SOLR-18296: dependency-analysis (DAGP) — reporting + safe advice (part 1/3)

build.gradle

@@ -171,6 +171,7 @@ apply from: file('gradle/validation/git-status.gradle')
 apply from: file('gradle/validation/validate-source-patterns.gradle')
 apply from: file('gradle/validation/rat-sources.gradle')
 apply from: file('gradle/validation/owasp-dependency-check.gradle')
+apply from: file('gradle/validation/dependency-analyze.gradle')
 apply from: file('gradle/validation/ecj-lint.gradle')
 apply from: file('gradle/validation/gradlew-scripts-tweaked.gradle')
 apply from: file('gradle/validation/validate-log-calls.gradle')

changelog/unreleased/dagp-dependency-analysis-PR4612.yml

@@ -0,0 +1,7 @@
+title: Add dependency-analysis (build-health) reporting to the build, and apply its uncontroversial advice (unused-dependency removals and test-scope corrections)
+type: changed
+authors:
+  - name: Serhiy Bzhezytskyy
+links:
+- name: PR#4612
+  url: https://github.com/apache/solr/pull/4612

gradle/libs.versions.toml

@@ -490,6 +490,7 @@ opentelemetry-exporter-prometheus = { module = "io.opentelemetry:opentelemetry-e
 opentelemetry-runtime-telemetry = { module = "io.opentelemetry.instrumentation:opentelemetry-runtime-telemetry-java17", version.ref = "opentelemetry-runtime-telemetry" }
 opentelemetry-sdk = { module = "io.opentelemetry:opentelemetry-sdk", version.ref = "opentelemetry" }
 opentelemetry-sdk-extension-autoconfigure = { module = "io.opentelemetry:opentelemetry-sdk-extension-autoconfigure", version.ref = "opentelemetry" }
+opentelemetry-sdk-extension-autoconfigure-spi = { module = "io.opentelemetry:opentelemetry-sdk-extension-autoconfigure-spi", version.ref = "opentelemetry" }
 opentelemetry-sdk-metrics = { module = "io.opentelemetry:opentelemetry-sdk-metrics", version.ref = "opentelemetry" }
 opentelemetry-sdk-testing = { module = "io.opentelemetry:opentelemetry-sdk-testing", version.ref = "opentelemetry" }
 opentelemetry-sdk-trace = { module = "io.opentelemetry:opentelemetry-sdk-trace", version.ref = "opentelemetry" }

gradle/validation/dependencies.gradle

@@ -113,7 +113,8 @@ allprojects {
         // This may not be the case where this task is added as a dependency, like for "dependencies" task
         project.configurations.findAll {
           // Add any custom filtering on the configurations to be resolved
-          it.canBeResolved
+          it.canBeResolved &&
+              !it.attributes.keySet().any {attr -> attr.name.startsWith("dagp.")}
         }.each {it.resolve()}
       }
     }

gradle/validation/dependency-analyze.gradle

@@ -0,0 +1,73 @@
+/*
+ * Licensed to the Apache Software Foundation (ASF) under one or more
+ * contributor license agreements.  See the NOTICE file distributed with
+ * this work for additional information regarding copyright ownership.
+ * The ASF licenses this file to You under the Apache License, Version 2.0
+ * (the "License"); you may not use this file except in compliance with
+ * the License.  You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+configure(rootProject) {
+  dependencyAnalysis {
+    issues {
+      project(':solr:ui') {
+        onUnusedDependencies {
+          severity('ignore')
+        }
+        onUsedTransitiveDependencies {
+          severity('ignore')
+        }
+        onIncorrectConfiguration {
+          severity('ignore')
+        }
+      }
+
+      project(':solr:solrj-jetty') {
+        onUnusedDependencies {
+          exclude(':solr:solrj')
+        }
+      }
+
+      project(':solr:modules:jwt-auth') {
+        onDuplicateClassWarnings {
+          severity('ignore')
+        }
+        // NOTE: DAGP advises demoting jackson-databind here from testImplementation to
+        // testRuntimeOnly. We intentionally do NOT follow that advice: the tests compile against
+        // mock-oauth2-server, whose classes reference Jackson's @JsonDeserialize annotations, so
+        // databind is needed on the test *compile* classpath (demoting it breaks compilation under
+        // -Werror). Left as a warning rather than enforced, per the report-not-fail policy below.
+      }
+
+      all {
+        // Report advice, don't fail the build. DAGP's advice is guidance, not law: some of it
+        // (notably api-vs-implementation promotions and a few test-scope demotions) needs
+        // case-by-case human judgment rather than blanket enforcement — e.g. demoting a
+        // test-compile dependency to testRuntimeOnly can break compilation when the dep is only
+        // referenced via a third-party annotation. Run `gradlew buildHealth` to see current advice.
+        onAny {
+          severity('warn')
+        }
+        onUnusedDependencies {
+          exclude(
+              'org.jspecify:jspecify',
+              'com.google.code.findbugs:jsr305',
+              'com.google.errorprone:error_prone_annotations'
+          )
+        }
+      }
+    }
+  }
+
+  tasks.named('check').configure {
+    dependsOn(tasks.named('buildHealth'))
+  }
+}

