Consider shading the JGit dependency in Grade plugin

[netvl]

Summary

In Gradle, all plugins share the same classpath. This makes it very hard, if not impossible, to use plugins which depend on different incompatible versions of the same library. This is the case with Spotless and GitPublish:

1. Spotless depends on 5.7.0.202003110725-r
2. GitPublish depends on the "latest release" version, which for the latest version of the plugin itself is 5.6.0.201912101111-r

Downgrading the JGit dependency in Spotless, I believe, is not an option, but maybe you could consider shading this dependency, building it into the Gradle plugin JAR file? I believe that the official Gradle guidelines recommend minimizing the number of external dependencies, and shading is one of the ways to mitigate issues like this one.

Gradle version

Happens with any Gradle version, including the latest one, 6.4.1

Spotless version

4.0.1

Operating system and version

Probably not relevant, but macOS 10.15.3

Spotless configuration

Having something as simple as

spotless {
    scala {
        scalafmt("2.3.2").configFile(layout.projectDirectory.file(".scalafmt.conf"))
    }
}

in the build configuration will reproduce the issue,.

Console errors

In all my test cases any Spotless tasks don't cause errors; exceptions can be observed when the GitPublish plugin is used, and they are generic class linkage errors which happen when binary incompatible libraries with the same class names are present in the one classpath.

[nedtwigg]

Hm, I thought Gradle had some classloader magic to isolate the plugins a bit, but such magic is always very fragile, so I don't doubt you!

The gradle plugin consists of three artifacts, lib with no dependencies, lib-extra with JGit and a few others, and then plugin-gradle which needs both of those.

I think it's good for lib to be pristine (allows people to build their own stuff and integrate easily), but I don't see any problem with shading everything else, including lib-extra, into plugin-gradle. Unless other contributors raise objections, I'd be happy to merge and release a PR that accomplished that.

[jbduncan]

I'm not personally using Spotless's internals like lib or lib-extra at this time, so I'm happy for any of the dependencies to be shaded into plugin-gradle. 👍

[nedtwigg]

As a workaround, you can try futzing with something like this:

buildscript {
  configurations.classpath {
    resolutionStrategy {
      force 'org.eclipse.jgit:org.eclipse.jgit:5.7.0.202003110725-r'
    }
  }
}

[michaelruocco]

The workaround listed above works fine for me, any plans for a more permanent fix?

[nedtwigg]

The permanent fix is to shade everything except lib into plugin-gradle. It's very low on my todo list, but happy to merge and release a PR for it.

[michaelruocco]

That is fair, it's not a huge issue, especially with the work around you have provided. I'll try and see if I can raise a PR if I can find the time to familiarise myself with the code base. Thanks.

[nedtwigg]

[editor's note: deleted a few off-topic comments to keep this issue focused on jgit shading and its workaround]

[netvl]

FWIW, I'm not quite sure how resolutionStrategy thing is a workaround - it will force another version, sure, but the issue with different plugins depending on different, binary incompatible versions of the same library remains: either spotless won't work, or gradle-git-publish (in this case).