[ci/tool] Add external dependency validation #3466

stuartmorgan · 2023-03-15T18:08:22Z

We've had a general policy of avoiding external dependencies for at least the last year, but it hadn't really been communicated or enforced. It's now documented in the wiki, and this adds tooling and CI that validates that every package we depend on here is either a) local to this repository, b) from the SDK, or c) in an explicit allow list config file.

This follows the general trend in the repository away from "hope people know/remember/check for all of the policies" to "validate in CI and require explicit opt-out for exceptions". Once this lands, I'll update the wiki to point to the relevant config files where exceptions should be added when we choose to make exceptions.

In most cases, this just allows everything we're already using. For some example and dev-only dependencies, this moves to pinning since that's a simple change to make.

See flutter/flutter#122713

Pre-launch Checklist

tarrinneal

optional nit, but seems good to me.

tarrinneal · 2023-03-15T18:38:24Z

script/tool/lib/src/pubspec_check_command.dart

+  }
+
+  // Checks whether a given dependency is allowed.
+  bool _allowDependency(String name, Dependency dependency) {


This method name seems a little off from what I would expect. Something like _isDependancyAllowed or something similar.

As is I would expect this to add the dep to an allow list. Up to you if you agree.

Good call, changed to _shouldAllowDependency

stuartmorgan · 2023-03-15T19:03:44Z

Overrides: packages changes are to dev_dependencies, which are dev-only.

jmagman · 2023-03-15T19:09:37Z

For some example and dev-only dependencies, this moves to pinning since that's a simple change to make.

Can we turn on dependabot for this case?

stuartmorgan · 2023-03-15T20:05:53Z

Can we turn on dependabot for this case?

It's on my list to look into in general; currently we're not using it for Dart at all so I don't know how configurable it is. Ideally we'd use it for major versions of most dependencies, and now for other versions of these pinned items.

(For cases like mockito it's not clear if it would be useful since we'd want to actually regenerate the mocks, not just update the pin.)

jmagman

LGTM

script/tool/lib/src/pubspec_check_command.dart

ditman

LGTM! I have 2 deps to remove. (jwt_decoder and mocktail)

script/configs/allowed_pinned_deps.yaml

ditman · 2023-03-16T02:33:02Z

packages/camera/camera_web/example/pubspec.yaml

@@ -21,4 +21,4 @@ dev_dependencies:
    sdk: flutter
  integration_test:
    sdk: flutter
-  mocktail: ^0.3.0
+  mocktail: 0.3.0


(My bad, this should have never happened in the first place)

Co-authored-by: Jenn Magder <magder@google.com>

cbracken

This makes me happier than I can express in a single lgtm.

chunhtai

LGTM

auto-submit · 2023-03-16T18:28:56Z

auto label is removed for flutter/packages, pr: 3466, Failed to merge pr#: 3466 with Pull request could not be merged: Pull Request is not mergeable.

…s#3466)

* 7636eb7 [go_router_builder] Support default value for `Set`, `List` and `Iterable` route parameters (flutter/packages#3391) * 26c95da [image_picker] Move HashSet construction within if-statement (flutter/packages#3448) * f5687b2 [image_picker] fix typos in comments (flutter/packages#3413) * 84afba7 [image_picker] Migrate Android to Pigeon (flutter/packages#3476) * 42927fc [image_picker]: Bump androidx.exifinterface:exifinterface from 1.3.3 to 1.3.6 in /packages/image_picker/image_picker_android/android (flutter/packages#3238) * 9a44bdf Require Dart SDK 2.14, because of using APIs. (flutter/packages#3468) * 12609a2 [ci] Clean up iOS simulators (flutter/packages#3458) * 9b136a9 [ci/tool] Add external dependency validation (flutter/packages#3466) * 11aab47 Manual roll Flutter from fb7e828 to 67e5f66 (8 revisions) (flutter/packages#3482) * 784291b Update goldens (flutter/packages#3442) * 43a42d1 [webview_flutter_android] Updates Dart and Java InstanceManagers (flutter/packages#3282) * d0de136 [camera] Reland android flip/change camera while recording (flutter/packages#3460) * 74fd094 [image_picker_android] Adjust file extension in FileUtils when it does not match its mime type (flutter/packages#3409) * d2f1d2d [flutter_adaptive_scaffold] : 🐛 [FIX] : Issue: 121135. (flutter/packages#3253) * 3d078b5 Roll Flutter from 67e5f66 to 53dfd23 (39 revisions) (flutter/packages#3484) * 3b3a09d [url_launcher] Convert iOS to Pigeon (flutter/packages#3481) * 80cd50a Roll Flutter from 53dfd23 to 6bd2b3c (17 revisions) (flutter/packages#3486) * 998bb29 [webview_flutter] Updates the README with the migration of `WebView.initialCookies` and Hybrid Composition on (flutter/packages#3470) * bbf86a7 Roll Flutter from 6bd2b3c to 3e4e092 (7 revisions) (flutter/packages#3490)

