feat: support transitive dependencies in BGP (RNC-CLI path)

[KisaneNeko]

Summary

Adds an opt-in includeTransitiveDependencies option to the Brownfield Gradle Plugin. When a vanilla (non-Expo) brownfield app turns it on, BGP discovers the real third-party dependencies of its embedded native modules and publishes them into the AAR's POM/Gradle Module Metadata, so a consuming native app resolves them automatically instead of the host team having to hand-declare them. Mirrors the mechanism Expo projects already get unconditionally.

Notion ticket: Brownfield: support transitive dependencies in BGP

What's in this PR

• New includeTransitiveDependencies option on reactBrownfield { }
• Shared POM/module.json injector extracted out of the Expo-only code path (no behavior change for Expo)
• New discoverer for the RNC path, with day-1 handling for dynamic/versionless dependency coordinates
• Enabled in the RNApp demo, hand-rolled workaround removed
• Also fixes a real, pre-existing bug on the Expo side: appendExpoTransitiveDependenciesFromGradle was checking for a Gradle configuration named "runtime", which doesn't actually exist on modern AGP modules (the real name is "runtimeOnly") — so that fallback path has been silently skipping runtimeOnly dependencies since feat: expo config plugin #223. Fixed and added a regression test for it.

Testing

Verified locally: real Maven-local publish for both RNApp and ExpoApp57, inspected the generated POM/module.json (confirmed a genuinely new dependency gets injected, embedded modules stay excluded, dynamic-version coordinates get filtered), built the vanilla AndroidApp flavor against it, ran the existing Detox suites for both vanilla and Expo — all green.

Added unit tests for this, not the usual pattern in this repo, but they cover an actual bug I spotted and fixed in the Expo implementation so maybe they are worth to keep. Let me know what you think.

[Copilot]

🟡 Changes recommended

A critical compilation issue and unresolved dependency discovery and publication correctness issues remain.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Adds opt-in transitive dependency discovery and publication for vanilla Brownfield projects, shares publishing logic with Expo, and fixes Expo runtimeOnly fallback handling.

Changes:

• Adds RNC dependency discovery, filtering, mediation, and metadata injection.
• Enables the option in RNApp and removes the manual workaround.
• Adds tests, documentation, and CI coverage.

File summaries

File	Reviewed changes
gradle-plugins/react/brownfield/src/test/kotlin/com/callstack/react/brownfield/utils/ExtensionTest.kt	Tests the option default.
gradle-plugins/react/brownfield/src/test/kotlin/com/callstack/react/brownfield/shared/VersionMediatingDependencySetTest.kt	Tests dependency version mediation.
gradle-plugins/react/brownfield/src/test/kotlin/com/callstack/react/brownfield/shared/DependencyPublishabilityTest.kt	Tests dependency coordinate filtering.
gradle-plugins/react/brownfield/src/test/kotlin/com/callstack/react/brownfield/expo/ExpoPublishingHelperGradleFallbackTest.kt	Covers runtimeOnly discovery.
gradle-plugins/react/brownfield/src/test/kotlin/com/callstack/react/brownfield/artifacts/RncTransitiveDependencyDiscovererTest.kt	Tests RNC dependency discovery.
gradle-plugins/react/brownfield/src/main/kotlin/com/callstack/react/brownfield/utils/Extension.kt	Adds the opt-in configuration option.
gradle-plugins/react/brownfield/src/main/kotlin/com/callstack/react/brownfield/shared/VersionMediatingDependencySet.kt	Provides shared dependency mediation.
gradle-plugins/react/brownfield/src/main/kotlin/com/callstack/react/brownfield/shared/PublishingMetadataInjector.kt	Injects dependencies into publication metadata. Final note: moderate (2 votes)—the metadata path is publication-name specific.
gradle-plugins/react/brownfield/src/main/kotlin/com/callstack/react/brownfield/shared/GradleDependencyCollector.kt	Collects Gradle dependencies. Final note: moderate (1 vote)—runtimeOnly is published as compile.
gradle-plugins/react/brownfield/src/main/kotlin/com/callstack/react/brownfield/shared/DependencyPublishability.kt	Filters dependency versions. Final note: moderate (3 votes)—latest.* and Maven ranges are not rejected.
gradle-plugins/react/brownfield/src/main/kotlin/com/callstack/react/brownfield/shared/DependencyInfo.kt	Defines shared dependency data.
gradle-plugins/react/brownfield/src/main/kotlin/com/callstack/react/brownfield/shared/Constants.kt	Updates shared imports.
gradle-plugins/react/brownfield/src/main/kotlin/com/callstack/react/brownfield/plugin/RNBrownfieldPlugin.kt	Integrates discovery and metadata publishing. Final notes: critical (1 vote)—nullable captured var does not compile; moderate (1 vote)—embedded projects may not be evaluated; nit (1 vote)—Expo discovery runs twice.
gradle-plugins/react/brownfield/src/main/kotlin/com/callstack/react/brownfield/expo/utils/BrownfieldPublishingInfo.kt	Restores Expo publishing data.
gradle-plugins/react/brownfield/src/main/kotlin/com/callstack/react/brownfield/expo/ExpoPublishingHelper.kt	Uses shared collection and discovery logic.
gradle-plugins/react/brownfield/src/main/kotlin/com/callstack/react/brownfield/artifacts/RncTransitiveDependencyDiscoverer.kt	Discovers vanilla module dependencies. Final notes: moderate (1 vote)—embedded-project evaluation may race collection; moderate (1 vote)—same-coordinate dependencies can be skipped before mediation.
gradle-plugins/react/brownfield/gradle/libs.versions.toml	Adds JUnit dependency versions.
gradle-plugins/react/brownfield/build.gradle.kts	Configures unit testing.
docs/docs/docs/getting-started/android.mdx	Documents the new option. Final note: nit (1 vote)—the troubleshooting guide also needs updating.
apps/RNApp/android/BrownfieldLib/build.gradle.kts	Enables transitive publishing and removes the workaround.
.gitignore	Ignores internal artifacts.
.github/workflows/gradle-plugin-lint.yml	Runs Gradle plugin tests.
.github/workflows/ci.yml	Includes plugin changes in app builds.

