Merge branch 'Workiva:master' into update-analyzer

.github/dependabot.yml

@@ -0,0 +1,30 @@
+version: 2
+updates:
+    - package-ecosystem: "github-actions"
+      schedule:
+          interval: "weekly"
+      commit-message:
+          prefix: "GHA"
+      labels:
+          - "GHA"
+          - "dependencies"
+      open-pull-requests-limit: 1
+      target-branch: "master"
+      groups:
+        gha-dependencies:
+            patterns:
+                - "workiva/gha-*"
+                - "actions/*"
+      directory: "/"
+      pull-request-branch-name:
+          separator: "/"
+    - package-ecosystem: "pub"
+      directory: "/"
+      schedule:
+        interval: "weekly"
+      open-pull-requests-limit: 2
+      labels:
+          - "dependencies"
+      ignore:
+        - dependency-name: "*"
+          update-types: ["version-update:semver-major"]

.github/workflows/dart_ci.yaml

@@ -17,7 +17,7 @@ jobs:
       matrix:
         sdk: [2.19.6, stable]
     steps:
-      - uses: actions/checkout@v2
+      - uses: actions/checkout@v4
       - uses: dart-lang/setup-dart@v1
         with:
           sdk: ${{ matrix.sdk }}
@@ -31,7 +31,9 @@ jobs:
         run: dart analyze
       - name: Run tests
         run: dart test
+
       - uses: anchore/sbom-action@v0
+        if: ${{ matrix.sdk == '2.19.6'}}
         with:
           path: ./
           format: cyclonedx-json

CHANGELOG.md

@@ -1,7 +1,3 @@
-# 4.0.1
-- Reverted "non-dev packages that are only used within bin/", this was an invalid assumption and would cause
-failures for any consumer which treats `/bin` as apart of the public api.
-
 # 4.0.0
 
 - **Breaking Change:** Added "non-dev packages that are only used within bin/" check to cover this edge case.

README.md

@@ -4,17 +4,14 @@
 
 ## Installation
 
-Add the following to your pubspec.yaml:
-
-```yaml
-dev_dependencies:
-  dependency_validator: ^3.0.0
+```
+dart pub global activate dependency_validator
 ```
 
 ## Usage
 
 ```bash
-dart run dependency_validator
+dart pub global run dependency_validator
 ```
 
 This will report any missing, under-promoted, over-promoted, and unused

lib/src/dependency_validator.dart

@@ -311,6 +311,19 @@ Future<void> run() async {
       return binDir.listSync().any((entity) => entity.path.endsWith('.dart'));
     }).toSet();
 
+  final nonDevPackagesWithExecutables = packagesWithExecutables
+    .where(pubspec.dependencies.containsKey)
+    .toSet();
+  if (nonDevPackagesWithExecutables.isNotEmpty) {
+    logIntersection(
+      Level.WARNING,
+      'The following packages contain executables, and are only used outside of lib/. These should be downgraded to dev_dependencies:',
+      unusedDependencies,
+      nonDevPackagesWithExecutables,
+    );
+    exitCode = 1;
+  }
+
   logIntersection(
     Level.INFO,
     'The following packages contain executables, they are assumed to be used:',

test/executable_test.dart

@@ -576,6 +576,40 @@ void main() {
       expect(result.stdout, contains('No dependency issues found!'));
     });
 
+    test('fails when dependencies not used provide executables, but are not dev_dependencies', () async {
+      final pubspec = unindent('''
+          name: common_binaries
+          version: 0.0.0
+          private: true
+          environment:
+            sdk: '>=2.12.0 <4.0.0'
+          dependencies:
+            build_runner: ^2.3.3
+            coverage: any
+            dart_style: ^2.3.2
+            dependency_validator:
+              path: ${Directory.current.path}
+          dependency_overrides:
+            build_config:
+              git:
+                url: https://github.com/dart-lang/build.git
+                path: build_config
+                ref: $buildConfigRef
+          ''');
+
+      await d.dir('common_binaries', [
+        d.dir('lib', [
+          d.file('fake.dart', 'bool fake = true;'),
+        ]),
+        d.file('pubspec.yaml', pubspec),
+      ]).create();
+
+      result = checkProject('${d.sandbox}/common_binaries');
+
+      expect(result.exitCode, 1);
+      expect(result.stderr, contains('The following packages contain executables, and are only used outside of lib/. These should be downgraded to dev_dependencies'));
+    });
+
     test(
         'passes when dependencies are not imported but provide auto applied builders',
         () async {