cashapp / licensee

Gradle plugin which validates the licenses of your dependency graph match what you expect
https://cashapp.github.io/licensee/docs/1.x/
Apache License 2.0
626 stars 29 forks source link

Warning allowed dependency is unused in KMP Project #64

Closed vanniktech closed 8 months ago

vanniktech commented 2 years ago

When I run the aggregation task licensee all of the tasks for each applicable plugin are ran. Since the configuration is shared there are some warnings:

> Task :core:licenseeJvm
WARNING: Allowed dependency 'org.jetbrains.kotlinx:kotlinx-serialization-core-iosx64:1.3.0' is unused
WARNING: Allowed dependency 'org.jetbrains.kotlinx:kotlinx-serialization-core-iosarm64:1.3.0' is unused
WARNING: Allowed dependency 'org.jetbrains.kotlinx:kotlinx-serialization-json-iosx64:1.3.0' is unused
WARNING: Allowed dependency 'org.jetbrains.kotlinx:kotlinx-serialization-json-iosarm64:1.3.0' is unused

Obviously, jvm does not need ios targeted dependencies.

In my project where I have a common module that's being used on Android, iOS & Server I get 96 of those warnings.

Not only is that a lot, actually removing a custom URL / license becomes impossible since I'd need to try it out, rerun everything.


Since the warnings come from the fine grained task, I guess the one solution would be to have custom logic inside licensee which does it's own validation without delegating to other tasks.

Another solution would be to have different configurations for each target.

JakeWharton commented 2 years ago

I'm out the rest of the year. This will have to be tackled next year at some point.

JakeWharton commented 2 years ago

Probably covered by #48, too.

vdshb commented 11 months ago

Another solution proposal to mention is adding warning suppression options. Something like this:

licensee {
    allow("Apache-2.0")
    warnings {
        unusedAllowedIdentifiers = false
        unusedAllowedUrls = false
        unusedAllowedCoordinates = false
    }
}
vdshb commented 11 months ago

I've made a proof of concept of such API: https://github.com/vdshb/licensee/commit/304f2739131ba7967a709fd8a07ba2aac86b9c3a

Works perfect for me. It is for 1.7.0, because I need it for projects with previous AGP.

@JakeWharton Let me know if you interested in this peace of functionality. I'll try to make a proper PR(s) for 1.8.x/1.7.x. An advise with project's test policies and how to avoid signing plugin during tests might be required, though.

JakeWharton commented 8 months ago

You can hide warnings now with #285. To be released next week.

vanniktech commented 8 months ago

Works for me; hence closing this.