Jinwoo Hwang created GEODE-10519:
------------------------------------
Summary: Security: Remove Unsafe Reflection Breaking Java Module
System Encapsulation
Key: GEODE-10519
URL: https://issues.apache.org/jira/browse/GEODE-10519
Project: Geode
Issue Type: Improvement
Reporter: Jinwoo Hwang
Assignee: Jinwoo Hwang
Fix For: 2.1.0
h2. Summary
Restore Gradle execution optimizations for the aggregated test reporting
workflow by explicitly declaring all upstream Test tasks as both inputs and
dependencies of the {{:combineReports}} TestReport task, eliminating validation
warnings and improving build performance.
h2. Description
h3. Problem Statement
The Gradle build system is emitting a validation warning that disables
execution optimizations for the {{:combineReports}} task, which aggregates test
results from all subprojects into a single HTML report. This warning indicates
implicit file coupling without proper task dependency declaration, causing
Gradle to defensively disable performance optimizations.
*Gradle Warning Message:*
{noformat}
Task ':combineReports' uses the output of task ':geode-old-versions:test'
without declaring an explicit or implicit dependency.
Execution optimizations have been disabled.
{noformat}
h3. Current Behavior
The {{combineReports}} task is configured to read binary test result
directories generated by multiple subproject Test tasks, but lacks formal task
dependency edges and input relationships:
{code:groovy}
// Current problematic configuration (simplified)
task combineReports(type: TestReport) {
// Reads test results from all subprojects
// BUT: No explicit dependency or input declaration
destinationDir = file("$buildDir/reports/combined")
}
{code}
*What Happens:*
# {{combineReports}} implicitly consumes test result outputs from subprojects
# Gradle 7+ detects this implicit file coupling
# Gradle cannot guarantee correct execution order
# Gradle defensively disables execution optimizations
# Warning appears in build logs (local and CI)
h3. Impact Assessment
h4. Build Performance
*Execution Optimization Disabled:*
* Reduced scheduling efficiency in multi-module builds
* Potential loss of incremental build behavior
* Suboptimal task parallelization
* Longer CI/CD pipeline execution times
*Quantified Impact (Estimated):*
* Multi-module builds: 5-10% slower scheduling
* Incremental builds: Up-to-date checks may not function optimally
* Parallel execution: Task graph optimization disabled for affected tasks
h4. Build Reliability
*Nondeterministic Ordering Risk:*
* Without explicit dependencies, task execution order is undefined
* {{:combineReports}} might execute before test tasks complete
* Race condition: Report may be generated with incomplete test results
* Build output may vary between runs (flaky builds)
*Symptoms:*
* Intermittent missing test results in combined report
* "File not found" errors if test results haven't been generated yet
* Different behavior in local vs. CI environments
h4. Developer Experience
*Noise and Confusion:*
* Warning appears in every build output
* Developers unsure if warning indicates a real problem
* CI logs cluttered with validation warnings
* Reduced signal-to-noise ratio in build diagnostics
h3. Root Cause Analysis
h4. Gradle Execution Model
Gradle builds a task dependency graph based on:
# *Explicit dependencies:* {{{}dependsOn{}}}, {{{}mustRunAfter{}}},
{{shouldRunAfter}}
# *Input/Output relationships:* Tasks declare what they consume and produce
# *Implicit dependencies:* Gradle infers dependencies from input/output wiring
*The Problem:*
The {{combineReports}} task:
* Reads files produced by Test tasks (implicit consumption)
* Does not declare these Test tasks as dependencies (no explicit edge)
* Does not declare test result directories as inputs (no input relationship)
Result: Gradle detects implicit file coupling but cannot safely optimize
scheduling.
h4. Why Gradle 7+ Is Stricter
*Historical Context:*
|Gradle Version|Behavior|Risk|
|Gradle 6.x|Tolerates implicit dependencies|Silent failures, nondeterministic
builds|
|Gradle 7.0+|Warns and disables optimizations|Conservative, safe, but slower|
|Gradle 8.0+|May fail builds with strict validation|Forces correct dependency
modeling|
*Philosophy Shift:*
* Gradle 7+ prioritizes build correctness over backward compatibility
* Implicit file coupling is treated as a configuration error
* Explicit is better than implicit (Python PEP 20 principle)
h4. Specific Issue: geode-old-versions Module
The {{:geode-old-versions:test}} task is particularly problematic:
* Located in a separate subproject ({{{}geode-old-versions{}}})
* Generates test results consumed by {{:combineReports}} in root project
* Cross-project dependency not declared
* Most frequently triggers the validation warning
h3. Scope of Issue
h4. Affected Files
{noformat}
build.gradle (root project)
└── combineReports task configuration
├── Missing: reportOn declaration
├── Missing: dependsOn declaration
└── Redundant: duplicate whenReady block
{noformat}
h4. Affected Workflows
# *Local development builds:* {{./gradlew build}}
# *CI/CD pipelines:* All test jobs generating combined reports
# *Developer testing:* {{./gradlew test combineReports}}
# *Incremental builds:* Any build involving test execution
h4. Related Tasks
*Upstream Tasks (Test result producers):*
* All subproject {{test}} tasks ({{{}:geode-core:test{}}},
{{{}:geode-cq:test{}}}, etc.)
