check for newly added deps in config file that aren't level 0 in the lock

2 files changed, 37 insertions, 12 deletions

diff --git a/src/rebar3.erl b/src/rebar3.erl
index 268be68..03b7b98 100644
--- a/src/rebar3.erl
+++ b/src/rebar3.erl
@@ -142,15 +142,7 @@ init_config() ->
                      rebar_config:consult_file(ConfigFile)
              end,
 
-    Config1 = case rebar_config:consult_file(?LOCK_FILE) of
-                  [D] ->
-                      %% We want the top level deps only from the lock file.
-                      %% This ensures deterministic overrides for configs.
-                      Deps = [X || X <- D, element(3, X) =:= 0],
-                      [{{locks, default}, D}, {{deps, default}, Deps} | Config];
-                  _ ->
-                      Config
-              end,
+    Config1 = rebar_config:merge_locks(Config, rebar_config:consult_file(?LOCK_FILE)),
 
     %% If $HOME/.rebar3/config exists load and use as global config
     Home = rebar_dir:home_dir(),
@@ -229,8 +221,6 @@ version() ->
     ?CONSOLE("rebar ~s on Erlang/OTP ~s Erts ~s",
              [Vsn, erlang:system_info(otp_release), erlang:system_info(version)]).
 
-
-
 %% TODO: Actually make it 'global'
 %%
 %% set global flag based on getopt option boolean value
diff --git a/src/rebar_config.erl b/src/rebar_config.erl
index 949d6d4..43730ea 100644
--- a/src/rebar_config.erl
+++ b/src/rebar_config.erl
@@ -27,7 +27,9 @@
 -module(rebar_config).
 
 -export([consult/1
-        ,consult_file/1]).
+        ,consult_file/1
+
+        ,merge_locks/2]).
 
 -include("rebar.hrl").
 
@@ -58,6 +60,18 @@ consult_file(File) ->
             end
     end.
 
+merge_locks(Config, []) ->
+    Config;
+merge_locks(Config, [Locks]) ->
+    {deps, ConfigDeps} = lists:keyfind(deps, 1, Config),
+    %% We want the top level deps only from the lock file.
+    %% This ensures deterministic overrides for configs.
+    %% Then check if any new deps have been added to the config
+    %% since it was locked.
+    Deps = [X || X <- Locks, element(3, X) =:= 0],
+    NewDeps = find_newly_added(ConfigDeps, Locks),
+    [{{locks, default}, Locks}, {{deps, default}, NewDeps++Deps} | Config].
+
 %% ===================================================================
 %% Internal functions
 %% ===================================================================
@@ -84,3 +98,24 @@ bs(Vars) ->
     lists:foldl(fun({K,V}, Bs) ->
                         erl_eval:add_binding(K, V, Bs)
                 end, erl_eval:new_bindings(), Vars).
+
+%% Find deps that have been added to the config after the lock was created
+find_newly_added(ConfigDeps, LockedDeps) ->
+    [Dep || Dep <- ConfigDeps,
+            begin
+                NewDep = ec_cnv:to_binary(element(1, Dep)),
+                case lists:keyfind(NewDep, 1, LockedDeps) of
+                    false ->
+                        true;
+                    Match ->
+                        case element(3, Match) of
+                            0 ->
+                                true;
+                            _ ->
+                                ?WARN("Newly added dep ~s is locked at a lower level. "
+                                     "If you really want to unlock it, use 'rebar3 upgrade ~s'",
+                                     [NewDep, NewDep]),
+                                false
+                        end
+                end
+            end].