SOLR-18302: DAGP external-lib api advice — ILLUSTRATIVE, not for merge (part 3/3)

build.gradle

@@ -171,6 +171,7 @@ apply from: file('gradle/validation/git-status.gradle')
 apply from: file('gradle/validation/validate-source-patterns.gradle')
 apply from: file('gradle/validation/rat-sources.gradle')
 apply from: file('gradle/validation/owasp-dependency-check.gradle')
+apply from: file('gradle/validation/dependency-analyze.gradle.kts')
 apply from: file('gradle/validation/ecj-lint.gradle')
 apply from: file('gradle/validation/gradlew-scripts-tweaked.gradle')
 apply from: file('gradle/validation/validate-log-calls.gradle')

changelog/unreleased/dagp-SOLR-18302.yml

@@ -0,0 +1,11 @@
+# See https://github.com/apache/solr/blob/main/dev-docs/changelog.adoc
+
+title: >
+  Add dependency-analysis (build-health) reporting to the Gradle build in report-not-fail mode,
+  and apply its safe advice (unused-dependency removals and test-scope corrections)
+type: other
+authors:
+  - name: Serhiy Bzhezytskyy
+links:
+  - name: SOLR-18302
+    url: https://issues.apache.org/jira/browse/SOLR-18302

gradle/libs.versions.toml

@@ -490,6 +490,7 @@ opentelemetry-exporter-prometheus = { module = "io.opentelemetry:opentelemetry-e
 opentelemetry-runtime-telemetry = { module = "io.opentelemetry.instrumentation:opentelemetry-runtime-telemetry-java17", version.ref = "opentelemetry-runtime-telemetry" }
 opentelemetry-sdk = { module = "io.opentelemetry:opentelemetry-sdk", version.ref = "opentelemetry" }
 opentelemetry-sdk-extension-autoconfigure = { module = "io.opentelemetry:opentelemetry-sdk-extension-autoconfigure", version.ref = "opentelemetry" }
+opentelemetry-sdk-extension-autoconfigure-spi = { module = "io.opentelemetry:opentelemetry-sdk-extension-autoconfigure-spi", version.ref = "opentelemetry" }
 opentelemetry-sdk-metrics = { module = "io.opentelemetry:opentelemetry-sdk-metrics", version.ref = "opentelemetry" }
 opentelemetry-sdk-testing = { module = "io.opentelemetry:opentelemetry-sdk-testing", version.ref = "opentelemetry" }
 opentelemetry-sdk-trace = { module = "io.opentelemetry:opentelemetry-sdk-trace", version.ref = "opentelemetry" }

gradle/validation/dependencies.gradle

@@ -112,8 +112,11 @@ allprojects {
         // Resolve and update locks only if --write-locks explicitly included
         // This may not be the case where this task is added as a dependency, like for "dependencies" task
         project.configurations.findAll {
-          // Add any custom filtering on the configurations to be resolved
-          it.canBeResolved
+          // Add any custom filtering on the configurations to be resolved.
+          // Skip the dependency-analysis plugin's synthetic configurations (marked with "dagp.*"
+          // attributes); they are not meant to be resolved and would fail lock-file generation.
+          it.canBeResolved &&
+              !it.attributes.keySet().any {attr -> attr.name.startsWith("dagp.")}
         }.each {it.resolve()}
       }
     }

gradle/validation/dependency-analyze.gradle.kts

@@ -0,0 +1,66 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+import com.autonomousapps.DependencyAnalysisExtension
+
+configure<DependencyAnalysisExtension> {
+  issues {
+    project(":solr:ui") {
+      onUnusedDependencies {
+        severity("ignore")
+      }
+      onUsedTransitiveDependencies {
+        severity("ignore")
+      }
+      onIncorrectConfiguration {
+        severity("ignore")
+      }
+    }
+
+    project(":solr:solrj-jetty") {
+      onUnusedDependencies {
+        exclude(":solr:solrj")
+      }
+    }
+
+    project(":solr:modules:jwt-auth") {
+      onDuplicateClassWarnings {
+        severity("ignore")
+      }
+    }
+
+    all {
+      // Report advice as warnings rather than failing the build: several categories
+      // (api-vs-implementation promotions, some test-scope changes) need case-by-case
+      // human judgment. Run `gradlew buildHealth` to see the current advice.
+      onAny {
+        severity("warn")
+      }
+      onUnusedDependencies {
+        exclude(
+          "org.jspecify:jspecify",
+          "com.google.code.findbugs:jsr305",
+          "com.google.errorprone:error_prone_annotations",
+        )
+      }
+    }
+  }
+}
+
+tasks.named("check").configure {
+  dependsOn(tasks.named("buildHealth"))
+}

settings.gradle

@@ -24,9 +24,24 @@ pluginManagement {
   includeBuild("build-tools/build-infra")
 }
 
+// The dependency-analysis plugin (build-health) bundles a kotlin-metadata-jvm that can't yet parse
+// Kotlin 2.4.0 metadata, so it fails ExplodeJarTask on the :solr:ui (Compose/KMP) module
+// ("Provided Metadata instance has version 2.4.0, while maximum supported version is 2.3.0").
+// Tracked upstream in autonomousapps/dependency-analysis-gradle-plugin#1661; until that ships,
+// force the metadata library to match Solr's Kotlin version so DAGP can analyze the UI module.
+buildscript {
+  configurations.classpath {
+    resolutionStrategy {
+      force "org.jetbrains.kotlin:kotlin-metadata-jvm:2.4.0"
+    }
+  }
+}
+
 plugins {
   id 'com.gradle.develocity' version '4.2.2'
   id 'com.gradle.common-custom-user-data-gradle-plugin' version '2.4.0'
+  id 'com.autonomousapps.build-health' version '3.16.0'
+  id 'org.jetbrains.kotlin.multiplatform' version '2.4.0' apply false
 }
 
 apply from: file('gradle/develocity.gradle')

solr/api/build.gradle

@@ -71,7 +71,6 @@ dependencies {
   implementation libs.semver4j.semver4j
 
   testImplementation project(':solr:test-framework')
-  testImplementation project(':solr:api')
   testImplementation libs.junit.junit
   testImplementation libs.hamcrest.hamcrest
   testImplementation libs.apache.lucene.testframework