[Feature]: Add CI step to check dependencies

[yurishkuro]

Recently we discovered several dependencies that were listed in the package.json but were not actually used (e.g. #1669, #1616, #1637). It would be good to have a CI-time check that would fail the CI when unused or missing dependencies are discovered.

I don't know if depcheck module is the best solution for this, but when I ran it in packages/jaeger-ui, it printed:

# ...jaeger-ui/packages/jaeger-ui 
$ depcheck
Unused dependencies
* @types/react-copy-to-clipboard
* @types/recompose
* d3-scale
* redux-async-middleware
* tar
Unused devDependencies
* @babel/preset-env
* @babel/preset-react
* @babel/preset-typescript
* @svgr/babel-plugin-transform-svg-component
* @svgr/babel-preset
* @types/react-dom
* @types/react-router-redux
* babel-plugin-inline-react-svg
* jest-environment-jsdom
* react-test-renderer
* source-map-explorer
Missing dependencies
* react-select: ./src/components/common/VirtSelect.tsx
* react-virtualized: ./src/components/common/VirtSelect.tsx

I don't think it's completely accurate, especially some of devDependencies may be used in the build configurations and are a false positive. Maybe it can be additionally tuned/configured, or perhaps we can add a dummy "tools.js" file that will import these modules so that they will not be flagged.

The new step should:

• run the check in both jaeger-ui and plexus workspaces
• fail if missing or unused dependencies are found
• before failing, print a recommendation on how to add or remove them, e.g. cd packages/jaeger-ui; yarn remove $pkg
• maybe it doesn't need to be a separate GH Action, but run as part of yarn lint

[yurishkuro]

@shubbham1215 I mean automatically invoke it when running yarn lint, then it will already be a part of CI

[anshgoyalevil]

@yurishkuro I have worked with this previously PalisadoesFoundation/talawa-admin#858 (comment) and the problem with that is it sometimes gives false positives.

[yurishkuro]

I think there are ways to deal with false positives. For example, if a package is only referenced in the linter configuration, will removing it fail the linter?

I can see writing a script that runs before depcheck, scans the other config files that depcheck does not understand, and generates a temporary exclusion file based on our understanding of those config files.

[anshgoyalevil]

As per my analysis:

Unused dependencies
* @types/react-copy-to-clipboard // Can be removed safely
* @types/recompose // Can be removed safely
* tar // False Positive (Being used inside the release.yml for packaging into tar)
Unused devDependencies
* @babel/preset-env // (false +ve)
* @babel/preset-react // (false +ve)
* @babel/preset-typescript // (false +ve. These babel plugins are being used inside babel-transform.js)
* @svgr/babel-plugin-transform-svg-component // can be removed
* @svgr/babel-preset // can be removed
* @types/react-dom // should not be removed, but unsure
* @types/react-router-redux //shouldn't be removed since we are using react-router-redux
* @types/testing-library__jest-dom //direct dep can be removed, as it is already a dep for jest-dom
* babel-plugin-inline-react-svg // false +ve
* jest-environment-jsdom // false +ve
Missing dependencies // can be ignored using --skip-missing
* react-is: ./src/utils/ReactShallowRenderer.test.js
* react-select: ./src/components/common/VirtSelect.tsx
* react-virtualized: ./src/components/common/VirtSelect.tsx
* _: ./build/static/index-21cea8b1.js

[yurishkuro]

tar // False Positive (Being used inside the release.yml for packaging into tar)

in release.yml we use tar the Unix utility, not tar the npm module.

[anshgoyalevil]

In that case, it can also be removed. Creating a PR to remove unused packages. Further, would create a script for detecting false positives.