Warn about unreachable cookbooks in Policyfile

[KrisShannon]

Description

A policyfile compile (e.g. chef install or chef update) should warn about cookbooks that have been included in the policy but are not reachable via dependencies of the cookbooks mentioned in the run lists.

See this discussion in the Chef Community Slack Channel - #policyfile - 26th Feb 2019 9:39pm UTC

[KrisShannon]

I'll try to find the time next week to code up a pull request.

[lamont-granquist]

So this takes the run_lists in the policy, expands the run_lists, then takes the set difference and finds if there are stray cookbooks in the policy set?

I'm still a little unclear how that happens in practice even after reading the slack channel. You must have a Policyfile.rb which is listing cookbooks which forces them into the set, but then you're missing a depends line in a metadata.rb somewhere?

There's a higher level issue going on here which is that the cookbooks listed in the Policyfile.rb should really only be the cookbook that the Policyfile.rb is in (if it is a cookbook-policy) or should be limited to the cookbooks explicitly in the run_list(s). A lot of people start doing the work of the depsolver and manually including all their cookbooks in the Policyfile.rb, somehow we should either warn on that or lint on that (of course git overrides could still be necessary for transitive deps though so the problem gets a bit more complicated).

[KrisShannon]

Yes. The idea was that if you have included a cookbook in the policyfile but have not updated the metadata.rb to include it then we should be able to give a warning during policyfile compilation possibly with a hint that it should be added to a metadata.rb file in the cookbook that requires it.

I have seen this exact issue come up a number of times, often exactly as it happened in the linked conversation.

Someone adds the cookbook to the policyfile, and then tries to use it in an include_recipe without adding it to metadata.rb.

They will already get a MissingCookbookDependency warning during converge but are still often confused.

There may also be a case for improving the documentation.

[KrisShannon]

A lot of people start doing the work of the depsolver and manually including all their cookbooks in the Policyfile.rb, somehow we should either warn on that or lint on that.

I agree that would be great if we could, but as you mention there are legitimate reasons to be explicit about a specific dependency.

Maybe this is the information that really needs hilighting in the documentation.

[tyler-ball]

Moved this to the chef-cli repo. It seems like there are a few issues here that we need to address:

1. Cookbook dependencies should be managed in the metadata.rb and only added to the Policyfile.rb to override the location they come from (EG, pulling all cookbooks from Supermarket except 1 that is pulled from Github).

2. If users add cookbooks to their Policyfile.rb that are not used in any of the run_lists, they should get a warning or linting error

3. Someone adds the cookbook to the policyfile, and then tries to use it in an include_recipe without adding it to metadata.rb.

   In this case we should warn users to add the cookbook to the metadata.rb instead of the Policyfile.rb