From e14406dc8ae539620992939c0a9bcb907a9d63e7 Mon Sep 17 00:00:00 2001 From: Nelson Osacky Date: Wed, 3 Jun 2026 17:29:16 +0200 Subject: [PATCH 1/5] build(plugin): Add dependency locking and verification (GRADLE-104) Pin the transitive dependencies of the published plugin build to harden against supply-chain risk. Gradle dependency locking records resolved versions in a lockfile and fails the build (STRICT mode) on unexpected drift, while dependency verification checks a SHA-256 checksum for every resolved artifact. Scoped to plugin-build only, the build that produces the shipped artifact. The metadata captures the formatter (spotless), docs (dokka), and publish tooling in addition to the project configurations, so the existing CI enforces both controls without new workflow steps. Co-Authored-By: Claude Opus 4.8 (1M context) --- CHANGELOG.md | 4 + plugin-build/build.gradle.kts | 12 + plugin-build/gradle.lockfile | 225 ++ plugin-build/gradle/verification-metadata.xml | 3262 +++++++++++++++++ plugin-build/settings-gradle.lockfile | 4 + 5 files changed, 3507 insertions(+) create mode 100644 plugin-build/gradle.lockfile create mode 100644 plugin-build/gradle/verification-metadata.xml create mode 100644 plugin-build/settings-gradle.lockfile diff --git a/CHANGELOG.md b/CHANGELOG.md index 907a67aa0..227602105 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -32,6 +32,10 @@ - The `debug` extension property is now typed as `Property` instead of `Property` ([#1253](https://github.com/getsentry/sentry-android-gradle-plugin/pull/1253)) +### Internal Changes 🔧 + +- Pin the plugin's build dependencies with Gradle dependency locking and SHA-256 dependency verification ([#1248](https://github.com/getsentry/sentry-android-gradle-plugin/pull/1248)) + ## 6.9.0 ### Fixes diff --git a/plugin-build/build.gradle.kts b/plugin-build/build.gradle.kts index 38232b324..a319872a2 100644 --- a/plugin-build/build.gradle.kts +++ b/plugin-build/build.gradle.kts @@ -67,6 +67,18 @@ dependencies { testImplementation(libs.zip4j) } +dependencyLocking { lockAllConfigurations() } + +tasks.register("resolveAndLockAll") { + notCompatibleWithConfigurationCache("Filters configurations at execution time") + doFirst { + require(gradle.startParameter.isWriteDependencyLocks) { + "$path must be run from the command line with the `--write-locks` flag" + } + } + doLast { configurations.filter { it.isCanBeResolved }.forEach { it.resolve() } } +} + java { sourceCompatibility = JavaVersion.VERSION_11 targetCompatibility = JavaVersion.VERSION_11 diff --git a/plugin-build/gradle.lockfile b/plugin-build/gradle.lockfile new file mode 100644 index 000000000..079fd00fe --- /dev/null +++ b/plugin-build/gradle.lockfile @@ -0,0 +1,225 @@ +# This is a Gradle generated file for dependency locking. +# Manual edits can break the build and are not advised. +# This file is expected to be part of source control. +androidx.databinding:databinding-common:8.10.1=testRuntimeClasspath +androidx.databinding:databinding-compiler-common:8.10.1=testRuntimeClasspath +androidx.sqlite:sqlite-framework:2.1.0=testImplementationAar +androidx.sqlite:sqlite:2.1.0=testImplementationAar +com.android.databinding:baseLibrary:8.10.1=testRuntimeClasspath +com.android.tools.analytics-library:crash:31.10.1=testRuntimeClasspath +com.android.tools.analytics-library:protos:31.10.1=testRuntimeClasspath +com.android.tools.analytics-library:shared:31.10.1=testRuntimeClasspath +com.android.tools.analytics-library:tracker:31.10.1=testRuntimeClasspath +com.android.tools.build.jetifier:jetifier-core:1.0.0-beta10=testRuntimeClasspath +com.android.tools.build.jetifier:jetifier-processor:1.0.0-beta10=testRuntimeClasspath +com.android.tools.build:aapt2-proto:8.10.1-12782657=testRuntimeClasspath +com.android.tools.build:aaptcompiler:8.10.1=testRuntimeClasspath +com.android.tools.build:apksig:8.10.1=compileClasspath,compileOnlyDependenciesMetadata,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +com.android.tools.build:apkzlib:8.10.1=compileClasspath,compileOnlyDependenciesMetadata,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +com.android.tools.build:builder-model:8.10.1=compileClasspath,compileOnlyDependenciesMetadata,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +com.android.tools.build:builder-test-api:8.10.1=testRuntimeClasspath +com.android.tools.build:builder:8.10.1=compileClasspath,compileOnlyDependenciesMetadata,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +com.android.tools.build:bundletool:1.18.0=testRuntimeClasspath +com.android.tools.build:gradle-api:8.10.1=compileClasspath,compileOnlyDependenciesMetadata,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +com.android.tools.build:gradle-settings-api:8.10.1=testRuntimeClasspath +com.android.tools.build:gradle:8.10.1=compileClasspath,compileOnlyDependenciesMetadata,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +com.android.tools.build:manifest-merger:31.10.1=compileClasspath,compileOnlyDependenciesMetadata,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +com.android.tools.build:transform-api:2.0.0-deprecated-use-gradle-api=testRuntimeClasspath +com.android.tools.ddms:ddmlib:31.10.1=testRuntimeClasspath +com.android.tools.layoutlib:layoutlib-api:31.10.1=testRuntimeClasspath +com.android.tools.lint:lint-model:31.10.1=testRuntimeClasspath +com.android.tools.lint:lint-typedef-remover:31.10.1=testRuntimeClasspath +com.android.tools.utp:android-device-provider-ddmlib-proto:31.10.1=testRuntimeClasspath +com.android.tools.utp:android-device-provider-gradle-proto:31.10.1=testRuntimeClasspath +com.android.tools.utp:android-device-provider-profile-proto:31.10.1=testRuntimeClasspath +com.android.tools.utp:android-test-plugin-host-additional-test-output-proto:31.10.1=testRuntimeClasspath +com.android.tools.utp:android-test-plugin-host-apk-installer-proto:31.10.1=testRuntimeClasspath +com.android.tools.utp:android-test-plugin-host-coverage-proto:31.10.1=testRuntimeClasspath +com.android.tools.utp:android-test-plugin-host-emulator-control-proto:31.10.1=testRuntimeClasspath +com.android.tools.utp:android-test-plugin-host-logcat-proto:31.10.1=testRuntimeClasspath +com.android.tools.utp:android-test-plugin-result-listener-gradle-proto:31.10.1=testRuntimeClasspath +com.android.tools:annotations:31.10.1=testRuntimeClasspath +com.android.tools:common:31.10.1=testRuntimeClasspath +com.android.tools:dvlib:31.10.1=testRuntimeClasspath +com.android.tools:repository:31.10.1=testRuntimeClasspath +com.android.tools:sdk-common:31.10.1=testRuntimeClasspath +com.android.tools:sdklib:31.10.1=testRuntimeClasspath +com.android:signflinger:8.10.1=testRuntimeClasspath +com.android:zipflinger:8.10.1=compileClasspath,compileOnlyDependenciesMetadata,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +com.fasterxml.jackson.core:jackson-annotations:2.12.7=dokkaGfmPlugin,dokkaGfmRuntime,dokkaHtmlPlugin,dokkaHtmlRuntime,dokkaJavadocPlugin,dokkaJavadocRuntime,dokkaJekyllPlugin,dokkaJekyllRuntime +com.fasterxml.jackson.core:jackson-core:2.12.7=dokkaGfmPlugin,dokkaGfmRuntime,dokkaHtmlPlugin,dokkaHtmlRuntime,dokkaJavadocPlugin,dokkaJavadocRuntime,dokkaJekyllPlugin,dokkaJekyllRuntime +com.fasterxml.jackson.core:jackson-databind:2.12.7.1=dokkaGfmPlugin,dokkaGfmRuntime,dokkaHtmlPlugin,dokkaHtmlRuntime,dokkaJavadocPlugin,dokkaJavadocRuntime,dokkaJekyllPlugin,dokkaJekyllRuntime +com.fasterxml.jackson.dataformat:jackson-dataformat-xml:2.12.7=dokkaGfmRuntime,dokkaHtmlRuntime,dokkaJavadocRuntime,dokkaJekyllRuntime +com.fasterxml.jackson.module:jackson-module-jaxb-annotations:2.12.7=dokkaGfmRuntime,dokkaHtmlRuntime,dokkaJavadocRuntime,dokkaJekyllRuntime +com.fasterxml.jackson.module:jackson-module-kotlin:2.12.7=dokkaGfmPlugin,dokkaGfmRuntime,dokkaHtmlPlugin,dokkaHtmlRuntime,dokkaJavadocPlugin,dokkaJavadocRuntime,dokkaJekyllPlugin,dokkaJekyllRuntime +com.fasterxml.jackson:jackson-bom:2.12.7=dokkaGfmPlugin,dokkaGfmRuntime,dokkaHtmlPlugin,dokkaHtmlRuntime,dokkaJavadocPlugin,dokkaJavadocRuntime,dokkaJekyllPlugin,dokkaJekyllRuntime +com.fasterxml.woodstox:woodstox-core:6.2.4=dokkaGfmRuntime,dokkaHtmlRuntime,dokkaJavadocRuntime,dokkaJekyllRuntime +com.github.zafarkhaja:java-semver:0.9.0=testRuntimeClasspath +com.google.android:annotations:4.1.1.4=testRuntimeClasspath +com.google.api.grpc:proto-google-common-protos:2.48.0=testRuntimeClasspath +com.google.auto.value:auto-value-annotations:1.11.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +com.google.code.findbugs:jsr305:3.0.2=compileClasspath,compileOnlyDependenciesMetadata,testRuntimeClasspath +com.google.code.gson:gson:2.11.0=testRuntimeClasspath +com.google.crypto.tink:tink:1.7.0=testRuntimeClasspath +com.google.dagger:dagger:2.28.3=testRuntimeClasspath +com.google.errorprone:error_prone_annotations:2.41.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +com.google.flatbuffers:flatbuffers-java:1.12.0=testRuntimeClasspath +com.google.guava:failureaccess:1.0.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +com.google.guava:guava:33.4.3-android=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +com.google.j2objc:j2objc-annotations:3.0.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +com.google.jimfs:jimfs:1.1=testRuntimeClasspath +com.google.protobuf:protobuf-java-util:3.25.5=testRuntimeClasspath +com.google.protobuf:protobuf-java:3.25.5=testRuntimeClasspath +com.google.testing.platform:core-proto:0.0.9-alpha03=testRuntimeClasspath +com.google.truth:truth:1.4.5=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +com.googlecode.juniversalchardet:juniversalchardet:1.0.3=testRuntimeClasspath +com.guardsquare:proguard-base:7.5.0=compileClasspath,compileOnlyDependenciesMetadata,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +com.guardsquare:proguard-core:9.1.4=compileClasspath,compileOnlyDependenciesMetadata,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +com.guardsquare:proguard-gradle:7.5.0=compileClasspath,compileOnlyDependenciesMetadata,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +com.nhaarman.mockitokotlin2:mockito-kotlin:2.2.