[alexander-yevsyukov]

What

Declares io.spine.dependency.lib.OpenTelemetryKotlin in buildSrc —
io.opentelemetry.kotlin 0.4.0, modules api, noop, core,
implementation, compat.

Why

core-jvm declared this object in its own copy of buildSrc (added by
core-jvm@e46a9a04, "Draft server-otel module"); config has never had it —
git log -S"OpenTelemetryKotlin" over the whole repository is empty. The
server-otel module imports it:

import io.spine.dependency.lib.OpenTelemetryKotlin
...
api(OpenTelemetryKotlin.api)

ConfigTester renames the repository's buildSrc to buildSrc-original and
copies this one in its place, so under buildDependants the declaration
disappears and server-otel/build.gradle.kts fails to compile with four
Unresolved reference 'OpenTelemetryKotlin' errors. That is the last repository
failing a buildDependants run (base and base-types pass, the latter with
SpineEventEngine/base-types#56).

Upstreaming makes config the owner of the declaration: the test build of
core-jvm compiles, the artifact comes under the dependency-update sweep —
which never saw the consumer-local copy — and core-jvm's next ./config/pull
overwrites its copy with an identical file instead of leaving two sources of
truth.

The version stays at 0.4.0, the one core-jvm's sources compile against,
with a comment saying so. Maven Central is at 0.9.0; the project is alpha and
publishes no BOM, so that bump belongs in a dependency-update pass made with
the consuming code at hand, not here.

The wider hazard

A consumer that adds a dependency object to its own buildSrc carries a change
no one upstream knows about. Worth noting that ./config/pull and the tester
differ here: migrate installs buildSrc with cp -R buildSrc .., which
overlays and therefore leaves consumer-local extras in place, whereas the
tester replaces the folder wholesale. So a file like this survives a pull but
fails the integration test — the test is the stricter of the two, and it is what
surfaced this. Both readings point the same way: a dependency object belongs in
config.

Verification

• ./gradlew detekt — green. This also compiles buildSrc, where the new file
  lives; the root project has no build or dokkaGenerate task.
• All five modules confirmed published at 0.4.0 on Maven Central.
• io.opentelemetry.kotlin.ExperimentalApi and the createOpenTelemetry { }
  entry point in implementation (not core) were checked against the
  published 0.4.0 artifacts, so the KDoc claims hold.
• Not verified end to end: clean buildDependants was not re-run for this
  change. It needs Fix the buildDependants task #805 (the tester fix) and base-types#56 merged, or a worktree
  that stacks all three.

Review note

dependency-audit and kotlin-engineer both flagged that the versioned
constants (val api = "$group:api:$version") cannot be looked up through
Dependency.artifact { }, whose artifacts map is keyed by the versionless
modules entries, and asked for versionless constants instead. Deliberately not
done here:

• Compiler, Time, Kotlin, Jackson, JacksonV2 and JUnit in this same
  tree already pair versioned convenience properties with a versionless
  modules list; artifact { } is the idiom of the other group (Ksp,
  PalantirJavaFormat). Nothing in config calls it on this object.
• forceArtifacts and artifacts read modules, which is versionless and
  correct, so forcing works.
• Making the constants versionless would break api(OpenTelemetryKotlin.api) in
  core-jvm — the build this change exists to fix.

Picking one of the two idioms for the whole catalogue is a separate change.

🤖 Generated with Claude Code

[chatgpt-codex-connector]

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-19T15:14:16.237996Z	e062788	New commits

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

• Open a pull request for review
• Mark a draft as ready
• Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

[Copilot]

🟢 Approved

The declaration matches existing catalogue patterns and consumer usage, with no blocking issues identified; end-to-end verification remains outstanding.

No open issues 🎉

What changed in this PR

Adds OpenTelemetryKotlin to the shared dependency catalogue so replacing consumer buildSrc no longer removes the declaration needed by core-jvm.

Changes:

• Declares five OpenTelemetry Kotlin modules pinned to version 0.4.0.
• Documents experimental API requirements and module roles.

File	Description
buildSrc/​src/​main/​kotlin/​io/​spine/​dependency/​lib/​OpenTelemetryKotlin.kt	Adds shared dependency coordinates and usage documentation.

_{Review effort: Balanced}