Check if your npm dependencies are actually used

npm-check-used.sh

#!/bin/bash

# Run from your project's root
# Run "npm install" or "npm update" before
# Requirement: jq (https://stedolan.github.io/jq/)

required () {
	grep -R "from ['\"]${1}[\\/'\"]\|require(['\"]${1}[\\/'\"]" --exclude-dir=node_modules --include='*.js' > /dev/null
}

used_in_script () {
	# Use a temp file as "while … done" executes in a subprocess and any return or
	# local variable in there won't be passed to function's scope
	local tmp=$(tempfile)
	echo 1 > $tmp
	if jq -e 'has("scripts")' package.json > /dev/null; then
		# There are npm scripts, look into them (note: here we won't recursively parse referenced scripts)
		if jq -e 'has("bin")' "node_modules/$1/package.json" > /dev/null; then
			# dep has bins, check for them
			jq -r '.bin|keys|join("\n")' "node_modules/$1/package.json" | while read b; do
				if jq -r '.scripts|values|join("\n")' package.json | grep "\(^\|['\" ]\)$b\($\|['\" ]\)" > /dev/null; then
					echo 0 > $tmp
				fi
			done
		fi
		# All cases: check for direct reference (used as a plugin)
		if jq -r '.scripts|values|join("\n")' package.json | grep "\(['\" =]\)${1}\($\|['\" ]\)" > /dev/null; then
			echo 0 > $tmp
		fi
	fi
	local status=$(cat $tmp)
	rm -f $tmp
	return $status
}

check_used () {
	local tmp=$(tempfile)
	echo 0 > $tmp
	jq -r ".${1}|keys|join(\"\\n\")" package.json | while read p; do
		echo -e -n "\033[0m$p… "
		if required $p; then
			echo -e "\033[1K\033[0;32m\r$p used (required)."
		elif used_in_script $p; then
			echo -e "\033[1K\033[0;32m\r$p used (npm script)."
		else
			echo -e "\033[1K\033[1;31m\r$p unused?"
			echo 1 > $tmp
		fi
	done
	local status=$(cat $tmp)
	rm -f $tmp
	return $status
}

check_used_all () {
	local res=0

	echo -e "\033[;1m\nChecking dependencies…\n"
	if check_used "dependencies"; then
		echo -e "\033[1;32m\nEverything looks OK :)"
	else
		res=1
		echo -e "\033[1;31m\nSome packages looks like not being used (but I may have not detected them)"
		echo -e "\033[0mTo remove a package: npm remove --save <package>"
	fi

	echo -e "\033[;1m\nChecking devDependencies…\n"
	if check_used "devDependencies"; then
		echo -e "\033[1;32m\nEverything looks OK :)"
	else
		res=1
		echo -e "\033[1;31m\nSome packages looks like not being used (but I may have not detected them)"
		echo -e "\033[0mTo remove a package: npm remove --save-dev <package>"
	fi

	return $res
}

if check_used_all; then
	echo -e "\033[1;32m\nALL OK."
	exit 0
else
	echo -e "\033[1;31m\nCheck your dependencies…"
	exit 1
fi

since I don't have jq, I will probably try to port this script as a node.js script 😛

@lionelB jq is easy to install and very useful when working with json files ;) you should step in