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +com.squareup:javapoet:1.10.0=testRuntimeClasspath +com.squareup:javawriter:2.5.0=compileClasspath,compileOnlyDependenciesMetadata,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +com.sun.activation:javax.activation:1.2.0=testRuntimeClasspath +com.sun.istack:istack-commons-runtime:3.0.8=testRuntimeClasspath +com.sun.xml.fastinfoset:FastInfoset:1.2.16=testRuntimeClasspath +commons-codec:commons-codec:1.11=testRuntimeClasspath +commons-io:commons-io:2.16.1=testRuntimeClasspath +commons-logging:commons-logging:1.2=testRuntimeClasspath +io.github.reandroid:ARSCLib:1.1.4=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +io.grpc:grpc-api:1.69.1=testRuntimeClasspath +io.grpc:grpc-context:1.69.1=testRuntimeClasspath +io.grpc:grpc-core:1.69.1=testRuntimeClasspath +io.grpc:grpc-inprocess:1.69.1=testRuntimeClasspath +io.grpc:grpc-netty:1.69.1=testRuntimeClasspath +io.grpc:grpc-protobuf-lite:1.69.1=testRuntimeClasspath +io.grpc:grpc-protobuf:1.69.1=testRuntimeClasspath +io.grpc:grpc-stub:1.69.1=testRuntimeClasspath +io.grpc:grpc-util:1.69.1=testRuntimeClasspath +io.netty:netty-buffer:4.1.110.Final=testRuntimeClasspath +io.netty:netty-codec-http2:4.1.110.Final=testRuntimeClasspath +io.netty:netty-codec-http:4.1.110.Final=testRuntimeClasspath +io.netty:netty-codec-socks:4.1.110.Final=testRuntimeClasspath +io.netty:netty-codec:4.1.110.Final=testRuntimeClasspath +io.netty:netty-common:4.1.110.Final=testRuntimeClasspath +io.netty:netty-handler-proxy:4.1.110.Final=testRuntimeClasspath +io.netty:netty-handler:4.1.110.Final=testRuntimeClasspath +io.netty:netty-resolver:4.1.110.Final=testRuntimeClasspath +io.netty:netty-transport-native-unix-common:4.1.110.Final=testRuntimeClasspath +io.netty:netty-transport:4.1.110.Final=testRuntimeClasspath +io.perfmark:perfmark-api:0.27.0=testRuntimeClasspath +io.sentry:sentry-android-okhttp:7.22.6=testImplementationAar +io.sentry:sentry-android:8.43.1=testImplementationAar +io.sentry:sentry-okhttp:8.43.1=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +io.sentry:sentry:8.43.1=compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +it.unimi.dsi:fastutil-core:8.5.12=dokkaGfmPlugin,dokkaHtmlPlugin,dokkaJavadocPlugin,dokkaJekyllPlugin +jakarta.activation:jakarta.activation-api:1.2.1=dokkaGfmRuntime,dokkaHtmlRuntime,dokkaJavadocRuntime,dokkaJekyllRuntime,testRuntimeClasspath +jakarta.xml.bind:jakarta.xml.bind-api:2.3.2=dokkaGfmRuntime,dokkaHtmlRuntime,dokkaJavadocRuntime,dokkaJekyllRuntime,testRuntimeClasspath +javax.annotation:javax.annotation-api:1.3.2=testRuntimeClasspath +javax.inject:javax.inject:1=compileClasspath,compileOnlyDependenciesMetadata,testRuntimeClasspath +junit:junit:4.13.2=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +net.bytebuddy:byte-buddy-agent:1.9.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +net.bytebuddy:byte-buddy:1.9.