infer-annotation bundled in SDK

[jrodbx]

Our CI environment highlighted the following transitive dependency being pulled in to our build:

-+--- com.bugsnag:bugsnag-android:4.5.0
-|    \--- com.android.support:support-annotations:27.0.0 -> 27.1.1
++--- com.bugsnag:bugsnag-android:4.6.0
+|    +--- com.android.support:support-annotations:27.0.0 -> 27.1.1
+|    \--- com.facebook.infer.annotation:infer-annotation:0.11.2
+|         \--- com.google.code.findbugs:jsr305:3.0.1

Here's the line in question:

bugsnag-android/sdk/build.gradle

Line 68 in 0200a0e

compile "com.facebook.infer.annotation:infer-annotation:0.11.2"

Since Infer is a static analyzer tool, might it be better to add it as a buildscript dependency or use a plugin like: https://github.com/uber-common/infer-plugin?

[fractalwrench]

Thanks for the report @jrodbx. Did you have specific concerns over the inclusion of this dependency, such as size, or just having one more artefact to download?

Uber's infer-plugin appears to be deprecated, but we can investigate forking the project or coming up with a similar solution that doesn't use a compile-time dependency.

[jrodbx]

The inclusion of the transitive dependency as it would also be bundled into our app, despite its sole function as a build time static analysis tool.

Oops, I missed that it's now deprecated. What about uber/nullaway? I'm exploring it myself for use in Picasso: https://github.com/square/picasso/compare/jrod/nullaway

[fractalwrench]

Got it. We'll investigate nullaway and a few other options - we are primarily interested in Infer for the thread-safety analysis.

One option might be specifying a custom annotation com.bugsnag.android, that can be substituted for @ThreadSafe using the Infer options. That could avoid adding Infer as a dependency in the release build, but would still document which classes should be Thread Safe.

Thanks for all your contributions to Picasso by the way :) that library has saved me from many painful hours of development!