Play Framework

build: add ant audit-deps, a ratchet against unjustified jars in framework/lib

org.eclipse.jdt.core sat in lib/ from 2011, became redundant in 2023 when ecj
was listed beside it, and was still being re-resolved and re-vendored on every
JDT bump two years later. Nothing re-checked that a vendored jar was still
needed, and nothing recorded why any of them were there, so there was nothing
for the drift to contradict. This adds the check and the record.

A bare "unused jar" report is unusable here: 40 of 136 jars are unreachable
from the framework's own bytecode and all but three are demonstrably required.
Static analysis cannot see JNI natives (brotli4j, netty-quic, tcnative), a
driver named only in a config string (DBPlugin sets "org.postgresql.Driver"),
ServiceLoader bindings (log4j-slf4j2-impl, the JsonTemplateLayout behind
application.log.format=json), jars shipped for end-user applications to compile
against (junit-jupiter-engine, hamcrest), or code reached only from a module's
app/ tree — asm is used by modules/testrunner/app/controllers/TestRunner.java,
which ApplicationClassloader compiles at runtime and which therefore exists in
no analysable artifact at all.

So the question the check asks is not "is it used" but "has someone said why",
and dependencies-audit.conf is that answer. It fails on UNJUSTIFIED (unreachable
and unlisted), NO-CLASSES (an artifact carrying no bytecode, unless it is a
declared kmp-alias), and STALE-ENTRY (a pattern matching nothing — how the list
would otherwise rot when a dependency is dropped); it warns on REDUNDANT-ENTRY.
Three jars nobody could justify are recorded as category 'unverified' rather
than given an invented reason: dom4j, jandex and cglib are unreachable and
unreferenced by any other jar, and settling them needs a runtime class-load
census this pass does not do.

Analysis roots include each bundled module's jar, not just framework/classes:
jj-textile and jj-wikitext are reached only from docviewer, and auditing the
framework alone reports them as unused.

If jdeps fails or its output format moves, the tool refuses to report rather
than calling all 136 jars unused — the one failure mode that would make an
automated dependency audit actively dangerous.

Wired first in Buildfile: build.xml does not exist! so it fails fast; runs in seconds. All five gates were
exercised by hand (unjustified, stale, no-classes, bad category, malformed line)
and each exits non-zero with the offending file:line.

Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01JTvjeSmGVe7RFyx8ZJXRAx