autonomousapps / autonomousapps/dependency-analysis-gradle-plugin

compileOnly: allow users to define a list of compileOnly(Api) dependencies

Open
#1,387 3 comments 1 reaction 0 assignees View on GitHub
enhancement help wanted sponsorable
Dominant language
Kotlin
Stars
2.2k
Forks
158
Avg merge
16h 25m
Merged PRs (30d)
46

Description

**Is your feature request related to a problem? Please describe.**

Often projects use annotation libraries that are only required at compile time. For example: `com.github.spotbugs:spotbugs-annotations`

If these are placed in the `compileOnly` or `compileOnlyApi` scope, the plugin does not complain. It essential treats these as accepted alternatives to `implementation` or `api`.

However, if the dependency is missing, the plugin gives an advice like this:

```
These transitive dependencies should be declared directly:
implementation("com.github.spotbugs:spotbugs-annotations:4.9.1")
```

In a large project, users may easily just copy/paste the advice, although in other places of the multi-project `compileOnlyApi` is used for the dependency.

**Describe the solution you'd like**

It is difficult or impossible for the plugin to tell if a dependency is still needed at runtime or not. Hence the current behavior. However, the plugin could offer a configuration option to define a list of "compile only libraries" centrally. Then, the information can be picked up when creating the advice. Something like:

```
dependencyAnalysis {
structure {
compileOnly("com.github.spotbugs:spotbugs-annotations")
}
}
```

Whether it will be `compileOnly` or `compileOnlyApi` should be decided automatically:
- If it's `implementation` -> `compileOnly`
- If it's `api` -> `compileOnlyApi`

This is related to #1210, although the current behavior I see is the opposite to what that issue describes: I get the recommendation for `implementation` (see example above) although I annotated public API. Need to check.

**Describe alternatives you've considered**

Using the plugin in combination with https://github.com/gradlex-org/java-module-dependencies, which offers it's own post-processing task, I could offer such a solution in the extension of that plugin. But I would prefer to offer this to all users of DAGP.

Contributor guide

Open the contributing guide

Research direction

Start by reviewing the existing dependencyAnalysis structure configuration and the code that creates dependency advice. Define how a central compileOnly library list is represented, then verify that implementation dependencies produce compileOnly advice and api dependencies produce compileOnlyApi advice, including the behavior described in #1210.

Written by the indexing model from the issue text.

Assessment

Tech stack
kotlin
Domain
build-system, tooling
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.