tree c4fc23f9a930bed2fcd32de138c499d0884e1212
parent 2134c3482c1382f85d05c38f010310de4e944cc3
author David Ostrovsky <david@ostrovsky.org> 1771076710 +0100
committer David Ostrovsky <david@ostrovsky.org> 1774088779 -0700

Add allowlist test for packaged runtime JARs

Track the set of third-party runtime dependencies that are bundled into
the oauth plugin by generating a deterministic manifest for
:oauth__plugin and diffing it against an allowlist in CI.

This prevents accidental changes to the packaged dependency set and
ensures that libraries already provided by Gerrit are not bundled into
the plugin.

Exclude org.slf4j:slf4j-api from the Maven dependencies since Gerrit
ships it, avoiding duplicate classes and potential version skew in the
plugin classloader.

Change-Id: I625bd7f0d4a29ff68996b295562b5349ef4b7c55