autonomousapps / autonomousapps/gradle-best-practices-plugin
False positive reports for safe Project properties
- Dominant language
- Kotlin
- Stars
- 197
- Forks
- 4
- PR merge metrics
- No merged PRs in 30d
Description
Not all `allprojects` accesses are evil. If you look at how `CrossProjectModelAccess` creates `ProblemReportingProject` instances, they actually list all the properties that are unsafe. These can be indentified by looking at the `onAccess()` calls.
Here are a few examples which are safe:
* Project.toString
* Project.name
* Project.path
* Project.rootDir
* Project.displayName
* Project.childProjects
* Project.findProject
* Project.parent
* Project.rootProject
So essentially it's safe to navigate the hierarchy of projects, as long as we don't access anything that requires potential evaluation of the project.
I know this might be a bit of a feature, but even a best-effort trivial implementation of some kind of data flow analysis would be nice.
Example safe use case (based on the above restrictions):
```kotlin
project.tasks.register("allDependencies") {
val projects = project.rootProject.allprojects.sortedBy { it.path }
doFirst {
println(projects.joinToString(prefix = "Printing dependencies for modules:\n", separator = "\n") { " * ${it}" })
}
dependsOn(projects.map { "${it.path}:dependencies" })
}
```
Current report (above code resides in `gradle/plugins/src/main/kotlin/root.gradle.kts`:
```
root_gradle$2#invoke(Ljava.lang.Object;)Ljava.lang.Object; ->
root_gradle$2#invoke(Lorg.gradle.api.Task;)V ->
org.gradle.api.Project#getAllprojects()Ljava.util.Set;
```
Contributor guide
Research direction
Start with gradle/plugins/src/main/kotlin/root.gradle.kts and trace the reported Project.getAllprojects() access through CrossProjectModelAccess and its onAccess() calls. Determine how the safe Project properties listed in the issue are represented, then verify that the example no longer produces a false-positive report while unsafe accesses remain reported.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- kotlin
- Domain
- build-system
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100