moshi)
   implementation(libs.squareup.moshi.adapters)
 

buildSrc/src/main/java/dependency-guard.gradle.kts

@@ -0,0 +1,31 @@
+import com.android.build.gradle.TestedExtension
+import com.dropbox.gradle.plugins.dependencyguard.DependencyGuardPluginExtension
+
+val configurationNames = when {
+  // record the root project's *build* classpath
+  project == rootProject -> listOf("classpath")
+  // Android variants and their configurations are added later in the configuration phase,
+  // so we can't look them up now using the `configurations` property.
+  // Instead we can just hard-code "releaseRuntimeClasspath" for any module which has AGP applied.
+  // This is actually pretty robust, since if this configuration ever changes,
+  // dependency-guard will fail when trying to look it up.
+  extensions.findByType<TestedExtension>() != null -> listOf("releaseRuntimeClasspath")
+  // If we got here, we're either in an empty "parent" module without a build plugin
+  // (and no configurations), or we're in a vanilla Kotlin module.  In this case, we can just look
+  // at configuration names.
+  else -> configurations
+    .map { it.name }
+    // anything ending with 'runtimeClasspath' but not 'testRuntimeClasspath'
+    .filter { it.matches("^(?!test)\\w*[rR]untimeClasspath$".toRegex()) }
+}
+
+if (configurationNames.isNotEmpty()) {
+  apply(plugin = "com.dropbox.dependency-guard")
+
+  configure<DependencyGuardPluginExtension> {
+    configurationNames.forEach { configName ->
+      // Tell dependency-guard to check the `configName` configuration's dependencies.
+      configuration(configName)
+    }
+  }
+}

