Add plugins/packages analyze step after `pub downgrade`

[stuartmorgan-g]

Since CI always runs in a clean environment, we never catch issues like flutter/plugins#6202 where we forget to update a minimum dependency version. We should add a new step (similar to the legacy analyze step or the path-based analyze step) where we pub downgrade before running pub analyze to make sure our minimums are correct.

[CicadaCinema]

Finding bugs like this is actually part of my GSOC project for Dart! Sometimes when the package in question has a lot of dependencies, they will prevent pub downgrade from fetching the minimum version. This also applies to dev dependencies, which (I presume) are downloaded during CI, but not when a user consumes the package. Don't know if you can work around this, but it's what I've found!

However, at least in the case of flutter/plugins#6202 it looks like running pub downgrade before the analysis step would have actually caught the bug.

[stuartmorgan-g]

Your PRs are what inspired this, so they are much appreciated :) They highlighted that this was really a pattern of mistake, not something one-off, which made me think about how to prevent it systematically.

This also applies to dev dependencies, which (I presume) are downloaded during CI, but not when a user consumes the package.

That's a really interesting point; I hadn't considered that. We should be able to work around it by, instead of running analyze, doing:

• flutter create a_dummy_app
• flutter pub add plugin_to_test
• flutter pub downgrade
• flutter build <some platform>

That would be significantly more expensive to run though, and in practice I think the simple solution will work in the vast majority of cases (since we're most likely to hit this with our federated plugins where we have a lot of API churn in dependencies).

If the goal is to eventually have pub.dev and/or PANA do this though, that (or an equivalent approach for non-Flutter packages) could be an interesting route to explore.

[Edit: technically you'd want to do all of that with the minimum version of Flutter supported by the package, because in theory the same problem this is trying to avoid with dev_dependencies could happen with things that are pinned by the Flutter SDK, and those version will be lower in older Flutter versions.]

[CicadaCinema]

If the goal is to eventually have pub.dev and/or PANA do this though, that (or an equivalent approach for non-Flutter packages) could be an interesting route to explore.

Yes, that's what I'm working on - you can see the current progress here and here if you like. I run my analysis against individual dependencies (pinned to their minimum allowed versions by a dummy package) to see if they provide the necessary symbols to the target package. (And I don't consider the Flutter SDK, or anything which isn't a dependency on pub.dev for that matter)

Currently quite a handful of the detections have come from packages in https://github.com/flutter/plugins , so it'll be interesting to see how this new step in the CI changes this.

[github-actions]

This thread has been automatically locked since there has not been any recent activity after it was closed. If you are still experiencing a similar issue, please open a new bug, including the output of flutter doctor -v and a minimal reproduction of the issue.