Transitive bazel dependencies have public visibility

[realityforge]

As a reasonably new user I found it extremely surprising that a transitive dependency that was not declared in the artifacts attribute had public visibility. I would have expected that the way to make a transitive artifact public was to supply a 2-part spec in the artifacts attribute.

This would make it much easier for relative beginners to read the rules as the public targets would be explicitly declared.

Was this ever considered?

Other than that, it has been reasonably easy to get started. Thanks!

[jin]

Yes, we should definitely restrict the visibility of unspecified artifacts. I'll mark this as a good first issue for anyone to take up if they want to give it a shot.

[mpassell]

This seems like a good idea in principle, but there are unfortunately some dependencies that seem to be specifically set up to bring in dependencies for you to directly reference. The Spring Boot starters would be a good example. It seems like a bad practice to me, but they get used pretty heavily. :( So, even if this gets done, I think there should be an option to turn it off.

[jin]

So, even if this gets done, I think there should be an option to turn it off.

I agree. It's also possible for the rule, or use bazel query, to provide the flat list of artifacts that are actually used, so it's simple to switch to this behavior.