feat: unmanaged dependency check

[JoeWang1127]

Implement an unmanaged dependency check, part of dependency governance project.

[suztomo]

Todo:

• To add action.yml a BOM directory is an input.
• Use the action.yml against https://github.com/googleapis/sdk-platform-java/tree/main/gapic-generator-java-bom
• Add an unmanaged dependency to https://github.com/googleapis/sdk-platform-java/blob/main/gax-java/gax-grpc/pom.xml to see the check fails (within this pull request).

Until the design doc is approved, leave this pull request as failed state in draft.

To recover from the failure: Assuming the (unmanaged) dependency went through the governance process,

• Add the unmanaged dependency to the shared dependencies BOM in the same pull request 2223. The check now should become green.

(Before merging this 2223, we'll revert the edits in the shared dependencies BOM and gax-java/gax-grpc/pom.xml.)

[JoeWang1127]

In order to fail the check, an unmanaged dependency has to be added in the target bom, not the dependency of this bom.
In this case, an unmananged dependency has to be added in gapic-generator-java-bom/pom.xml, but not in gax-java/gax-grpc/pom.xml, which is a transitive dependency of gapic-generator-java-bom/pom.xml.

The check needs to update.

I added a dependency in gapic-generator-java-bom/pom.xml but the check is successful (it shouldn't)

Run unmanaged_dependencies=$(mvn exec:java -Dexec.args="3.20.0 ../../gapic-generator-java-bom/pom.xml" -q)
  unmanaged_dependencies=$(mvn exec:java -Dexec.args="3.20.0 ../../gapic-generator-java-bom/pom.xml" -q)
  echo "${unmanaged_dependencies}"
  if [[ "${unmanaged_dependencies}" != "[]" ]]; then
    echo "${unmanaged_dependencies}"
    exit 1
  fi
  shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
  env:
    JAVA_HOME: /opt/hostedtoolcache/Java_Temurin-Hotspot_jdk/11.0.21-9/x64
    JAVA_HOME_11_X64: /opt/hostedtoolcache/Java_Temurin-Hotspot_jdk/11.0.21-9/x64
    shared_dependencies_version: 3.20.0
[]

When tested locally:

joewa-macbookpro:unmanaged-dependency-check joewa$ echo "${unmanaged_dependencies}"
[com.h2database:h2]

[sonarcloud]

Quality Gate passed for 'gapic-generator-java-root'

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud

[sonarcloud]

Quality Gate passed for 'java_showcase_integration_tests'

Kudos, no new issues were introduced!

0 New issues
0 Security Hotspots
No data about Coverage
No data about Duplication

See analysis details on SonarCloud