[native_assets_builder] `build.dart` dependencies cannot be dev dependencies.

[dcharkes]

TODO for closing this issue: Add a check somewhere, or add documentation.

• lib/src/validator/strict_dependencies.dart should check dependencies in hook/ pub#4365
• Add hook/ to strict dependencies check pub#4364
• https://dart-review.googlesource.com/c/sdk/+/383301

Consider package:my_app depends on package:foo, and package:foo has a build.dart using package:http to download a dylib from a CIDN.

A. If package:foo would only add package:http as a dev dependency, then

1. (current behavior) the native assets builder will invoke the build.dart with the root package (package:my_app) package_config.json, and the build.dart invocation will fail, or
2. (possible alternative behavior) the native assets builder will run pub get inside the pub cache containing package:foo and use the resulting package config to run build.dart.

B. If package:foo adds package:http as a normal dependency, then

1. (current behavior) the native assets builder will invoke the build.dart with the root package (package:my_app) package_config.json, and the build.dart invocation will succeed.

So with the current setup, build.dart dependencies must be added as normal dependencies, not dev dependencies.

@jonasfj would probably not enjoy us running pub get inside the pub cache.

Switching to the alternative behavior A.2. enables various build.dart scripts to rely on incompatible versions of package:http.

However, build.dart does not need all the other dev dependencies, nor possibly the main dependencies. So this sounds like another hint in the direction of introducing build_dependencies.

• [new feature] build_dependencies pub#3794

Thanks for reporting @craiglabenz!

[dcharkes]

@jonasfj Do we have logic for checking somewhere that if you use a dev-dependency in lib/ instead of tool/ or test/ you get an error?

[jonasfj]

Yes, dart pub publish --dry-run should run some validators that check if dev_dependencies are used in lib/, etc.

See:
https://github.com/dart-lang/pub/blob/master/lib/src/validator/strict_dependencies.dart

[jonasfj]

@dcharkes it's possible that we do what to check this for hook/ too :D

[dcharkes]

@dcharkes it's possible that we do what to check this for hook/ too :D

I was going to suggest this!

[jonasfj]

Filed dart-lang/pub#4365

[jonasfj]

lol 🤣

[HosseinYousefi]

[sigurdm]

I ...think we have something corresponding in the analyzer as well...

Specifically https://dart.dev/tools/linter-rules/depend_on_referenced_packages most likely need adjusting too.

I think the definition of isInPublicDir that is defined here:

https://github.com/dart-lang/sdk/blob/4babb9deb1c74e3fa23587a0cd2f9aa7c607fffa/pkg/linter/lib/src/ast.dart#L163

and referenced here:

https://github.com/dart-lang/sdk/blob/1f4f0d386a9095fc788f53b0a98d0069bcabc800/pkg/linter/lib/src/rules/pub/depend_on_referenced_packages.dart#L78

needs an update to include files in the hooks folder.