Dependency Analysis Gradle Plugin

Features

The Dependency Analysis Gradle Plugin has the following features:

It reports on dependency-related issues such as:

1. … unused dependencies.

2. … used transitive dependencies, which it is advisable you declare directly.

3. … dependencies declared on the wrong configuration (api vs implementation vs compileOnly, etc.).

4. … unused annotation processors.

For these types of issues, the plugin has auto-remediation capabilities.

It can also report on plugin-related issues such as when:

1. … the org.jetbrains.kotlin.jvm plugin is applied but isn’t used.

2. … the com.android.library plugin is applied but the module could be JVM.

Additionally, the plugin:

1. … will warn when a classpath has duplicate class files.

2. … can trigger downloading of external dependencies, which can help with containerized builds.

3. … print the dominator tree for a project, which can help with discovering "fat" dependencies that are bloating the size of your deployables.

4. … generate a project graph to help visualize the shape of your project.

Compatibilities

The plugin can be used to analyze JVM or Android projects, including multi-project builds including both JVM and Android. It supports Groovy, Java, Kotlin, and Scala on the JVM. For Android, it supports analysis of com.android.application, com.android.library, and com.android.test modules. It has special handling for "application" modules, which are those that apply the application, org.gretty, or org.springframework.boot plugins.

Please see the wiki for comprehensive information.

Add to your project and use

For detailed instructions, see the wiki.

The simplest approach is to add the following:

settings.gradle.kts

plugins {
  id("com.autonomousapps.build-health") version "<<latest_version>>"
}

and then in the root build script:

build.gradle.kts

dependencyAnalysis {
  issues {
    all {
      onAny {
        severity("fail")
      }
    }
  }
}

Important

If your project uses Kotlin or Android (or both), then those plugins must also be loaded in the settings script classloader (or a parent). See the wiki for more information

For a quick start, just run the following:

./gradlew buildHealth

You will probably see output like the following:

> Task :buildHealth FAILED

FAILURE: Build failed with an exception.

* What went wrong:
Execution failed for task ':buildHealth'.
> There were dependency violations. See report at file:///path/to/project/build/reports/dependency-analysis/build-health-report.txt

If you wish to have this (potentially very long) report printed to console, add this to the dependencyAnalysis DSL:

build.gradle.kts

dependencyAnalysis {
  reporting {
    printBuildHealth(true)
  }
}

Repositories

From 2.19.0 for releases, and 2.18.1-SNAPSHOT for snapshots, this plugin uses https://central.sonatype.com. To add this plugin to your project, use the following repositories.

settings.gradle.kts

pluginManagement {
  repositories {
    // releases
    mavenCentral()
    // snapshots
    maven(url = "https://central.sonatype.com/repository/maven-snapshots/")
    // Once you start using pluginManagement, you should explicitly add this,
    // unless you NEVER want to use this repository
    gradlePluginPortal()
  }
}

More advanced usage

You do not have to apply this plugin to all projects via the settings script. It can also be applied to only specific subprojects. In this case, it must also be applied to the root build script.

root build.gradle.kts

plugins {
  id("com.autonomousapps.dependency-analysis") version "<<latest_version>>"
}

sub/project/build.gradle.kts

plugins {
  id("com.autonomousapps.dependency-analysis")
}

Important

If your project uses Kotlin or Android (or both), then those plugins must also be loaded in the root build script classloader (or a parent). See the wiki for more information

Project Health

The analysis can be run against individual modules with the projectHealth task. For example:

./gradlew app:projectHealth

Fix dependency issues automatically

It is common for the plugin to report many issues with your project’s dependency declarations. Since fixing manually can be tedious, the plugin also provides a task to auto-remediate all issues.

./gradlew fixDependencies

The fixDependencies task is registered on each project where the plugin is applied. Running it as above will run the task in each subproject. See also One click dependencies fix.

Fix only some dependency issues automatically

In some circumstances, it may be considered infeasible to resolve all issues in one pass. Maybe you have a very large project, or you publish libraries and you know that changing your dependency declarations will also change your libraries' metadata, which might break consumers. To support this use-case, the the fixDependencies task takes an optional flag to tell it to, essentially, make only "safe" changes.

./gradlew fixDependencies --upgrade

With this flag in place, the fixDependencies task will not remove or "downgrade" any dependency declarations. It will only add or "upgrade" declarations (e.g., from implementation to api).

