add dependency-guard and baselines

.github/workflows/ci.yml

@@ -51,7 +51,7 @@ jobs:
       - name: build website
         run: ./gradlew buildSite --no-daemon
 
-  artifacts-check:
+  static-analysis:
 
     runs-on: ubuntu-latest
     if: github.actor != 'renovate[bot]'
@@ -78,29 +78,8 @@ jobs:
       - name: artifacts check
         run: ./gradlew artifactsCheck --no-daemon
 
-  detekt:
-
-    runs-on: ubuntu-latest
-    if: github.actor != 'renovate[bot]'
-    steps:
-      - name: check out with token (used by forks)
-        uses: actions/checkout@v3
-        if: github.event.pull_request.head.repo.full_name != github.repository
-
-      - name: check out with PAT (used by main repo)
-        uses: actions/checkout@v3
-        if: github.event.pull_request.head.repo.full_name == github.repository
-        with:
-          ref: ${{ github.event.pull_request.head.ref }}
-          token: ${{ secrets.PERSONAL_ACCESS_TOKEN }}
-          fetch-depth: 0
-
-      - name: Set up JDK
-        uses: actions/setup-java@v3
-        with:
-          distribution: 'adopt'
-          java-version: '11'
-          cache: 'gradle'
+      - name: dependency-guard
+        run: ./gradlew dependencyGuard --no-daemon
 
       - name: detekt
         run: ./gradlew detekt --no-daemon

build-logic/mcbuild/build.gradle.kts

@@ -33,6 +33,7 @@ dependencies {
 
   implementation(libs.benManes.gradle)
   implementation(libs.detekt.gradle)
+  implementation(libs.dropbox.dependencyGuard)
   implementation(libs.dokka.gradle)
   implementation(libs.google.dagger.api)
   implementation(libs.google.ksp)

build-logic/mcbuild/src/main/kotlin/mcbuild.dependency-guard.gradle.kts

@@ -0,0 +1,36 @@
+/*
+ * Copyright (C) 2021-2022 Rick Busarow
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *      http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+plugins {
+  kotlin("jvm")
+  id("com.dropbox.dependency-guard")
+}
+
+dependencyGuard {
+  if (project.rootProject == project) {
+    configuration("classpath")
+  } else {
+    configuration("runtimeClasspath") {
+      modules = false
+    }
+  }
+}
+
+// Delete any existing dependency files/directories before recreating with a new baseline task.
+val dependencyGuardDeleteBaselines by tasks.registering(Delete::class) {
+  delete("dependencies")
+}
+tasks.matching { it.name == "dependencyGuardBaseline" }
+  .configureEach { dependsOn(dependencyGuardDeleteBaselines) }

build-logic/mcbuild/src/main/kotlin/mcbuild.gradle.kts

@@ -28,6 +28,7 @@ import modulecheck.builds.libsCatalog
 plugins {
   id("mcbuild.clean")
   id("mcbuild.detekt")
+  id("mcbuild.dependency-guard")
   id("mcbuild.java-library")
   id("mcbuild.kotlin")
   id("mcbuild.ktlint")

build.gradle.kts

@@ -34,6 +34,7 @@ plugins {
   id("mcbuild.artifacts-check")
   id("mcbuild.ben-manes")
   id("mcbuild.clean")
+  id("mcbuild.dependency-guard")
   id("mcbuild.dokka")
   id("mcbuild.kotlin")
   id("mcbuild.ktlint")

