Maven-dependency-plugin and annotations with SOURCE RetentionPolicy

Question

In the mvn project, where I use maven-dependency-plugin to detect unused dependencies, there seems to be no scope dependency that I can specify for Google AutoValue ( com.google.auto.value:auto-value ) to convince the plugin to that the dependency is used despite the fact that annotations from the package are used (for example, @AutoValue ), and the project will not be built if auto-value excluded.

Now one solution just adds a configuration entry to my plugin:

 <plugin> <groupId>org.apache.maven.plugins</groupId> <artifactId>maven-dependency-plugin</artifactId> <configuration> <usedDependencies> <usedDependency>com.google.auto.value:auto-value</usedDependency> </usedDependencies> </configuration> </plugin> 

But I would be interested to know if it is possible to configure the maven-dependency-plugin or dependency record for auto-value in such a way as to detect a dependency dependency on its annotations?

My suspicion is that this is not possible because the RetentionPolicy annotations that I use from the automatic value have RetentionPolicy.SOURCE and are discarded by the compiler. Is it correct?

Answer 1

Unfortunately, your suspicion is true. The maven-dependency-plugin documentation specifically lists this as a problem for source level annotations: http://maven.apache.org/shared/maven-dependency-analyzer/

Warning The analysis is performed not at the source level, but at bytecode, then some cases are not detected (constants, annotations with source code preserved, links in javadoc), which can lead to an incorrect result if they are the only use of the dependency.

You can make AutoValue as used with usedDependencies , as it was in your example, or use the ignoredUnusedDeclaredDependencies configuration (this is what I did recently).

I don’t think that you can configure the dependency section to avoid this, because maven does not provide only the scope level. I mark AutoValue with the provided scope to prevent its shading, which I could do.

Finally, you can write (or find, if one exists) a custom dependency analyzer that takes source level annotations into account. See the documentation here http://maven.apache.org/plugins/maven-dependency-plugin/analyze-mojo.html#analyzer . Probably not worth the effort.