settings.gradle

@@ -24,9 +24,24 @@ pluginManagement {
   includeBuild("build-tools/build-infra")
 }
 
+// The dependency-analysis plugin (build-health) bundles a kotlin-metadata-jvm that can't yet parse
+// Kotlin 2.4.0 metadata, so it fails ExplodeJarTask on the :solr:ui (Compose/KMP) module
+// ("Provided Metadata instance has version 2.4.0, while maximum supported version is 2.3.0").
+// Tracked upstream in autonomousapps/dependency-analysis-gradle-plugin#1661; until that ships,
+// force the metadata library to match Solr's Kotlin version so DAGP can analyze the UI module.
+buildscript {
+  configurations.classpath {
+    resolutionStrategy {
+      force "org.jetbrains.kotlin:kotlin-metadata-jvm:2.4.0"
+    }
+  }
+}
+
 plugins {
   id 'com.gradle.develocity' version '4.2.2'
   id 'com.gradle.common-custom-user-data-gradle-plugin' version '2.4.0'
+  id 'com.autonomousapps.build-health' version '3.16.0'
+  id 'org.jetbrains.kotlin.multiplatform' version '2.4.0' apply false
 }
 
 apply from: file('gradle/develocity.gradle')

solr/api/gradle.lockfile

@@ -16,7 +16,7 @@ com.fasterxml.jackson.jakarta.rs:jackson-jakarta-rs-json-provider:2.22.0=swagger
 com.fasterxml.jackson.module:jackson-module-jakarta-xmlbind-annotations:2.22.0=jarValidation,swaggerBuild,testRuntimeClasspath
 com.fasterxml.jackson:jackson-bom:2.22.0=compileClasspath,jarValidation,runtimeClasspath,swaggerBuild,testCompileClasspath,testRuntimeClasspath
 com.fasterxml.woodstox:woodstox-core:7.2.1=jarValidation,testRuntimeClasspath
-com.github.ben-manes.caffeine:caffeine:3.2.4=annotationProcessor,errorprone,jarValidation,testAnnotationProcessor,testRuntimeClasspath
+com.github.ben-manes.caffeine:caffeine:3.2.4=annotationProcessor,errorprone,jarValidation,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.github.kevinstern:software-and-algorithms:1.0=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.auto.service:auto-service-annotations:1.0.1=annotationProcessor,errorprone,testAnnotationProcessor
 com.google.auto.value:auto-value-annotations:1.11.1=annotationProcessor,errorprone,testAnnotationProcessor
@@ -33,7 +33,7 @@ com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=anno
 com.google.j2objc:j2objc-annotations:3.1=annotationProcessor,errorprone,jarValidation,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath
 com.google.protobuf:protobuf-java:4.35.1=annotationProcessor,errorprone,testAnnotationProcessor
 com.j256.simplemagic:simplemagic:1.17=jarValidation,testRuntimeClasspath
-com.jayway.jsonpath:json-path:3.0.0=jarValidation,testRuntimeClasspath
+com.jayway.jsonpath:json-path:3.0.0=jarValidation,testCompileClasspath,testRuntimeClasspath
 com.sun.activation:jakarta.activation:2.0.1=swaggerBuild
 com.tdunning:t-digest:3.3=jarValidation,testRuntimeClasspath
 commons-cli:commons-cli:1.11.0=jarValidation,testRuntimeClasspath
@@ -63,11 +63,11 @@ io.opentelemetry:opentelemetry-api-incubator:1.56.0-alpha=jarValidation,testRunt
 io.opentelemetry:opentelemetry-api:1.56.0=jarValidation,testCompileClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-common:1.56.0=jarValidation,testCompileClasspath,testRuntimeClasspath
 io.opentelemetry:opentelemetry-context:1.56.0=jarValidation,testCompileClasspath,testRuntimeClasspath
-io.opentelemetry:opentelemetry-exporter-prometheus:1.56.0-alpha=jarValidation,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk-common:1.56.0=jarValidation,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk-metrics:1.56.0=jarValidation,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk-trace:1.56.0=jarValidation,testRuntimeClasspath
-io.opentelemetry:opentelemetry-sdk:1.56.0=jarValidation,testRuntimeClasspath
+io.opentelemetry:opentelemetry-exporter-prometheus:1.56.0-alpha=jarValidation,testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-common:1.56.0=jarValidation,testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-metrics:1.56.0=jarValidation,testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk-trace:1.56.0=jarValidation,testCompileClasspath,testRuntimeClasspath
+io.opentelemetry:opentelemetry-sdk:1.56.0=jarValidation,testCompileClasspath,testRuntimeClasspath
 io.prometheus:prometheus-metrics-exposition-formats:1.1.0=jarValidation,testRuntimeClasspath
 io.prometheus:prometheus-metrics-model:1.1.0=jarValidation,testRuntimeClasspath
 io.sgr:s2-geometry-library-java:1.0.0=jarValidation,testRuntimeClasspath
@@ -127,22 +127,22 @@ org.eclipse.jetty.compression:jetty-compression-common:12.1.10=jarValidation,tes
 org.eclipse.jetty.compression:jetty-compression-gzip:12.1.10=jarValidation,testRuntimeClasspath
 org.eclipse.jetty.ee10:jetty-ee10-servlet:12.1.10=jarValidation,testRuntimeClasspath
 org.eclipse.jetty.http2:jetty-http2-client-transport:12.1.10=jarValidation,testRuntimeClasspath
-org.eclipse.jetty.http2:jetty-http2-client:12.1.10=jarValidation,testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty.http2:jetty-http2-common:12.1.10=jarValidation,testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty.http2:jetty-http2-hpack:12.1.10=jarValidation,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty.http2:jetty-http2-client:12.1.10=jarValidation,testRuntimeClasspath
+org.eclipse.jetty.http2:jetty-http2-common:12.1.10=jarValidation,testRuntimeClasspath
+org.eclipse.jetty.http2:jetty-http2-hpack:12.1.10=jarValidation,testRuntimeClasspath
 org.eclipse.jetty.http2:jetty-http2-server:12.1.10=jarValidation,testRuntimeClasspath
-org.eclipse.jetty:jetty-alpn-client:12.1.10=jarValidation,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-alpn-client:12.1.10=jarValidation,testRuntimeClasspath
 org.eclipse.jetty:jetty-alpn-java-client:12.1.10=jarValidation,testRuntimeClasspath
 org.eclipse.jetty:jetty-alpn-java-server:12.1.10=jarValidation,testRuntimeClasspath
 org.eclipse.jetty:jetty-alpn-server:12.1.10=jarValidation,testRuntimeClasspath
 org.eclipse.jetty:jetty-client:12.1.10=jarValidation,testRuntimeClasspath
-org.eclipse.jetty:jetty-http:12.1.10=jarValidation,testCompileClasspath,testRuntimeClasspath
-org.eclipse.jetty:jetty-io:12.1.10=jarValidation,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-http:12.1.10=jarValidation,testRuntimeClasspath
+org.eclipse.jetty:jetty-io:12.1.10=jarValidation,testRuntimeClasspath
 org.eclipse.jetty:jetty-rewrite:12.1.10=jarValidation,testRuntimeClasspath
 org.eclipse.jetty:jetty-security:12.1.10=jarValidation,testRuntimeClasspath
 org.eclipse.jetty:jetty-server:12.1.10=jarValidation,testRuntimeClasspath
 org.eclipse.jetty:jetty-session:12.1.10=jarValidation,testRuntimeClasspath
-org.eclipse.jetty:jetty-util:12.1.10=jarValidation,testCompileClasspath,testRuntimeClasspath
+org.eclipse.jetty:jetty-util:12.1.10=jarValidation,testRuntimeClasspath
 org.glassfish.hk2.external:aopalliance-repackaged:4.0.1=jarValidation,testRuntimeClasspath
 org.glassfish.hk2:hk2-api:4.0.1=jarValidation,testRuntimeClasspath
 org.glassfish.hk2:hk2-locator:4.0.1=jarValidation,testRuntimeClasspath

solr/benchmark/build.gradle

@@ -56,4 +56,8 @@ dependencies {
   implementation libs.slf4j.api
   runtimeOnly libs.lmax.disruptor
   annotationProcessor libs.openjdk.jmh.generatorannprocess
+
+  testAnnotationProcessor libs.openjdk.jmh.generatorannprocess
+  testImplementation libs.carrotsearch.randomizedtesting.runner
+  testImplementation libs.junit.junit
 }