dependencies/classpath.txt

@@ -0,0 +1,238 @@
+:mcbuild
+androidx.databinding:databinding-common:7.1.1
+androidx.databinding:databinding-compiler-common:7.1.1
+com.android.databinding:baseLibrary:7.1.1
+com.android.tools.analytics-library:crash:30.1.1
+com.android.tools.analytics-library:protos:30.1.1
+com.android.tools.analytics-library:shared:30.1.1
+com.android.tools.analytics-library:tracker:30.1.1
+com.android.tools.build.jetifier:jetifier-core:1.0.0-beta09
+com.android.tools.build.jetifier:jetifier-processor:1.0.0-beta09
+com.android.tools.build:aapt2-proto:7.1.1-7984345
+com.android.tools.build:aaptcompiler:7.1.1
+com.android.tools.build:apksig:7.1.1
+com.android.tools.build:apkzlib:7.1.1
+com.android.tools.build:builder-model:7.1.1
+com.android.tools.build:builder-test-api:7.1.1
+com.android.tools.build:builder:7.1.1
+com.android.tools.build:bundletool:1.8.0
+com.android.tools.build:gradle-api:7.1.1
+com.android.tools.build:gradle:7.1.1
+com.android.tools.build:manifest-merger:30.1.1
+com.android.tools.build:transform-api:2.0.0-deprecated-use-gradle-api
+com.android.tools.ddms:ddmlib:30.1.1
+com.android.tools.layoutlib:layoutlib-api:30.1.1
+com.android.tools.lint:lint-model:30.1.1
+com.android.tools.utp:android-device-provider-ddmlib-proto:30.1.1
+com.android.tools.utp:android-device-provider-gradle-proto:30.1.1
+com.android.tools.utp:android-test-plugin-host-additional-test-output-proto:30.1.1
+com.android.tools.utp:android-test-plugin-host-coverage-proto:30.1.1
+com.android.tools.utp:android-test-plugin-host-retention-proto:30.1.1
+com.android.tools.utp:android-test-plugin-result-listener-gradle-proto:30.1.1
+com.android.tools:annotations:30.1.1
+com.android.tools:common:30.1.1
+com.android.tools:dvlib:30.1.1
+com.android.tools:repository:30.1.1
+com.android.tools:sdk-common:30.1.1
+com.android.tools:sdklib:30.1.1
+com.android:signflinger:7.1.1
+com.android:zipflinger:7.1.1
+com.autonomousapps.dependency-analysis:com.autonomousapps.dependency-analysis.gradle.plugin:1.2.1
+com.autonomousapps:dependency-analysis-gradle-plugin:1.2.1
+com.dorongold.plugins:task-tree:2.1.0
+com.dorongold.task-tree:com.dorongold.task-tree.gradle.plugin:2.1.0
+com.dropbox.dependency-guard:dependency-guard:0.1.0
+com.fasterxml.jackson.core:jackson-annotations:2.12.4
+com.fasterxml.jackson.core:jackson-core:2.12.4
+com.fasterxml.jackson.core:jackson-databind:2.12.4
+com.fasterxml.jackson.dataformat:jackson-dataformat-xml:2.12.4
+com.fasterxml.jackson.module:jackson-module-jaxb-annotations:2.12.4
+com.fasterxml.jackson.module:jackson-module-kotlin:2.12.4
+com.fasterxml.jackson:jackson-bom:2.12.4
+com.fasterxml.woodstox:woodstox-core:6.2.4
+com.github.ben-manes.caffeine:caffeine:3.0.4
+com.github.ben-manes:gradle-versions-plugin:0.42.0
+com.github.gundy:semver4j:0.16.4
+com.github.javaparser:javaparser-core:3.24.2
+com.github.javaparser:javaparser-symbol-solver-core:3.24.2
+com.google.android:annotations:4.1.1.4
+com.google.api.grpc:proto-google-common-protos:1.12.0
+com.google.auto.value:auto-value-annotations:1.6.2
+com.google.code.findbugs:jsr305:3.0.2
+com.google.code.gson:gson:2.8.9
+com.google.crypto.tink:tink:1.3.0-rc2
+com.google.dagger:dagger:2.42
+com.google.devtools.ksp:symbol-processing-gradle-plugin:1.6.21-1.0.5
+com.google.errorprone:error_prone_annotations:2.11.0
+com.google.flatbuffers:flatbuffers-java:1.12.0
+com.google.guava:failureaccess:1.0.1
+com.google.guava:guava:31.1-jre
+com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava
+com.google.j2objc:j2objc-annotations:1.3
+com.google.jimfs:jimfs:1.1
+com.google.protobuf:protobuf-java-util:3.10.0
