License plugin reading incorrect artifact file might cause OOM

[blindpirate]

Context

Today I'm investigating an OOM after upgrade to Android Gradle Plugin 3.6.0-beta01, and finally found that it was caused by OssLicensesPlugin.

DependencyTask generates a dependencies JSON file from all dependency artifact files by ResolvedArtifact.file.getAbsolutePath(), then LicensesTask search for POM files based on the assumption of Maven repo layout.

However, sometimes ResolvedArtifact.file.getAbsolutePath() might return the transformed artifact file path, like ~/.gradle/caches/transforms-2/files-2.1/c592d6fca3e3510c0238d97e044b0eab/jetified-kotlin-stdlib-1.3.40.jar. In this case, the POM-searching-code will have serious performance issue - it's searching the transform directory ~/.gradle/caches/transforms-2, which has nearly 30000 files in my computer.

        FileTree tree = project.fileTree(
            dir: artifactFile.parentFile.parentFile, <--- This is not the Maven pom directory
            include: ["**/${pomFileName}", pomFileName])

Since Gradle has internal cache for file tree search patterns, there will be tens of thousands of useless cache entries, which might result in OOM easily.

To Reproduce

Run ./gradlew clean assemble in https://github.com/gradle/santa-tracker-android/tree/agp-3.6.0 branch you can see the OOM at the end of build.

On Gradle's side, we'll decrease the internal cache size, but I think we'd also better exclude tranformed dependencies because there's no POM at all.

[blindpirate]

Seems to be closed by #104

[jkasnicki]

Released in com.google.android.gms:oss-licenses-plugin:0.10.1

See https://developers.google.com/android/guides/releases#january_13_2020