tools/java_deps.MODULE.bazel

# Module-file fragment for Java/Maven external dependencies.
#
# This file is included from the root MODULE.bazel via include().
# It contains the rules_jvm_external configuration for Gerrit:
#  - pinned root artifact versions to keep Gerrit and JGit aligned
#  - excluded artifacts to prevent duplicate classes and unwanted runtimes
#  - TOML-based dependency import + lockfile enforcement
#
# NOTE: MODULE/.MODULE.bazel files are evaluated in the bzlmod resolution phase
# and do not allow load() or function definitions. Keep this file self-contained.

maven = use_extension("@rules_jvm_external//:extensions.bzl", "maven")

# Although flexmark is published as many small modules, the `flexmark-all`
# artifact is a shaded aggregate that already includes all required classes.
# Exclude the modular artifacts to avoid duplicate classes in the WAR.
_FLEXMARK_GROUP = "com.vladsch.flexmark"

_FLEXMARK_MODULES = [
    "flexmark",
    "flexmark-ext-abbreviation",
    "flexmark-ext-admonition",
    "flexmark-ext-anchorlink",
    "flexmark-ext-aside",
    "flexmark-ext-attributes",
    "flexmark-ext-autolink",
    "flexmark-ext-definition",
    "flexmark-ext-emoji",
    "flexmark-ext-enumerated-reference",
    "flexmark-ext-escaped-character",
    "flexmark-ext-footnotes",
    "flexmark-ext-gfm-issues",
    "flexmark-ext-gfm-strikethrough",
    "flexmark-ext-gfm-tasklist",
    "flexmark-ext-gfm-users",
    "flexmark-ext-gitlab",
    "flexmark-ext-ins",
    "flexmark-ext-jekyll-front-matter",
    "flexmark-ext-jekyll-tag",
    "flexmark-ext-macros",
    "flexmark-ext-media-tags",
    "flexmark-ext-resizable-image",
    "flexmark-ext-superscript",
    "flexmark-ext-tables",
    "flexmark-ext-toc",
    "flexmark-ext-typographic",
    "flexmark-ext-wikilink",
    "flexmark-ext-xwiki-macros",
    "flexmark-ext-yaml-front-matter",
    "flexmark-ext-youtube-embedded",
    "flexmark-html2md-converter",
    "flexmark-jira-converter",
    "flexmark-pdf-converter",
    "flexmark-profile-pegdown",
    "flexmark-util",
    "flexmark-util-ast",
    "flexmark-util-builder",
    "flexmark-util-collection",
    "flexmark-util-data",
    "flexmark-util-dependency",
    "flexmark-util-format",
    "flexmark-util-html",
    "flexmark-util-misc",
    "flexmark-util-options",
    "flexmark-util-sequence",
    "flexmark-util-visitor",
    "flexmark-youtrack-converter",
]

_OTHER_EXCLUDES = [
    # Logging clashes / legacy implementations.
    "log4j:log4j",
    "org.slf4j:slf4j-log4j12",

    # openid4java transitively depends on commons-logging; not needed at runtime.
    "commons-logging:commons-logging",

    # commons-validator: exclude unused transitive commons-* stack.
    "commons-beanutils:commons-beanutils",
    "commons-collections:commons-collections",
    "commons-digester:commons-digester",

    # sshd-common/core bundled inside sshd-osgi in your runtime set.
    "org.apache.sshd:sshd-common",
    "org.apache.sshd:sshd-core",

    # Unused Lucene modules (keep WAR footprint aligned with pre-migration).
    "org.apache.lucene:lucene-facet",
    "org.apache.lucene:lucene-queries",
    "org.apache.lucene:lucene-sandbox",

    # soy-template transitives not required at runtime.
    "com.google.escapevelocity:escapevelocity",
    "javax.annotation:jsr250-api",
    "org.json:json",

    # Redundant legacy XML APIs already provided by JDK; pulled via html/xml parsers.
    "xml-apis:xml-apis",
]

EXCLUDED_ARTIFACTS = (
    ["%s:%s" % (_FLEXMARK_GROUP, a) for a in _FLEXMARK_MODULES] +
    _OTHER_EXCLUDES
)

# We consume Guice's unshaded artifact (published as the "classes"
# classifier) plus an external OW2 ASM (see //lib/guice and tools/nongoogle.toml),
# because the ASM shaded into the default guice jar cannot read Java 25 class
# files and corrupts Guice's error-message source formatting. The external ASM
# must be >= 9.8, the first release with Java 25 (class major 69) support;
# Gerrit pins 9.9.1.
#
# That only holds if the plain (fat) com.google.inject:guice never reaches the
# classpath. These artifacts pull it in transitively, so strip that edge from
# each; they resolve Guice solely from the //lib/guice classes-classifier jar.
# Keep this list in sync with everything that depends on Guice transitively --
# a missed entry silently reintroduces the shaded ASM.
#
# TODO(davido): Drop these exclusions (and the classes classifier) once Guice
# ships a default jar with an updated shaded ASM that reads current class
# files: https://github.com/google/guice/issues/1926
_GUICE_FAT_JAR_CONSUMERS = [
    "com.google.inject.extensions:guice-assistedinject",
    "com.google.inject.extensions:guice-servlet",
    "com.google.template:soy",
    "org.openid4java:openid4java",
]

[
    maven.amend_artifact(
        name = "external_deps",
        coordinates = coord,
        exclusions = ["com.google.inject:guice"],
    )
    for coord in _GUICE_FAT_JAR_CONSUMERS
]

# Empty maven.install call to apply the configuration to the installation from
# toml files.
maven.install(
    name = "external_deps",
    artifacts = [],
    # CRITICAL: Must remain "error".
    # This guarantees fail-fast behavior if multiple versions of the same
    # artifact are introduced by contributing modules. Downgrading this to
    # "warn" would allow version skew to silently leak into release.war.
    duplicate_version_warning = "error",
    excluded_artifacts = EXCLUDED_ARTIFACTS,
    fail_if_repin_required = True,
    fail_on_missing_checksum = True,
    fetch_sources = True,
    known_contributing_modules = [
        "jgit",
        "gerrit",
    ],
    lock_file = "//:external_deps.lock.json",
    repositories = [
        # Prefer Gerrit's mirror to reduce direct Maven Central traffic.
        # Keep Maven Central as fallback while the mirror is populated.
        "https://gerrit-maven.storage.googleapis.com",
        "https://repo1.maven.org/maven2",
    ],
    version_conflict_policy = "pinned",
)
maven.from_toml(
    name = "external_deps",
    libs_versions_toml = "//tools:deps.toml",
)
maven.from_toml(
    name = "external_deps",
    libs_versions_toml = "//tools:nongoogle.toml",
)
use_repo(maven, "external_deps")