+com.google.protobuf:protobuf-java:3.10.0
+com.google.testing.platform:core-proto:0.0.8-alpha07
+com.googlecode.json-simple:json-simple:1.1
+com.googlecode.juniversalchardet:juniversalchardet:1.0.3
+com.ibm.icu:icu4j:69.1
+com.osacky.doctor:com.osacky.doctor.gradle.plugin:0.8.0
+com.osacky.doctor:doctor-plugin:0.8.0
+com.osacky.tagger:tagger-lib:0.2
+com.rickbusarow.dispatch:dispatch-core:1.0.0-beta10
+com.rickbusarow.module-check:com.rickbusarow.module-check.gradle.plugin:0.12.0
+com.rickbusarow.modulecheck:modulecheck-api:0.12.0
+com.rickbusarow.modulecheck:modulecheck-core:0.12.0
+com.rickbusarow.modulecheck:modulecheck-dagger:0.12.0
+com.rickbusarow.modulecheck:modulecheck-parsing-core:0.12.0
+com.rickbusarow.modulecheck:modulecheck-parsing-gradle:0.12.0
+com.rickbusarow.modulecheck:modulecheck-parsing-groovy-antlr:0.12.0
+com.rickbusarow.modulecheck:modulecheck-parsing-java:0.12.0
+com.rickbusarow.modulecheck:modulecheck-parsing-jvm:0.12.0
+com.rickbusarow.modulecheck:modulecheck-parsing-psi:0.12.0
+com.rickbusarow.modulecheck:modulecheck-parsing-wiring:0.12.0
+com.rickbusarow.modulecheck:modulecheck-plugin:0.12.0
+com.rickbusarow.modulecheck:modulecheck-project-api:0.12.0
+com.rickbusarow.modulecheck:modulecheck-project-impl:0.12.0
+com.rickbusarow.modulecheck:modulecheck-reporting-checkstyle:0.12.0
+com.rickbusarow.modulecheck:modulecheck-reporting-console:0.12.0
+com.rickbusarow.modulecheck:modulecheck-reporting-graphviz:0.12.0
+com.rickbusarow.modulecheck:modulecheck-runtime:0.12.0
+com.rickbusarow.modulecheck:modulecheck-utils:0.12.0
+com.squareup.anvil:annotations:2.4.0
+com.squareup.anvil:gradle-plugin:2.4.0
+com.squareup.moshi:moshi-adapters:1.12.0
+com.squareup.moshi:moshi-kotlin:1.12.0
+com.squareup.moshi:moshi:1.13.0
+com.squareup.okhttp3:okhttp:3.14.9
+com.squareup.okio:okio:2.10.0
+com.squareup.retrofit2:converter-moshi:2.9.0
+com.squareup.retrofit2:retrofit:2.9.0
+com.squareup:javapoet:1.10.0
+com.squareup:javawriter:2.5.0
+com.sun.activation:javax.activation:1.2.0
+com.sun.istack:istack-commons-runtime:3.0.8
+com.sun.xml.fastinfoset:FastInfoset:1.2.16
+com.thoughtworks.xstream:xstream:1.4.17
+com.vanniktech:gradle-maven-publish-plugin:0.19.0
+com.vanniktech:nexus:0.19.0
+commons-codec:commons-codec:1.10
+commons-io:commons-io:2.4
+commons-logging:commons-logging:1.2
+de.undercouch:gradle-download-task:4.1.1
+dev.zacsweers.moshix:moshi-sealed-runtime:0.14.1
+gradle.plugin.dev.arunkumar:scabbard-gradle-plugin:0.5.0
+io.github.detekt.sarif4k:sarif4k:0.0.1
+io.github.x-stream:mxparser:1.2.1
+io.gitlab.arturbosch.detekt:detekt-gradle-plugin:1.20.0
+io.gitlab.arturbosch.detekt:detekt-utils:1.20.0
+io.gitlab.arturbosch.detekt:io.gitlab.arturbosch.detekt.gradle.plugin:1.20.0
+io.grpc:grpc-api:1.21.1
+io.grpc:grpc-context:1.21.1
+io.grpc:grpc-core:1.21.1
+io.grpc:grpc-netty:1.21.1
+io.grpc:grpc-protobuf-lite:1.21.1
+io.grpc:grpc-protobuf:1.21.1
+io.grpc:grpc-stub:1.21.1
+io.netty:netty-buffer:4.1.34.Final
+io.netty:netty-codec-http2:4.1.34.Final
+io.netty:netty-codec-http:4.1.34.Final
+io.netty:netty-codec-socks:4.1.34.Final
+io.netty:netty-codec:4.1.34.Final
+io.netty:netty-common:4.1.34.Final
+io.netty:netty-handler-proxy:4.1.34.Final
+io.netty:netty-handler:4.1.34.Final
+io.netty:netty-resolver:4.1.34.Final
+io.netty:netty-transport:4.1.34.Final
+io.opencensus:opencensus-api:0.21.0
+io.opencensus:opencensus-contrib-grpc-metrics:0.21.0
+io.reactivex.rxjava3:rxjava:3.1.3
+it.unimi.dsi:fastutil:8.4.0
+jakarta.activation:jakarta.activation-api:1.2.1
+jakarta.xml.bind:jakarta.xml.bind-api:2.3.2
+javax.inject:javax.inject:1
+net.java.dev.jna:jna-platform:5.6.0
+net.java.dev.jna:jna:5.6.0
+net.sf.jopt-simple:jopt-simple:4.9
+net.sf.kxml:kxml2:2.3.0
+net.swiftzer.semver:semver:1.2.0
+org.abego.treelayout:org.abego.treelayout.core:1.0.3
+org.antlr:ST4:4.3.2
+org.antlr:antlr-runtime:3.5.3
+org.antlr:antlr4-runtime:4.10
+org.antlr:antlr4:4.10
+org.apache.commons:commons-compress:1.20
+org.apache.commons:commons-lang3:3.5
+org.apache.httpcomponents:httpclient:4.5.6
+org.apache.httpcomponents:httpcore:4.4.10
+org.apache.httpcomponents:httpmime:4.5.6
+org.bitbucket.b_c:jose4j:0.7.0
+org.bouncycastle:bcpkix-jdk15on:1.56
+org.bouncycastle:bcprov-jdk15on:1.56
+org.checkerframework:checker-qual:3.18.0
+org.codehaus.groovy:groovy-xml:3.0.10
+org.codehaus.groovy:groovy:3.0.10
+org.codehaus.mojo:animal-sniffer-annotations:1.17
+org.codehaus.woodstox:stax2-api:4.2.1
+org.glassfish.jaxb:jaxb-runtime:2.3.2
+org.glassfish.jaxb:txw2:2.3.2
+org.glassfish:javax.json:1.0.4
+org.javassist:javassist:3.28.0-GA
+org.jdom:jdom2:2.0.6
+org.jetbrains.dokka:dokka-core:1.6.21
+org.jetbrains.dokka:dokka-gradle-plugin:1.6.21
+org.jetbrains.intellij.deps:trove4j:1.0.20200330
+org.jetbrains.kotlin:kotlin-android-extensions:1.6.21
+org.jetbrains.kotlin:kotlin-annotation-processing-gradle:1.6.21
+org.jetbrains.kotlin:kotlin-bom:1.6.10
+org.jetbrains.kotlin:kotlin-build-common:1.6.21
+org.jetbrains.kotlin:kotlin-compiler-embeddable:1.6.21
+org.jetbrains.kotlin:kotlin-compiler-runner:1.6.21
+org.jetbrains.kotlin:kotlin-daemon-client:1.6.21
+org.jetbrains.kotlin:kotlin-daemon-embeddable:1.6.21
+org.jetbrains.kotlin:kotlin-gradle-plugin-api:1.6.21
+org.jetbrains.kotlin:kotlin-gradle-plugin-model:1.6.21
+org.jetbrains.kotlin:kotlin-gradle-plugin:1.6.21
+org.jetbrains.kotlin:kotlin-klib-commonizer-api:1.6.21
+org.jetbrains.kotlin:kotlin-native-utils:1.6.21
+org.jetbrains.kotlin:kotlin-project-model:1.6.21
+org.jetbrains.kotlin:kotlin-reflect:1.5.31
+org.jetbrains.kotlin:kotlin-script-runtime:1.6.21
+org.jetbrains.kotlin:kotlin-scripting-common:1.6.21
+org.jetbrains.kotlin:kotlin-scripting-compiler-embeddable:1.6.21
+org.jetbrains.kotlin:kotlin-scripting-compiler-impl-embeddable:1.6.21
+org.jetbrains.kotlin:kotlin-scripting-jvm:1.6.21
+org.jetbrains.kotlin:kotlin-stdlib-common:1.5.31
+org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.5.31
+org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.5.31
+org.jetbrains.kotlin:kotlin-stdlib:1.5.31
+org.jetbrains.kotlin:kotlin-tooling-metadata:1.6.21
+org.jetbrains.kotlin:kotlin-util-io:1.6.21
+org.jetbrains.kotlin:kotlin-util-klib:1.6.21
+org.jetbrains.kotlinx:kotlinx-coroutines-bom:1.6.1
+org.jetbrains.kotlinx:kotlinx-coroutines-core-jvm:1.6.1
+org.jetbrains.kotlinx:kotlinx-coroutines-core:1.6.1
+org.jetbrains.kotlinx:kotlinx-metadata-jvm:0.3.0
+org.jetbrains.kotlinx:kotlinx-serialization-core-jvm:1.1.0
+org.jetbrains.kotlinx:kotlinx-serialization-core:1.1.0
+org.jetbrains.kotlinx:kotlinx-serialization-json-jvm:1.1.0
+org.jetbrains.kotlinx:kotlinx-serialization-json:1.1.0
+org.jetbrains:annotations:13.0
+org.jetbrains:markdown-jvm:0.2.4
+org.jetbrains:markdown:0.2.4
+org.jlleitschuh.gradle:ktlint-gradle:10.3.0
+org.json:json:20180813
+org.jsoup:jsoup:1.14.3
+org.jvnet.staxex:stax-ex:1.8.1
+org.ow2.asm:asm-analysis:9.1
+org.ow2.asm:asm-commons:9.1
+org.ow2.asm:asm-tree:9.1
+org.ow2.asm:asm-util:9.1
+org.ow2.asm:asm:9.1
+org.reactivestreams:reactive-streams:1.0.3
+org.slf4j:slf4j-api:1.7.30
+org.tensorflow:tensorflow-lite-metadata:0.1.0-rc2
+org.unbescape:unbescape:1.1.6.RELEASE
+xerces:xercesImpl:2.12.0
+xml-apis:xml-apis:1.4.01
+xmlpull:xmlpull:1.1.3.1