dependencies/classpath.txt

@@ -0,0 +1,176 @@
+androidx.databinding:databinding-common:7.1.3
+androidx.databinding:databinding-compiler-common:7.1.3
+com.android.databinding:baseLibrary:7.1.3
+com.android.tools.analytics-library:crash:30.1.3
+com.android.tools.analytics-library:protos:30.1.3
+com.android.tools.analytics-library:shared:30.1.3
+com.android.tools.analytics-library:tracker:30.1.3
+com.android.tools.build.jetifier:jetifier-core:1.0.0-beta09
+com.android.tools.build.jetifier:jetifier-processor:1.0.0-beta09
+com.android.tools.build:aapt2-proto:7.1.3-7984345
+com.android.tools.build:aaptcompiler:7.1.3
+com.android.tools.build:apksig:7.1.3
+com.android.tools.build:apkzlib:7.1.3
+com.android.tools.build:builder-model:7.1.3
+com.android.tools.build:builder-test-api:7.1.3
+com.android.tools.build:builder:7.1.3
+com.android.tools.build:bundletool:1.8.0
+com.android.tools.build:gradle-api:7.1.3
+com.android.tools.build:gradle:7.1.3
+com.android.tools.build:manifest-merger:30.1.3
+com.android.tools.build:transform-api:2.0.0-deprecated-use-gradle-api
+com.android.tools.ddms:ddmlib:30.1.3
+com.android.tools.layoutlib:layoutlib-api:30.1.3
+com.android.tools.lint:lint-model:30.1.3
+com.android.tools.utp:android-device-provider-ddmlib-proto:30.1.3
+com.android.tools.utp:android-device-provider-gradle-proto:30.1.3
+com.android.tools.utp:android-test-plugin-host-additional-test-output-proto:30.1.3
+com.android.tools.utp:android-test-plugin-host-coverage-proto:30.1.3
+com.android.tools.utp:android-test-plugin-host-retention-proto:30.1.3
+com.android.tools.utp:android-test-plugin-result-listener-gradle-proto:30.1.3
+com.android.tools:annotations:30.1.3
+com.android.tools:common:30.1.3
+com.android.tools:dvlib:30.1.3
+com.android.tools:repository:30.1.3
+com.android.tools:sdk-common:30.1.3
+com.android.tools:sdklib:30.1.3
+com.android:signflinger:7.1.3
+com.android:zipflinger:7.1.3
+com.fasterxml.jackson.core:jackson-annotations:2.12.4
+com.fasterxml.jackson.core:jackson-core:2.12.4
+com.fasterxml.jackson.core:jackson-databind:2.12.4
+com.fasterxml.jackson.dataformat:jackson-dataformat-xml:2.12.4
+com.fasterxml.jackson.module:jackson-module-jaxb-annotations:2.12.4
+com.fasterxml.jackson.module:jackson-module-kotlin:2.12.4
+com.fasterxml.jackson:jackson-bom:2.12.4
+com.fasterxml.woodstox:woodstox-core:6.2.4
+com.github.gundy:semver4j:0.16.4
+com.google.android:annotations:4.1.1.4
+com.google.api.grpc:proto-google-common-protos:1.12.0
+com.google.auto.value:auto-value-annotations:1.6.2
+com.google.code.findbugs:jsr305:3.0.2
+com.google.code.gson:gson:2.8.6
+com.google.crypto.tink:tink:1.3.0-rc2
+com.google.dagger:dagger:2.28.3
+com.google.devtools.ksp:symbol-processing-gradle-plugin:1.6.10-1.0.2
+com.google.errorprone:error_prone_annotations:2.3.4
+com.google.flatbuffers:flatbuffers-java:1.12.0
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:30.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.j2objc:j2objc-annotations:1.3
+com.google.jimfs:jimfs:1.1
+com.google.protobuf:protobuf-java-util:3.10.0
+com.google.protobuf:protobuf-java:3.10.0
+com.google.testing.platform:core-proto:0.0.8-alpha07
+com.googlecode.java-diff-utils:diffutils:1.3.0
+com.googlecode.json-simple:json-simple:1.1
+com.googlecode.juniversalchardet:juniversalchardet:1.0.3
+com.squareup.moshi:moshi:1.12.0
+com.squareup.okhttp3:okhttp:3.14.9
+com.squareup.okio:okio:2.10.0
+com.squareup.retrofit2:converter-moshi:2.9.0
+com.squareup.retrofit2:retrofit:2.9.0
+com.squareup:javapoet:1.10.0
+com.squareup:javawriter:2.5.0
+com.sun.activation:javax.activation:1.2.0
+com.sun.istack:istack-commons-runtime:3.0.8
+com.sun.xml.fastinfoset:FastInfoset:1.2.16
+com.vanniktech:gradle-maven-publish-plugin:0.18.0
+commons-codec:commons-codec:1.10
+commons-io:commons-io:2.4
+commons-logging:commons-logging:1.2
+de.undercouch:gradle-download-task:4.1.1