In an incremental rollout scenario, one could imagine using the --upgrade flag, then updating all consumers, then finally removing the flag and removing all unused dependencies.

Caveats

If the analysis has any bugs, then fixing the dependency declarations make break your build (but this is also the case with manual fixes). If you encounter this, please file an issue.

Additionally, the rewriting functionality is based on a simplified Gradle Groovy DSL grammar, which will fail in the presence of complex Groovy build scripts. The Kotlin DSL grammar has full support for the entire Kotlin language, which makes the rewriting functionality work much better for Gradle Kotlin DSL scripts. There are no plans to do the same for Gradle Groovy DSL.

Reason

You may be curious why the plugin is emitting (or not emitting) advice regarding some dependency. You can ask it why:

./gradlew lib:reason --id com.squareup.okio:okio:2.2.2 (1)
> Task :lib:reason

----------------------------------------
You asked about the dependency 'com.squareup.okio:okio:2.2.2'.
There is no advice regarding this dependency.
----------------------------------------

Shortest path from :lib to com.squareup.okio:okio:2.2.2:
:lib
\--- com.squareup.okio:okio:2.2.2

Source: main
------------
* Exposes class okio.BufferedSource (implies api).

1. The version string is optional.

Basic configuration

For detailed information on how to configure the plugin, see the wiki.

To configure the plugin, use the dependencyAnalysis extension.

Below is a summary of the top-level DSL options:

build.gradle.kts

dependencyAnalysis {
  // Declare that the plugin should use typesafe project accessors. False by default.
  useTypesafeProjectAccessors(true)

  // Configure ABI exclusion rules.
  abi { ... }

  // Configure the severity of issues, and exclusion rules, for potentially the entire project.
  issues { ... }

  // Configure issue reports.
  reporting { ... }

  // Configure dependency structure rules (bundles, mapping, etc).
  structure { ... }

  // Configure usage rules.
  usage { ... }
}

Ancillary tasks

As mentioned above, the plugin has a variety of features not strictly related to maintaining a correct dependency graph.

Trigger downloading of external dependencies

This task will resolve all the external dependencies for a given source set’s compile and runtime classpaths. "Resolving" a dependency will also result in downloading that dependency. A common case where this is useful is when you want to create an image for a containerized build.

./gradlew :<module>:resolveExternalDependenciesMain

where "Main" refers to the name of the source set or Android variant (capitalized).

Print the denominator tree

This will print the dominator tree for the given project. This is useful when looking for "fat" dependencies that contribute significantly to final binary size (such as with a fatjar or when building an image), and in cases where it’s desirable to shrink that binary.

./gradlew :<module>:printDominatorTreeCompileMain

where "Main" refers to the name of the source set or Android variant (capitalized).

Generate a project graph

This will generate various views of the project graph in your multi-project build, for both compile and runtime classpaths. In addition to the graphviz output, there is also a topological sort, which might be useful for debugging issues with evaluation order.

./gradlew :<module>:projectGraphMain

where "Main" refers to the name of the source set or Android variant (capitalized).

Programmatic usage and API guarantees

From version 3.0.0, the plugin includes an api definition in api/api.txt. Any backwards-incompatible change from then on will result in a major version release. Note that some code is public only due to tooling limitations; most of this code is in an internal package, but com.autonomousapps.tasks is also considered "internal." Usage of any API in these internal packages is at your own risk.

For typical users who only apply the plugin and run the primary tasks (buildHealth, projectHealth, reason, etc.), major releases should be treated as non-events. For these users, the "API" is just those primary tasks.

Publications

The following is a list of articles / blog posts that have been published discussing this plugin:

1. The proper care and feeding of your Gradle build

2. Dependency Analysis Gradle Plugin: Using bytecode analysis to find unused dependencies

3. Dependency Analysis Gradle Plugin: What’s an ABI?

4. Reducing my Gradle plugin’s impact on configuration time: A journey

5. One-click dependencies fix

This plugin has also been featured in these newsletters:

1. Gradle, Oct 2024

2. Gradle, May 2022

3. Gradle, September 2020

4. Gradle, August 2020

5. Android Weekly, Issue #423

6. Gradle, July 2020

7. Gradle, June 2020

Podcast episodes about this plugin could be found here:

1. The Developers' Bakery, Episode #31

Youtube videos about this plugin:

1. Understanding Gradle #28 – Clean Compile Classpaths with the Dependency Analysis Plugin