cashapp / licensee

Gradle plugin which validates the licenses of your dependency graph match what you expect
https://cashapp.github.io/licensee/docs/1.x/
Apache License 2.0
626 stars 29 forks source link

Add support for Configuration cache #141

Closed hfhbd closed 1 year ago

hfhbd commented 1 year ago

Instead of resolving the pom files during task action, they are now resolved during configuration. This should not have a negative performance impact, because Gradle fetches the pom files to resolve the dependencies too.

Problem: dependency-substitution-replace-remote-with-include-build-ignored fails, because I access the incoming configuration before the dependency substitution is resolved. Unfortunately, I don't know, how to solve this.

Adding a dependency substitution rule to a configuration changes the timing of when that configuration is resolved. https://docs.gradle.org/current/userguide/resolution_rules.html#sec:module_replacement

Fixes #72

hfhbd commented 1 year ago

Removing/Keeping afterEvaluate has no effect on dependency-substitution-replace-remote-with-include-build-ignored

hfhbd commented 1 year ago

I found a solution for the failing test and resolving the dependencies of the included build at configuration phase. See https://github.com/hfhbd/tasks-with-dependency-resolution-result-inputs

Unfortunately, this solution requires Gradle 7.4 and it is @Incubating. https://docs.gradle.org/current/javadoc/org/gradle/api/artifacts/result/ResolutionResult.html#getRootComponent--

Do you want it? Then I would port it to licensee

Looks like it will be stable with Gradle 8: https://github.com/gradle/gradle/pull/22776

JakeWharton commented 1 year ago

If it hasn't changed between 7.4 and 8.0 where it's stable then I'm comfortable depending on it.

hfhbd commented 1 year ago

getRootComponent was added here without any changes since 2021-12-16: https://github.com/gradle/gradle/commit/1b91ae23349f7ba36882edaffbb8c694e3fb8ef7

Same for getResolvedArtifacts (2021-12-14): https://github.com/gradle/gradle/commit/0a41029213f2a635ca3bcaeabe73a708aaa1e0de

So I will port it to licensee.

hfhbd commented 1 year ago

Everything works, except parent pom files... Because they are defined in the pom file, its definition is only available during parsing this file. At the moment, fetching and parsing is split into configuration stage (fetching) and task execution (parsing). Only option is to parse the pom files during configuration too, and add the parent dependencies. I will do it later.

hfhbd commented 1 year ago

Do you have an ETA?

JakeWharton commented 1 year ago

Nope, sorry. I'll try to get to it early next week.

warting commented 1 year ago

🥳

zsperske commented 1 year ago

Will there be a release in the near future for this/including this?

JakeWharton commented 1 year ago

Next year. I don't have the time or desire to bother this month.

zsperske commented 1 year ago

👍 fair enough, thanks!

hfhbd commented 1 year ago

In the meantime you can use the snapshot: id("app.cash.licensee") version "1.7.0-SNAPSHOT" (or "app.cash.licensee:licensee-gradle-plugin:1.7.0-SNAPSHOT" with the snapshot repo: maven(url = "https://oss.sonatype.org/content/repositories/snapshots") or maven { url "https://oss.sonatype.org/content/repositories/snapshots" }

emartynov commented 1 year ago

I've tried

maven {
            url "https://oss.sonatype.org/content/repositories/snapshots"
            content {
                includeModule("app.cash.licensee", "licensee-gradle-plugin")
            }
        }

But it didn't work for me.

Plugin [id: 'app.cash.licensee', version: '1.7.0-SNAPSHOT', apply: false] was not found in any of the following sources:

- Gradle Core Plugins (plugin is not in 'org.gradle' namespace)
- Plugin Repositories (could not resolve plugin artifact 'app.cash.licensee:app.cash.licensee.gradle.plugin:1.7.0-SNAPSHOT')
  Searched in the following repositories:
    maven(https://oss.sonatype.org/content/repositories/snapshots)
JakeWharton commented 1 year ago

The error is telling you what's wrong. You've only allowed one artifact coordinate from the snapshot repo, but it is looking for another as indicated and failing (because it's not allowed).

emartynov commented 1 year ago

Thank you Jake! I limited the download to the group and it worked!