+io.grpc:grpc-api:1.21.1
+io.grpc:grpc-context:1.21.1
+io.grpc:grpc-core:1.21.1
+io.grpc:grpc-netty:1.21.1
+io.grpc:grpc-protobuf-lite:1.21.1
+io.grpc:grpc-protobuf:1.21.1
+io.grpc:grpc-stub:1.21.1
+io.netty:netty-buffer:4.1.34.Final
+io.netty:netty-codec-http2:4.1.34.Final
+io.netty:netty-codec-http:4.1.34.Final
+io.netty:netty-codec-socks:4.1.34.Final
+io.netty:netty-codec:4.1.34.Final
+io.netty:netty-common:4.1.34.Final
+io.netty:netty-handler-proxy:4.1.34.Final
+io.netty:netty-handler:4.1.34.Final
+io.netty:netty-resolver:4.1.34.Final
+io.netty:netty-transport:4.1.34.Final
+io.opencensus:opencensus-api:0.21.0
+io.opencensus:opencensus-contrib-grpc-metrics:0.21.0
+it.unimi.dsi:fastutil:8.4.0
+jakarta.activation:jakarta.activation-api:1.2.1
+jakarta.xml.bind:jakarta.xml.bind-api:2.3.2
+javax.inject:javax.inject:1
+me.champeau.gradle:jmh-gradle-plugin:0.5.3
+net.java.dev.jna:jna-platform:5.6.0
+net.java.dev.jna:jna:5.6.0
+net.sf.jopt-simple:jopt-simple:4.9
+net.sf.kxml:kxml2:2.3.0
+org.antlr:antlr4:4.5.3
+org.apache.commons:commons-compress:1.20
+org.apache.commons:commons-math3:3.2
+org.apache.httpcomponents:httpclient:4.5.6
+org.apache.httpcomponents:httpcore:4.4.10
+org.apache.httpcomponents:httpmime:4.5.6
+org.bitbucket.b_c:jose4j:0.7.0
+org.bouncycastle:bcpkix-jdk15on:1.56
+org.bouncycastle:bcprov-jdk15on:1.56
+org.checkerframework:checker-qual:3.5.0
+org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.codehaus.woodstox:stax2-api:4.2.1
+org.glassfish.jaxb:jaxb-runtime:2.3.2
+org.glassfish.jaxb:txw2:2.3.2
+org.jdom:jdom2:2.0.6
+org.jetbrains.dokka:dokka-core:1.5.31
+org.jetbrains.dokka:dokka-gradle-plugin:1.5.31
+org.jetbrains.intellij.deps:trove4j:1.0.20181211
+org.jetbrains.kotlin:kotlin-android-extensions:1.6.10
+org.jetbrains.kotlin:kotlin-annotation-processing-gradle:1.6.10
+org.jetbrains.kotlin:kotlin-build-common:1.6.10
+org.jetbrains.kotlin:kotlin-compiler-embeddable:1.6.10
+org.jetbrains.kotlin:kotlin-compiler-runner:1.6.10
+org.jetbrains.kotlin:kotlin-daemon-client:1.6.10
+org.jetbrains.kotlin:kotlin-daemon-embeddable:1.6.10
+org.jetbrains.kotlin:kotlin-gradle-plugin-api:1.6.10
+org.jetbrains.kotlin:kotlin-gradle-plugin-model:1.6.10
+org.jetbrains.kotlin:kotlin-gradle-plugin:1.6.10
+org.jetbrains.kotlin:kotlin-klib-commonizer-api:1.6.10
+org.jetbrains.kotlin:kotlin-native-utils:1.6.10
+org.jetbrains.kotlin:kotlin-project-model:1.6.10
+org.jetbrains.kotlin:kotlin-reflect:1.5.31
+org.jetbrains.kotlin:kotlin-scripting-common:1.6.10
+org.jetbrains.kotlin:kotlin-scripting-compiler-embeddable:1.6.10
+org.jetbrains.kotlin:kotlin-scripting-compiler-impl-embeddable:1.6.10
+org.jetbrains.kotlin:kotlin-scripting-jvm:1.6.10
+org.jetbrains.kotlin:kotlin-serialization:1.6.10
+org.jetbrains.kotlin:kotlin-stdlib-common:1.5.31
+org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.5.31
+org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.5.31
+org.jetbrains.kotlin:kotlin-stdlib:1.5.31
+org.jetbrains.kotlin:kotlin-tooling-metadata:1.6.10
+org.jetbrains.kotlin:kotlin-util-io:1.6.10
+org.jetbrains.kotlin:kotlin-util-klib:1.6.10
+org.jetbrains.kotlinx:binary-compatibility-validator:0.6.0
+org.jetbrains.kotlinx:kotlinx-coroutines-core-jvm:1.5.1
+org.jetbrains.kotlinx:kotlinx-coroutines-core:1.5.1
+org.jetbrains.kotlinx:kotlinx-metadata-jvm:0.2.0
+org.jetbrains:annotations:13.0
+org.jetbrains:markdown-jvm:0.2.4
+org.jetbrains:markdown:0.2.4
+org.jlleitschuh.gradle:ktlint-gradle:10.2.1
+org.json:json:20180813
+org.jsoup:jsoup:1.13.1
+org.jvnet.staxex:stax-ex:1.8.1
+org.openjdk.jmh:jmh-core:1.27
+org.ow2.asm:asm-analysis:9.1
+org.ow2.asm:asm-commons:9.1
+org.ow2.asm:asm-tree:9.1
+org.ow2.asm:asm-util:9.1
+org.ow2.asm:asm:9.1
+org.slf4j:slf4j-api:1.7.30
+org.tensorflow:tensorflow-lite-metadata:0.1.0-rc2
+xerces:xercesImpl:2.12.0
+xml-apis:xml-apis:1.4.01