[ci/tool] Add external dependency validation

stuartmorgan added 3 commits March 15, 2023 13:23

Add new validation

6899b5c

Add allow lists

e9919ab

Fix violations

313c315

stuartmorgan requested review from bparrishMines and tarrinneal March 15, 2023 18:08

stuartmorgan requested review from ditman, Hixie and chunhtai as code owners March 15, 2023 18:08

github-actions bot added p: camera p: go_router p: go_router_builder p: rfw Remote Flutter Widgets platform-web labels Mar 15, 2023

tarrinneal approved these changes Mar 15, 2023

View reviewed changes

stuartmorgan added 3 commits March 15, 2023 14:57

Review comments

66d83f9

Pin file_testing

40670fe

Pin mockito

7317df2

stuartmorgan added override: no versioning needed Override the check requiring version bumps for most changes override: no changelog needed Override the check requiring CHANGELOG updates for most changes labels Mar 15, 2023

stuartmorgan requested review from cbracken, cyanglaz, jmagman, vashworth, gmackall, camsim99, keyonghan and domesticmouse as code owners March 15, 2023 19:03

github-actions bot added p: file_selector p: flutter_markdown labels Mar 15, 2023

github-actions bot added platform-macos platform-windows labels Mar 15, 2023

jmagman approved these changes Mar 15, 2023

View reviewed changes

script/tool/lib/src/pubspec_check_command.dart Outdated Show resolved Hide resolved

script/tool/lib/src/pubspec_check_command.dart Outdated Show resolved Hide resolved

ditman approved these changes Mar 16, 2023

View reviewed changes

stuartmorgan and others added 3 commits March 16, 2023 07:10

Update script/tool/lib/src/pubspec_check_command.dart

3c689d1

Co-authored-by: Jenn Magder <magder@google.com>

Update script/tool/lib/src/pubspec_check_command.dart

ec58b25

Co-authored-by: Jenn Magder <magder@google.com>

Merge branch 'main' into tool-deps-check

4df7923

cbracken approved these changes Mar 16, 2023

View reviewed changes

chunhtai approved these changes Mar 16, 2023

View reviewed changes

Merge branch 'main' into tool-deps-check

081c18b

stuartmorgan added the autosubmit Merge PR when tree becomes green via auto submit App label Mar 16, 2023

auto-submit bot removed the autosubmit Merge PR when tree becomes green via auto submit App label Mar 16, 2023

stuartmorgan added 2 commits March 16, 2023 13:17

Merge branch 'main' into tool-deps-check

039bb2d

Merge branch 'main' into tool-deps-check

47963ba

stuartmorgan added the autosubmit Merge PR when tree becomes green via auto submit App label Mar 17, 2023

auto-submit bot merged commit 9b136a9 into flutter:main Mar 17, 2023

engine-flutter-autoroll mentioned this pull request Mar 17, 2023

Roll Packages from 44ddf2ceeb00 to 43a42d1ada65 (11 revisions) flutter/flutter#122893

Closed

engine-flutter-autoroll added a commit to engine-flutter-autoroll/flutter that referenced this pull request Mar 17, 2023

9b136a9 [ci/tool] Add external dependency validation (flutter/package…

4ea903d

…s#3466)

engine-flutter-autoroll mentioned this pull request Mar 17, 2023

Roll Packages from 44ddf2ceeb00 to 43a42d1ada65 (11 revisions) flutter/flutter#122904

Closed

engine-flutter-autoroll added a commit to engine-flutter-autoroll/flutter that referenced this pull request Mar 17, 2023

9b136a9 [ci/tool] Add external dependency validation (flutter/package…

3d5faac

…s#3466)

engine-flutter-autoroll mentioned this pull request Mar 20, 2023

Roll Packages from 44ddf2ceeb00 to bbf86a7e1a83 (19 revisions) flutter/flutter#123015

Merged

engine-flutter-autoroll added a commit to engine-flutter-autoroll/flutter that referenced this pull request Mar 20, 2023

9b136a9 [ci/tool] Add external dependency validation (flutter/package…

e154737

…s#3466)

reidbaker mentioned this pull request Mar 20, 2023

[Many] i123017 integration annotation documentation #3495

Merged

10 tasks

stuartmorgan mentioned this pull request Mar 24, 2023

Roll mockito to 5.4.0 #3544

Merged

nploi pushed a commit to nploi/packages that referenced this pull request Jul 16, 2023

[ci/tool] Add external dependency validation (flutter#3466)

abac8db

[ci/tool] Add external dependency validation

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

[ci/tool] Add external dependency validation #3466

[ci/tool] Add external dependency validation #3466

stuartmorgan commented Mar 15, 2023

tarrinneal left a comment

tarrinneal Mar 15, 2023

stuartmorgan Mar 15, 2023

stuartmorgan commented Mar 15, 2023

jmagman commented Mar 15, 2023 •

edited

Loading

stuartmorgan commented Mar 15, 2023

jmagman left a comment

ditman left a comment

ditman Mar 16, 2023 •

edited

Loading

cbracken left a comment

chunhtai left a comment

auto-submit bot commented Mar 16, 2023

[ci/tool] Add external dependency validation #3466

[ci/tool] Add external dependency validation #3466

Conversation

stuartmorgan commented Mar 15, 2023

Pre-launch Checklist

tarrinneal left a comment

Choose a reason for hiding this comment

tarrinneal Mar 15, 2023

Choose a reason for hiding this comment

stuartmorgan Mar 15, 2023

Choose a reason for hiding this comment

stuartmorgan commented Mar 15, 2023

jmagman commented Mar 15, 2023 • edited Loading

stuartmorgan commented Mar 15, 2023

jmagman left a comment

Choose a reason for hiding this comment

ditman left a comment

Choose a reason for hiding this comment

ditman Mar 16, 2023 • edited Loading

Choose a reason for hiding this comment

cbracken left a comment

Choose a reason for hiding this comment

chunhtai left a comment

Choose a reason for hiding this comment

auto-submit bot commented Mar 16, 2023

jmagman commented Mar 15, 2023 •

edited

Loading

ditman Mar 16, 2023 •

edited

Loading