Skip to content

Add opt-in --rev-deps check to pr-check using dart pub unpack - #171

Merged
kevmoo merged 2 commits into
mainfrom
rev-dep-api-collision
Oct 20, 2026
Merged

kevmoo merged 2 commits into
mainfrom
rev-dep-api-collision

Conversation

@kevmoo

@kevmoo kevmoo commented Oct 20, 2026

Copy link
Copy Markdown
Owner

Adds an opt-in --rev-deps flag to kscripts pr-check that validates touched publishable packages against already-published downstream consumers on pub.dev before a non-major release.

Why

  • Isolated API diffing tools (dart_apitool, api_summary) classify adding public top-level symbols or extension members as backwards-compatible minor changes, even when downstream consumers on pub.dev already import the package entrypoint without show and declare colliding extension members (ambiguous_extension_member_access) or top-level helpers (ambiguous_import), as occurred in feat: add class-model helpers for code generators (1.4.0) google/source_helper.dart#78 (1.4.0).
  • Validating against downstream HEAD branches misses these collisions when donor helpers have already been deleted on the consumer's feature branch.

Non-Obvious Callouts

  • Default pr-check runs make zero network calls and record Skipped: rev-deps:<pkg> (pass --rev-deps to run) when a publishable package modifies lib/ in a non-major release (VersionConstraint.compatibleWith(baseRelease).allows(targetRelease)).
  • When --rev-deps is passed, pr-check queries pub.dev (dependency:<pkg> and dependency:<pkg> publisher:kevmoo.com) plus ~/.pub-cache/hosted/pub.dev, unpacks each compatible consumer via dart pub unpack <consumer> --no-resolve, strips analysis_options.yaml, resolution, workspace, and dev_dependencies via YamlEditor, writes pubspec_overrides.yaml pointing <pkg> to the local checkout, and runs dart pub get + dart analyze lib.

Verification

- Add `lib/src/pr_check_rev_deps.dart` (`part of 'pr_check.dart'`) to detect newly exported top-level symbols and extension members from `api.txt` or `lib/*.dart` when a publishable package prepares a non-major release.
- Query `pub.dev` reverse-dependency tarballs and `~/.pub-cache` packages whose version constraint admits the target release, flagging consumers that import the package entrypoint without a guarding `show`/`hide`/`as` clause while declaring a colliding top-level symbol or extension member.
- Add unit tests in `test/pr_check_test.dart` covering `api.txt` and `lib/` symbol extraction, declaration-aware collision detection, `.tar.gz` extraction, and `runPrCheck` integration.
…unpack

- Add `--rev-deps` flag to `pr-check` (skipped by default with `pass --rev-deps to run` when a publishable package modifies `lib/` in a non-major release).
- Use `dart pub unpack <consumer> --no-resolve --output=<tempDir>`, `YamlEditor` (removing `resolution`, `workspace`, `dev_dependencies`, and `dependency_overrides` plus deleting `analysis_options.yaml`), `pubspec_overrides.yaml`, `dart pub get`, and `dart analyze lib` with zero regexps or custom tar/AST parsers.
- Query `pub.dev` (`dependency:<pkg>` and `dependency:<pkg> publisher:kevmoo.com`) alongside `~/.pub-cache/hosted/pub.dev` to build the candidate reverse-dependency list.
@kevmoo
kevmoo merged commit 1f726a0 into main Oct 20, 2026
6 checks passed
@kevmoo
kevmoo deleted the rev-dep-api-collision branch October 20, 2026 02:29
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant