ci: Replace depcheck with knip (#1294)

Due to the deprecation of depcheck we migrated to knip, which is in
active development and has more features. As a first step we only
activate the checking of unused dependencies except peer dependencies
(See comment in config). In the future we may also activate more rules
to improve code quality.

For monorepos it has to be run at root package level: [Knip
Monorepos](https://knip.dev/features/monorepos-and-workspaces).

The reason why we replaced the `docdash` jsdoc template path lookup in
the jsdoc script is that knip fails to detect that a dependency
(`jsdoc`) is used when a command inside of the package.json contains
JavaScript code (via sub-shell).

Also removes unused local-web-server dependency.

JIRA: CPOUI5FOUNDATION-1126

Author: werwolf2303

.github/workflows/github-ci.yml

@@ -56,7 +56,7 @@ jobs:
       run: npm run check-licenses
 
     - name: Perform dependency check
-      run: npm run depcheck
+      run: npm run knip
 
     - name: Run unit tests
       run: npm run coverage

internal/benchmark/package.json

@@ -11,18 +11,16 @@
 		"ui5-cli-benchmark": "./cli.js"
 	},
 	"scripts": {
-		"test": "npm run lint && npm run coverage && npm run depcheck",
+		"test": "npm run lint && npm run coverage",
 		"unit": "node --test 'test/e2e/**/*.js'",
 		"unit-watch": "node --test --watch 'test/e2e/**/*.js'",
 		"coverage": "node --test --experimental-test-coverage 'test/e2e/**/*.js'",
-		"lint": "eslint .",
-		"depcheck": "depcheck"
+		"lint": "eslint ."
 	},
 	"dependencies": {
 		"js-yaml": "^4.1.1"
 	},
 	"devDependencies": {
-		"depcheck": "^1.4.7",
 		"eslint": "^9.39.1"
 	}
 }

internal/documentation/package.json

@@ -24,22 +24,20 @@
 	"scripts": {
 		"start": "vitepress dev --open",
 		"lint": "eslint .",
-		"depcheck": "depcheck --ignores @ui5/documentation,vitepress,docdash,jsdoc,open-cli,handlebars,@types/node,@ui5/webcomponents,autoprefixer,cssnano,@theme/components",
 		"dev": "vitepress dev",
 		"build:vitepress": "vitepress build",
 		"build:assets": "sh -c 'DEST_DIR=${1:-./dist}; cp -r ./docs/images \"$DEST_DIR/images\"' --",
 		"preview": "vitepress preview --port 8080",
 		"jsdoc": "npm run jsdoc-generate && open-cli dist/api/index.html",
-		"jsdoc-generate": "jsdoc -c jsdoc/jsdoc-workspace.json -t $(node -p 'path.dirname(require.resolve(\"docdash\"))') ./ || (echo 'Error during JSDoc generation! Check log.' && exit 1)",
-		"jsdoc-generate-gh-pages": "jsdoc -c jsdoc/jsdoc.json -t $(node -p 'path.dirname(require.resolve(\"docdash\"))') ./ || (echo 'Error during JSDoc generation! Check log.' && exit 1)",
+		"jsdoc-generate": "jsdoc -c jsdoc/jsdoc-workspace.json -t $(npm ls docdash --parseable | head -1) ./ || (echo 'Error during JSDoc generation! Check log.' && exit 1)",
+		"jsdoc-generate-gh-pages": "jsdoc -c jsdoc/jsdoc.json -t $(npm ls docdash --parseable | head -1) ./ || (echo 'Error during JSDoc generation! Check log.' && exit 1)",
 		"generate-cli-doc": "node ./scripts/generateCliDoc.js",
 		"schema-generate": "node ./scripts/buildSchema.js",
 		"schema-generate-gh-pages": "node ./scripts/buildSchema.js gh-pages",
 		"download-packages": "./scripts/downloadPackages.sh"
 	},
 	"dependencies": {
 		"@types/node": "^25.2.2",
-		"@ui5/webcomponents": "^2.1.2",
 		"autoprefixer": "^10.4.20",
 		"cssnano": "^7.0.5",
 		"markdown-it-implicit-figures": "^0.12.0",

internal/shrinkwrap-extractor/package.json

@@ -19,12 +19,11 @@
 		"directory": "internal/shrinkwrap-extractor"
 	},
 	"scripts": {
-		"test": "npm run lint && npm run coverage && npm run depcheck",
+		"test": "npm run lint && npm run coverage",
 		"unit": "node --test test/lib/convertToShrinkwrap.js",
 		"unit-watch": "node --test --watch test/lib/convertToShrinkwrap.js",
 		"coverage": "node --test --experimental-test-coverage 'test/lib/convertToShrinkwrap.js'",
-		"lint": "eslint .",
-		"depcheck": "depcheck"
+		"lint": "eslint ."
 	},
 	"keywords": [
 		"npm",
@@ -44,7 +43,6 @@
 		"pacote": "^21.0.4"
 	},
 	"devDependencies": {
-		"depcheck": "^1.4.7",
 		"eslint": "^9.39.1"
 	}
 }

knip.config.js

@@ -0,0 +1,92 @@
+/**
+ * @type {import('knip').KnipConfig}
+ */
+const config = {
+	/**
+	 * We only need dependency checking at the moment,
+	 * so all checks except for dependencies are turned off.
+	 */
+	rules: {
+		files: "off",
+		duplicates: "off",
+		classMembers: "off",
+		unlisted: "off",
+		binaries: "off",
+		unresolved: "off",
+		catalog: "off",
+		exports: "off",
+		types: "off",
+		enumMembers: "off",
+		/**
+		 * We also ignore peer dependencies because @ui5/project
+		 * defines an optional peer dependency to @ui5/builder
+		 * which is needed and not an issue in our point of view.
+		 */
+		optionalPeerDependencies: "off"
+	},
+
+	ignoreDependencies: [
+		/**
+		 * Used via nyc ava --node-arguments="--experimental-loader=@istanbuljs/esm-loader-hook"
+		 * which is not detected by knip as a usage of this package
+		 */
+		"@istanbuljs/esm-loader-hook"
+	],
+
+	workspaces: {
+		".": {
+			ignoreDependencies: [
+				/**
+				 * Invoked manually via "npx husky" to install git hooks
+				 */
+				"husky"
+			]
+		},
+		"packages/cli": {
+			ignoreDependencies: [
+				/**
+				 * The package.json files of all @ui5/* packages are dynamically required for the "version" command
+				 * (See packages/cli/lib/cli/commands/versions.js)
+				 * Only @ui5/fs is not used anywhere else in the CLI package, so we need to ignore it here
+				 */
+				"@ui5/fs"
+			],
+			entry: [
+				/**
+				 * Commands are dynamically loaded via readdir (see packages/cli/lib/cli/cli.js)
+				 */
+				"lib/cli/commands/*.js"
+			]
+		},
+		"packages/server": {
+			/**
+			 * We ignore these dependencies here because these are dynamic imports
+			 * and knip is unable to detect that these are being used
+			 * (See packages/server/lib/middleware/MiddlewareManager.js)
+			 */
+			ignoreDependencies: [
+				"compression",
+				"cors"
+			]
+		},
+		"packages/*": {
+		},
+		"internal/documentation": {
+			ignoreDependencies: [
+				/**
+				 * Used in internal/documentation/postcss.config.js but can't be detected
+				 * as the plugin is dynamically applied based on NODE_ENV.
+				 */
+				"cssnano",
+				/**
+				 * Used as jsdoc template in package.json script, which is not detected
+				 */
+				"docdash"
+			]
+		},
+		"internal/*": {
+		}
+	}
+};
+
+module.exports = config;