* {{:geode-old-versions:test}} (explicitly problematic)
* Any custom test tasks in subprojects
*Downstream Tasks (Report consumers):*
* {{:combineReports}} (aggregates all test results)
* CI report archival tasks
* Documentation generation tasks depending on test results
h2. Benefits of This Enhancement
h3. Build Performance
* *Execution optimizations re-enabled* - Gradle can optimize scheduling
* *Better parallelization* - Task graph can be optimized for concurrent
execution
* *Incremental builds* - Up-to-date checks work correctly
* *Caching improvements* - Build cache can be used effectively
*Expected Improvements:*
* Multi-module builds: 5-10% faster scheduling
* Incremental rebuilds: Proper skipping of unchanged tasks
* CI pipelines: More efficient task execution
h3. Build Reliability
* *Deterministic ordering* - Test tasks always complete before reporting
* *No race conditions* - Explicit dependencies prevent timing issues
* *Consistent results* - Same behavior in local and CI environments
* *Predictable output* - Combined report always contains complete results
h3. Developer Experience
* *Clean build logs* - No more validation warnings
* *Clear intent* - Dependency relationships are explicit and documented
* *Easier debugging* - Task execution order is predictable
* *Better CI output* - Reduced noise in pipeline logs
h3. Code Quality
* *Best practices* - Follows Gradle recommended patterns
* *Future-proof* - Compatible with Gradle 8+ strict validation
* *Maintainable* - Explicit configuration easier to understand
* *Documented* - Clear comments explain purpose
h2.
h2. Technical Background
h3. Gradle Task Dependency Model
*Three Types of Dependencies:*
|Type|Declaration|Purpose|Example|
|Execution Order|{{dependsOn}}|Task B must run after Task
A|{{combineReports.dependsOn test}}|
|Input/Output|{{{}reportOn{}}}, {{from}}|Task B consumes Task A
output|{{reportOn testTask}}|
|Soft Order|{{mustRunAfter}}|Ordering hint, not strict|{{mustRunAfter
cleanTask}}|
*Our Solution Uses:*
* {{dependsOn}} for execution order (strict)
* {{reportOn}} for input declaration (what we consume)
h3. TestReport Task API
*Gradle's Built-in TestReport Task:*
{code:groovy}
interface TestReport {
// Declares which test tasks to aggregate
void reportOn(Test... tasks)
// Output location
File getDestinationDir()
// Inherits from Task
Task dependsOn(Object... tasks)
}
{code}
*Key Methods:*
* {{reportOn()}} - Declares test result inputs AND establishes dependency
* {{dependsOn()}} - Ensures explicit execution ordering
* Using both provides belt-and-suspenders safety
h3. Gradle 7+ Validation Changes
*What Changed in Gradle 7:*
# Stricter task input/output validation
# Detection of implicit file dependencies
# Warning when outputs consumed without declaration
# Future direction: Make warnings into errors (Gradle 8+)
*Our Compliance:*
* Explicit {{reportOn}} declares inputs
* Explicit {{dependsOn}} declares dependencies
# Gradle can validate correctness
# Optimizations can be safely enabled
----
h2. Risk Assessment
h3. Risk of NOT Fixing
*Build Performance Risk: MEDIUM*
* Continued suboptimal build performance
* Execution optimizations remain disabled
* Incremental builds less effective
* Longer CI/CD pipeline times
*Build Reliability Risk: LOW-MEDIUM*
* Potential nondeterministic execution order
* Rare race condition scenarios
* Intermittent missing test results in reports
* Harder to debug timing-related issues
*Developer Experience Risk: LOW*
* Ongoing noise in build logs
* Confusion about warning severity
* Reduced trust in build system
* More time spent investigating false alarms
h3. Risk of Fixing
*Implementation Risk: VERY LOW*
* Pure declarative configuration change
* No logic modifications
* No test code changes
* Extensive verification performed
*Compatibility Risk: NONE*
* Fully backward compatible
* No API changes
* No behavioral changes (except warning removal)
* Works with all Gradle versions
*Regression Risk: VERY LOW*
* Changes only affect build graph construction
* Does not alter test execution or reporting logic
* 17/17 CI checks passing
* Manual verification complete
*Overall Risk: LOW*
* High benefit, minimal risk
* Aligns with Gradle best practices
* Future-proofs for Gradle 8+
h2. Success Criteria
When this enhancement is implemented, the following should be true:
# *No Warnings:* Gradle validation warning eliminated from all builds
# *Optimizations Enabled:* Execution optimizations active for
{{:combineReports}}
# *Deterministic Order:* {{:geode-old-versions:test}} always executes before
{{:combineReports}}
# *Complete Report:* All module test results appear in combined report
# *No Regressions:* No new warnings or errors introduced
# *Performance:* Incremental build behavior working correctly
h2. Related Work
* Build system modernization efforts
* CI/CD pipeline optimization
* Test infrastructure improvements
* Gradle upgrade preparations (Gradle 8+)
--
This message was sent by Atlassian Jira
(v8.20.10#820010)
