This message was deleted.

other than trying to parse the build script manually of course

Perhaps create a BuildService; have your custom plugin register “blessed” dependencies there. On build events (build services can listen to these events), grab the dependencies used in a project and compare them.

that’s kinda sorta what i tried first - except my own plugin adds the dependencies i want to prevent people from adding manually, so the plugin ended up reporting its own actions as invalid

If you implement the BuildService, it would have an

internal

(Kotlin) method for the plugin itself to register approved dependencies (hence restricting anyone else from registering approved dependencies), and either a listener or another method for projects (consumers of the plugin) to register what they actually used (this is where the comparison of approved / used would take place).

oh! this seems so obvious in retrospect.