fix: [SDK-4753] narrow overly broad consumer ProGuard/R8 keep rules

[abdulraqeeb33]

Problem

A developer ran Android's R8 Configuration Analyzer on their app and found that 3 of the top 5 sources of the broadest -keep rules in their final app came from OneSignal (reported against core-5.9.2). Our consumer rules shipped whole-package member keeps like:

-keepclassmembers class com.onesignal.core.** { *; }
-keepclassmembers class com.onesignal.notifications.** { *; }
...

These keep all members of all classes across nearly the entire SDK, blocking R8 from obfuscating and member-shrinking consumer apps that depend on OneSignal.

Note: the real consumer-facing rules live in each module's consumer-rules.pro (wired via consumerProguardFiles). The proguard-rules.pro files are the modules' own internal build config and are empty.

What changed (per module)

core/consumer-rules.pro

• Removed the six broad -keepclassmembers class com.onesignal.{core,session,user,internal,debug,common}.** { *; } rules.
• Added a constructor-only keep for com.onesignal.** (service impls are instantiated via reflective constructor selection in ServiceRegistrationReflection).
• Added a Model getter keep without allowobfuscation (*** get*(); + *** is*();) — Model.initializeFromJson matches getter method names via reflection, so getters must keep their names.
• Narrowed the IModule rule from { *; } to { <init>(); } (modules are loaded by FQN string via Class.forName(...).newInstance()).
• Kept the @KeepStub constructor rule as-is.
• Kept -dontwarn com.amazon.**; removed the blanket -dontwarn com.onesignal.**.

notifications/consumer-rules.pro

• Replaced -keepclassmembers class com.onesignal.notifications.** { *; } with a constructor-only keep.
• Tightened the NSE rule to also keep <init>() (resolved by name from manifest <meta-data> and newInstance()d).
• Collapsed the 15 per-class badger keeps into one implements Badger { <init>(...); } rule.
• Kept the WorkManager worker + InputMerger rules.
• Removed the dead -dontwarn com.onesignal.notification.** (wrong package — the package is notifications).
• Narrowed (not deleted) the risky rules: ADM ADMMessageHandler/ADMMessageHandlerJob and JobIntentService$* changed from {*;} to { <init>(...); }.
• Deleted the stale com.google.firebase.iid.FirebaseInstanceId and com.google.android.gms.common.api.GoogleApiClient keeps and the three consumer observer keeps (IPermissionObserver, IPushSubscriptionObserver, IUserStateObserver) — no main-source references found (FCM now uses FirebaseMessaging; observers are invoked through their interfaces so R8 keeps reachable overrides automatically). See Validation needed below.

in-app-messages/consumer-rules.pro

• Replaced { *; } with constructor-only keep; removed dead -dontwarn com.onesignal.iam.**.

location/consumer-rules.pro

• Replaced { *; } with constructor-only keep; removed -dontwarn com.onesignal.location.**.

otel/consumer-rules.pro — no change (only -dontwarn for optional Jackson/AutoValue; no shrinking impact).

Narrowed vs deleted

• Narrowed (cannot regress): all package member keeps → constructor-only; NSE; badgers; ADM handlers; JobIntentService$*; IModule.
• Deleted (needs validation): stale FirebaseInstanceId/GoogleApiClient keeps; the three observer keeps.

Build

./gradlew :onesignal:core:assemble :onesignal:notifications:assemble :onesignal:in-app-messages:assemble :onesignal:location:assemble :onesignal:otel:assemble → BUILD SUCCESSFUL (consumer-rules are merged at build time; only pre-existing Kotlin warnings remain). Consumer ProGuard/R8 rules are ultimately validated at the consuming app's R8 step, hence the checklist below. Spotless/detekt run in CI but do not apply to .pro files.

Validation needed (R8 full-mode sample-app smoke test)

Build a sample app with android.enableR8.fullMode=true + minifyEnabled true and verify:

• Notification receive + open (FCM)
• NSE (INotificationServiceExtension) resolved from manifest <meta-data>
• ADM path (Amazon device) — confirms narrowed ADM handler rules
• Notification badges (shortcut badger)
• Login / logout + operation persistence round-trip across an app restart (exercises Model.initializeFromJson getter-name reflection)
• IAM triggers
• Location updates
• Observer callbacks fire after deleting the observer keeps (IPermissionObserver, IPushSubscriptionObserver, IUserStateObserver)

References

• GitHub issue: [Feedback]: Overly broad ProGuard/R8 rules used throughout the library #2658
• Linear: SDK-4753

Do not merge until the R8 full-mode validation above is complete.

Made with Cursor

[github-actions]

📊 Diff Coverage Report

✓ Coverage check passed (no source files changed)

📥 View workflow run

[fadi-george]

One release-risk item to address before merge: the PR deletes the GoogleApiClient keep rule from notifications, but location still reflects on GMS methods by string in GoogleApiClientCompatProxy (blockingConnect, connect, disconnect). In a minified consumer app those methods may be renamed/stripped, silently breaking GMS location.
Can we move/add a targeted rule in location/consumer-rules.pro for those reflected GoogleApiClient methods?