gradle/libs.versions.toml

@@ -22,6 +22,7 @@ compileSdk = "30"
 dependencyAnalysis = "1.2.1"
 detekt = "1.20.0"
 dokka = "1.6.21"
+dropbox-dependencyGuard = "0.1.0"
 exhaustive = "0.2.0"
 
 google-accompanist = "0.18.0"
@@ -69,6 +70,7 @@ autoManifest = { id = "com.gradleup.auto.manifest", version.ref = "autoManifest"
 benManes = { id = "com.github.ben-manes.versions", version.ref = "benManes" }
 dependencyAnalysis = { id = "com.autonomousapps.dependency-analysis", version.ref = "dependencyAnalysis" }
 detekt = { id = "io.gitlab.arturbosch.detekt", version.ref = "detekt" }
+dropbox-dependencyGuard = { id = "com.dropbox.dependency-guard", version.ref = "dropbox-dependencyGuard" }
 exhaustive = { id = "app.cash.exhaustive:exhaustive-gradle", version.ref = "exhaustive" }
 gradleDoctor = { id = "com.osacky.doctor", version.ref = "gradleDoctor" }
 kotlin-jvm = { id = "org.jetbrains.kotlin.jvm", version.ref = "kotlin" }
@@ -98,6 +100,8 @@ detekt-gradle = { module = "io.gitlab.arturbosch.detekt:detekt-gradle-plugin", v
 
 dokka-gradle = { module = "org.jetbrains.dokka:dokka-gradle-plugin", version.ref = "dokka" }
 
+dropbox-dependencyGuard = { module = "com.dropbox.dependency-guard:dependency-guard", version.ref = "dropbox-dependencyGuard" }
+
 google-dagger-api = { module = "com.google.dagger:dagger", version.ref = "google-dagger" }
 google-dagger-compiler = { module = "com.google.dagger:dagger-compiler", version.ref = "google-dagger" }
 

modulecheck-api/dependencies/runtimeClasspath.txt

@@ -0,0 +1,21 @@
+com.google.dagger:dagger:2.42
+com.rickbusarow.dispatch:dispatch-core:1.0.0-beta10
+com.squareup.anvil:annotations:2.4.0
+javax.inject:javax.inject:1
+net.java.dev.jna:jna:5.6.0
+net.swiftzer.semver:semver:1.2.0
+org.codehaus.groovy:groovy-xml:3.0.10
+org.codehaus.groovy:groovy:3.0.10
+org.jetbrains.intellij.deps:trove4j:1.0.20200330
+org.jetbrains.kotlin:kotlin-compiler-embeddable:1.6.21
+org.jetbrains.kotlin:kotlin-daemon-embeddable:1.6.21
+org.jetbrains.kotlin:kotlin-reflect:1.6.21
+org.jetbrains.kotlin:kotlin-script-runtime:1.6.21
+org.jetbrains.kotlin:kotlin-stdlib-common:1.6.21
+org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.6.21
+org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.6.21
+org.jetbrains.kotlin:kotlin-stdlib:1.6.21
+org.jetbrains.kotlinx:kotlinx-coroutines-bom:1.6.1
+org.jetbrains.kotlinx:kotlinx-coroutines-core-jvm:1.6.1
+org.jetbrains.kotlinx:kotlinx-coroutines-core:1.6.1
+org.jetbrains:annotations:13.0