# Package validation

The packages in `pkg/` are automatically validated on the LUCI CI bots. The
validation is largely done by the `tools/package_deps` package; it can be tested
locally via:

```
dart tools/package_deps/bin/package_deps.dart
```

## Packages which are published

There are several packages developed in `pkg/` which are published to pub.
Validation of these packages is particularly important because the pub tools are
not used for these packages during development; we get our dependency versions
from the DEPS file. Its very easy for the dependencies specified in a package's
pubspec file to get out of date wrt the packages and versions actually used.

In order to better ensure we're publishing correct packages, we validate some
properties of the pubspec files on our CI system. These validations include:

- that the dependencies listed in the pubspec are used in the package
- that all the packages used by the source are listed in the pubspec
- that we don't use relative path deps to pkg/ or third_party/ packages

## Packages which are not published

For packages in pkg/ which we do not intend to be published, we put the
following comment in the pubspec.yaml file:

```
# This package is not intended for consumption on pub.dev. DO NOT publish.
publish_to: none
```

These pubspecs are still validated by the package validation tool. The contents
are more informational as the pubspecs for these packages are not consumed by
the pub tool or ecosystem.

We validate:
- that the dependencies listed in the pubspec are used in the package
- that all the packages used by the source are listed in the pubspec
- that a reference to a pkg/ package is done via a relative path dependency