lib: check that nongoogle.bzl doesn't grow new dependencies

Change-Id: Ie5fbd18de68fca13f954ef4d05ea7acc7d9cfea9

lib/BUILD

@@ -504,3 +504,9 @@ java_library(
     visibility = ["//visibility:public"],
     exports = ["@postgresql//jar"],
 )
+
+sh_test(
+    name = "nongoogle_test",
+    srcs = ["nongoogle_test.sh"],
+    data = ["//tools:nongoogle.bzl"],
+)

lib/nongoogle_test.sh

@@ -0,0 +1,17 @@
+#!/bin/sh
+
+# This test ensures that new dependencies in nongoogle.bzl go through LC review.
+
+set -eux
+
+bzl=$(pwd)/tools/nongoogle.bzl
+
+TMP=$(mktemp -d || mktemp -d -t /tmp/tmp.XXXXXX)
+
+grep 'name = "[^"]*"' ${bzl} | sed 's|^[^"]*"||g;s|".*$||g' | sort > $TMP/names
+
+cat << EOF > $TMP/want
+tukaani-xz
+EOF
+
+diff -u $TMP/names $TMP/want

tools/BUILD

@@ -4,6 +4,8 @@ load(
     "default_java_toolchain",
 )
 
+exports_files(["nongoogle.bzl"])
+
 py_binary(
     name = "merge_jars",
     srcs = ["merge_jars.py"],

tools/nongoogle.bzl

@@ -1,9 +1,11 @@
-load("//tools/bzl:maven_jar.bzl", "GERRIT", "MAVEN_LOCAL", "maven_jar")
+load("//tools/bzl:maven_jar.bzl", "maven_jar")
 
 def declare_nongoogle_deps():
     """loads dependencies that are not used at Google.
 
-    These are exempt from library compliance review.
+    Changes to versions are exempt from library compliance review. New
+    dependencies must pass through library compliance review. This is
+    enforced by //lib:nongoogle_test.
     """
 
     # Transitive dependency of commons-compress