Review details

Suppressed comments (6)

docs/docs/docs/getting-started/android.mdx:346

• The new opt-in is not reflected in docs/docs/docs/guides/troubleshooting.mdx, which still says bare React Native transitive dependencies are not auto-resolved and instructs users to hand-declare them. Update that guide so users are directed to includeTransitiveDependencies and the manual workaround is reserved for projects that intentionally leave the option disabled.

> **Transitive dependencies:** the task-registration block above strips embedded-module entries from the generated POM by hand. If you don't need your embedded modules' own third-party dependencies to be resolvable by the app consuming this AAR, that manual block is all you need — skip the rest of this note.
>
> If you *do* want that (e.g. your embedded native modules pull in AndroidX libraries the consuming app should get automatically via Maven), set `includeTransitiveDependencies = true` in this module's `reactBrownfield { }` block instead of hand-rolling the JSON-manipulation task above — the plugin now performs the equivalent removal *and* injects your modules' real dependencies for you:
>
> ```kotlin
> reactBrownfield {
>     includeTransitiveDependencies = true
> }

gradle-plugins/react/brownfield/src/main/kotlin/com/callstack/react/brownfield/artifacts/RncTransitiveDependencyDiscoverer.kt:43

• This filters only by group/artifact, so it drops an embedded module's higher requirement whenever BrownfieldLib already declares the same coordinate at a lower or dynamic version. For example, an existing appcompat:1.6.0 declaration causes a module's appcompat:1.7.1 to be discarded before VersionMediatingDependencySet can mediate it, leaving the published POM at 1.6.0 and allowing a consumer to resolve below the module's requirement. Compare versions here, or merge and replace the existing publication entry with the mediated version instead of skipping unconditionally.

            .filterNot { isAlreadyDeclaredByConsumer(it.groupId, it.artifactId) }
            .forEach { discovered.add(it) }

gradle-plugins/react/brownfield/src/main/kotlin/com/callstack/react/brownfield/artifacts/RncTransitiveDependencyDiscoverer.kt:43

• afterEvaluate only guarantees that the Brownfield project has finished evaluation; it does not wait for each autolinked moduleProject returned by findProject. If a native module is evaluated later in the multi-project build, its implementation/api declarations are still absent here and the dependency is silently omitted from the published metadata. Ensure the embedded projects are evaluated before collection (or defer discovery until their evaluation callbacks have run).

        collectPublishableGradleDependencies(moduleProject)
            .filterNot { isAlreadyDeclaredByConsumer(it.groupId, it.artifactId) }
            .forEach { discovered.add(it) }

gradle-plugins/react/brownfield/src/main/kotlin/com/callstack/react/brownfield/plugin/RNBrownfieldPlugin.kt:84

• ExpoPublishingHelper.configure() still calls discoverAllExpoTransitiveDependencies for logging, and this new callback calls the same discovery again. Expo builds therefore parse the same POMs/configurations twice during configuration, adding avoidable work and duplicating any discovery failures; cache the first result or remove one of the calls.

                val expoTransitiveDeps = expoPublishingHelper.discoverAllExpoTransitiveDependencies(expoProjects)

gradle-plugins/react/brownfield/src/main/kotlin/com/callstack/react/brownfield/plugin/RNBrownfieldPlugin.kt:90

• This discovery runs from afterEvaluate on the Brownfield library, but findProject does not evaluate the embedded module. If an autolinked module is evaluated later, its implementation/api/runtimeOnly declarations are still unpopulated here and the code silently publishes no dependencies for that module. Ensure the embedded projects are evaluated before collecting their configurations, or defer discovery until project evaluation is complete.

            if (extension.includeTransitiveDependencies) {
                val rncTransitiveDeps = RncTransitiveDependencyDiscoverer(project).discover(artifacts)
                Logging.log("Merged ${rncTransitiveDeps.size} transitive dependencies discovered by the RNC discoverer")

gradle-plugins/react/brownfield/src/main/kotlin/com/callstack/react/brownfield/shared/GradleDependencyCollector.kt:34

• fromGradleDep hard-codes every discovered dependency to compile, so the newly supported runtimeOnly configuration is published in the POM as a compile dependency. That unnecessarily puts runtime-only libraries on the consuming app's compile classpath and changes their intended API visibility; preserve the configuration's runtime scope when constructing DependencyInfo.

    TRANSITIVE_DEPENDENCY_CONFIG_NAMES.forEach { configName ->
        val configuration = project.configurations.findByName(configName) ?: return@forEach

        configuration.dependencies.forEach { dependency ->
            if (dependency is DefaultProjectDependency) return@forEach
            val group = dependency.group ?: return@forEach

            val info = DependencyInfo.fromGradleDep(group, dependency.name, dependency.version)
            if (isPublishableCoordinate(info)) result.add(info)

• Files reviewed: 22/23 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[hurali97]

Great work with the PR 🚀 Left some comments, please also review the Copilot's comments.

[hurali97]

This register a task in afterEvaluate which in most cases is discouraged. From the implementation here, we can see that it reads a file and then applies operations. It also uses a doLast block to conduct this operation.

I believe this provides us structure and enough information to register this task with inputs in the configuration phase, so before/outside of afterEvaluate.

[hurali97]

Let's default to true and rename/mark this as experimental.