ben-manes / gradle-versions-plugin

Gradle plugin to discover dependency updates
Apache License 2.0
3.87k stars 200 forks source link

dependencies in script plugins are not checked #283

Open Vampire opened 5 years ago

Vampire commented 5 years ago

In my main build file I have apply from: 'gradle/publishing.gradle' and in publishing.gradle I have

buildscript {
    repositories {
        gradlePluginPortal()
    }
    dependencies {
        classpath 'io.codearte.gradle.nexus:gradle-nexus-staging-plugin:0.11.0'
        classpath 'gradle.plugin.net.wooga.gradle:atlas-github:1.0.1'
        classpath 'net.researchgate:gradle-release:2.7.0'
        classpath 'org.ajoberstar:grgit:2.3.0'
        classpath 'org.kohsuke:github-api:1.93'
    }
}

Those are not shown in the dependency report. :-(

ben-manes commented 5 years ago

Did you apply the plugin on the root project? The task evaluates the project and subprojects of the project it is being run on.

Vampire commented 5 years ago

This project only has the root project, so yes I'm pretty sure :-)

ben-manes commented 5 years ago

you'd probably want to check --info to see what its doing. If its a private repo, you can provide a minimal sample to debug from. I am pretty sure it works correctly, but we can debug your project.

Vampire commented 5 years ago

It's not private but FOSS, just not ready for first push yet. :-D info output does not mention the ones that are missing or what am I looking for?

ben-manes commented 5 years ago

you should see Resolving ${project.name} buildscript with repositories:... which would indicate it is evaluating that buildscript configuration

Vampire commented 5 years ago

btw I already described minimal reproducer with which I just reproduced.

build.gradle

plugins { id 'com.github.ben-manes.versions' version '0.20.0' }
apply from: 'gradle/foo.gradle'

gradle/foo.gradle

buildscript {
    repositories {  gradlePluginPortal() }
    dependencies { classpath 'org.ajoberstar:grgit:2.3.0' }
}

That is all you need to reproduce

Vampire commented 5 years ago
$ gw dependencyUpdate -i --console=plain 2>&1 | grep -A 10 Resolving
Resolving versions-plugin-showcase project (root) buildscript with repositories:
 - __plugin_repository__Gradle Central Plugin Repository: PluginArtifactRepository
Resolving versions-plugin-showcase project (root) configurations with repositories:
Did not find url for com.github.ben-manes.versions:com.github.ben-manes.versions.gradle.plugin:0.20.0

> Task :dependencyUpdates
Task ':dependencyUpdates' is not up-to-date because:
  Task.upToDateWhen is false.
Comparing dependency (current: com.github.ben-manes.versions:com.github.ben-manes.versions.gradle.plugin:0.20.0, latest: 0.20.0)

------------------------------------------------------------
: Project Dependency Updates (report to plain text file)
------------------------------------------------------------
Vampire commented 5 years ago

btw. little side question, do you have a plan when next release will come out? Besides this bug, I'd like to have the changed behavior of not printing the default plain report if the output formatter is a closure without using a snapshot version or source dependency. :-)

Vampire commented 5 years ago

Btw. just tried with a source dependency of master branch and nothing changed

ben-manes commented 5 years ago

I guess this is a bug. The problem is that Gradle hides the the external script's buildscript from us.

allprojects {
  buildscript.configurations.each {
    it.dependencies.each { println project.name + " " + it }
  }
}

and you won't see anything from foo.gradle. It's a bug / limitation of Gradle, as there is no obvious API to call. You could file an issue on their side.

-- In regards to releases, no one is actively developing the plugin so we don't really plan for them. I think we should fix #255 for the next release, and I can take a look soon. I didn't have time for OSS work over the last 6 months or so, and have a long backlog for this and Caffeine to address.

ben-manes commented 5 years ago

It sounds like you already ran into similar problems in https://github.com/gradle/gradle/issues/5003:

this is expected, because script plugins (e.g. publishing.gradle) and project build scripts do not share a classloader hierarchy

Vampire commented 5 years ago

Sounds related, yes

Vampire commented 5 years ago

Also, if I take the advice that Stefan posted in his blog referenced in that issue and put the dependencies in buildSrc, this makes it not really better for gradle-versions-plugin, as it does not look into buildSrc project, but I'll open another issue for that.