autonomousapps / autonomousapps/gradle-best-practices-plugin

False positive reports for safe Project properties

Open
#13 1 comment 0 reactions 0 assignees View on GitHub
enhancement help wanted wontfix
Dominant language
Kotlin
Stars
197
Forks
4
PR merge metrics
No merged PRs in 30d

Description

Not all `allprojects` accesses are evil. If you look at how `CrossProjectModelAccess` creates `ProblemReportingProject` instances, they actually list all the properties that are unsafe. These can be indentified by looking at the `onAccess()` calls.

Here are a few examples which are safe:
* Project.toString
* Project.name
* Project.path
* Project.rootDir
* Project.displayName
* Project.childProjects
* Project.findProject
* Project.parent
* Project.rootProject

So essentially it's safe to navigate the hierarchy of projects, as long as we don't access anything that requires potential evaluation of the project.

I know this might be a bit of a feature, but even a best-effort trivial implementation of some kind of data flow analysis would be nice.

Example safe use case (based on the above restrictions):
```kotlin
project.tasks.register("allDependencies") {
val projects = project.rootProject.allprojects.sortedBy { it.path }
doFirst {
println(projects.joinToString(prefix = "Printing dependencies for modules:\n", separator = "\n") { " * ${it}" })
}
dependsOn(projects.map { "${it.path}:dependencies" })
}
```

Current report (above code resides in `gradle/plugins/src/main/kotlin/root.gradle.kts`:
```
root_gradle$2#invoke(Ljava.lang.Object;)Ljava.lang.Object; ->
root_gradle$2#invoke(Lorg.gradle.api.Task;)V ->
org.gradle.api.Project#getAllprojects()Ljava.util.Set;
```

Contributor guide

Open the contributing guide

Research direction

Start with gradle/plugins/src/main/kotlin/root.gradle.kts and trace the reported Project.getAllprojects() access through CrossProjectModelAccess and its onAccess() calls. Determine how the safe Project properties listed in the issue are represented, then verify that the example no longer produces a false-positive report while unsafe accesses remain reported.

Written by the indexing model from the issue text.

Assessment

Tech stack
kotlin
Domain
build-system
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.