gradle/libs.versions.toml

@@ -34,6 +34,7 @@ androidx-work = "2.6.0"
 
 detekt = "1.19.0"
 dokka = "1.5.31"
+dependencyGuard = "0.1.0"
 
 google-accompanist = "0.18.0"
 google-dagger = "2.40.5"
@@ -84,7 +85,9 @@ kotlin-jvm = { id = "org.jetbrains.kotlin.jvm", version.ref = "kotlin" }
 
 dokka = { id = "org.jetbrains.dokka", version.ref = "dokka" }
 
-google-ksp = { id = "com.google.devtools.ksp", version.ref = "google-ksp"}
+dropbox-dependencyGuard = { id = "com.dropbox.dependency-guard", version.ref = "dependencyGuard" }
+
+google-ksp = { id = "com.google.devtools.ksp", version.ref = "google-ksp" }
 
 kotlin-serialization = { id = "org.jetbrains.kotlin.plugin.serialization", version.ref = "kotlin" }
 kotlinx-apiBinaryCompatibility = { id = "org.jetbrains.kotlinx.binary-compatibility-validator", version.ref = "kotlinx-binary-compatibility" }
@@ -101,7 +104,7 @@ androidx-activity-ktx = { module = "androidx.activity:activity-ktx", version.ref
 
 androidx-appcompat = { module = "androidx.appcompat:appcompat", version.ref = "androidx-appcompat" }
 
-androidx-macro-benchmark = { module ="androidx.benchmark:benchmark-macro-junit4", version.ref = "androidx-benchmark" }
+androidx-macro-benchmark = { module = "androidx.benchmark:benchmark-macro-junit4", version.ref = "androidx-benchmark" }
 
 androidx-compose-foundation = { module = "androidx.compose.foundation:foundation", version.ref = "androidx-compose" }
 
@@ -142,14 +145,16 @@ androidx-test-truth = { module = "androidx.test.ext:truth", version.ref = "andro
 
 androidx-test-uiautomator = "androidx.test.uiautomator:uiautomator:2.2.0"
 
-androidx-tracing-ktx = { module = "androidx.tracing:tracing-ktx", version.ref = "androidx-tracing"}
+androidx-tracing-ktx = { module = "androidx.tracing:tracing-ktx", version.ref = "androidx-tracing" }
 
 androidx-transition = { module = "androidx.transition:transition", version.ref = "androidx-transition" }
 
 androidx-viewbinding = { module = "androidx.databinding:viewbinding", version.ref = "androidTools" }
 
 dokka-gradle-plugin = { module = "org.jetbrains.dokka:dokka-gradle-plugin", version.ref = "dokka" }
 
+dropbox-dependencyGuard = { module = "com.dropbox.dependency-guard:dependency-guard", version.ref = "dependencyGuard" }
+
 google-android-material = { module = "com.google.android.material:material", version.ref = "material" }
 google-ksp = { module = "com.google.devtools.ksp:symbol-processing-gradle-plugin", version.ref = "google-ksp" }
 

internal-testing-utils/dependencies/runtimeClasspath.txt

@@ -0,0 +1,5 @@
+org.jetbrains.kotlin:kotlin-stdlib-common:1.6.10
+org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.6.10
+org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.6.10
+org.jetbrains.kotlin:kotlin-stdlib:1.6.10
+org.jetbrains:annotations:13.0

trace-encoder/dependencies/runtimeClasspath.txt

@@ -0,0 +1,10 @@
+com.squareup.moshi:moshi-adapters:1.13.0
+com.squareup.moshi:moshi:1.13.0
+com.squareup.okio:okio:2.10.0
+org.jetbrains.kotlin:kotlin-stdlib-common:1.6.10
+org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.6.10
+org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.6.10
+org.jetbrains.kotlin:kotlin-stdlib:1.6.10
+org.jetbrains.kotlinx:kotlinx-coroutines-core-jvm:1.5.1
+org.jetbrains.kotlinx:kotlinx-coroutines-core:1.5.1
+org.jetbrains:annotations:13.0