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +net.java.dev.jna:jna-platform:5.6.0=testRuntimeClasspath +net.java.dev.jna:jna:5.6.0=testRuntimeClasspath +net.lingala.zip4j:zip4j:2.11.5=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +net.sf.jopt-simple:jopt-simple:4.9=testRuntimeClasspath +net.sf.kxml:kxml2:2.3.0=testRuntimeClasspath +org.apache.ant:ant-launcher:1.10.13=compileClasspath,compileOnlyDependenciesMetadata +org.apache.ant:ant:1.10.13=compileClasspath,compileOnlyDependenciesMetadata +org.apache.commons:commons-compress:1.21=testRuntimeClasspath +org.apache.httpcomponents:httpclient:4.5.14=testRuntimeClasspath +org.apache.httpcomponents:httpcore:4.4.16=testRuntimeClasspath +org.apache.httpcomponents:httpmime:4.5.6=testRuntimeClasspath +org.apache.logging.log4j:log4j-api:2.19.0=testRuntimeClasspath +org.apache.logging.log4j:log4j-core:2.19.0=testRuntimeClasspath +org.bitbucket.b_c:jose4j:0.9.5=testRuntimeClasspath +org.bouncycastle:bcpkix-jdk18on:1.79=testRuntimeClasspath +org.bouncycastle:bcprov-jdk18on:1.79=testRuntimeClasspath +org.bouncycastle:bcutil-jdk18on:1.79=testRuntimeClasspath +org.checkerframework:checker-qual:3.43.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +org.codehaus.groovy:groovy:3.0.21=compileClasspath,compileOnlyDependenciesMetadata +org.codehaus.mojo:animal-sniffer-annotations:1.24=testRuntimeClasspath +org.codehaus.woodstox:stax2-api:4.2.1=dokkaGfmRuntime,dokkaHtmlRuntime,dokkaJavadocRuntime,dokkaJekyllRuntime +org.freemarker:freemarker:2.3.32=dokkaGfmPlugin,dokkaHtmlPlugin,dokkaJavadocPlugin,dokkaJekyllPlugin +org.glassfish.jaxb:jaxb-runtime:2.3.2=testRuntimeClasspath +org.glassfish.jaxb:txw2:2.3.2=testRuntimeClasspath +org.gradle.experimental:gradle-public-api:8.9=compileClasspath,compileOnlyDependenciesMetadata +org.hamcrest:hamcrest-core:1.3=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +org.jdom:jdom2:2.0.6=testRuntimeClasspath +org.jetbrains.dokka:analysis-kotlin-descriptors:1.9.20=dokkaGfmPlugin,dokkaHtmlPlugin,dokkaJavadocPlugin,dokkaJekyllPlugin +org.jetbrains.dokka:analysis-markdown:1.9.20=dokkaGfmPlugin,dokkaHtmlPlugin,dokkaJavadocPlugin,dokkaJekyllPlugin +org.jetbrains.dokka:dokka-base:1.9.20=dokkaGfmPlugin,dokkaHtmlPlugin,dokkaJavadocPlugin,dokkaJekyllPlugin +org.jetbrains.dokka:dokka-core:1.9.20=dokkaGfmRuntime,dokkaHtmlRuntime,dokkaJavadocRuntime,dokkaJekyllRuntime +org.jetbrains.intellij.deps:trove4j:1.0.20200330=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinKlibCommonizerClasspath +org.jetbrains.kotlin:fus-statistics-gradle-plugin:2.1.21=compileClasspath,compileOnlyDependenciesMetadata +org.jetbrains.kotlin:kotlin-build-tools-api:2.1.21=compileClasspath,compileOnlyDependenciesMetadata,kotlinBuildToolsApiClasspath +org.jetbrains.kotlin:kotlin-build-tools-impl:2.1.21=kotlinBuildToolsApiClasspath +org.jetbrains.kotlin:kotlin-compiler-embeddable:2.1.21=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinKlibCommonizerClasspath +org.jetbrains.kotlin:kotlin-compiler-runner:2.1.21=kotlinBuildToolsApiClasspath +org.jetbrains.kotlin:kotlin-daemon-client:2.1.21=kotlinBuildToolsApiClasspath +org.jetbrains.kotlin:kotlin-daemon-embeddable:2.1.21=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinKlibCommonizerClasspath +org.jetbrains.kotlin:kotlin-gradle-plugin-annotations:2.1.21=compileClasspath,compileOnlyDependenciesMetadata +org.jetbrains.kotlin:kotlin-gradle-plugin-api:2.1.21=compileClasspath,compileOnlyDependenciesMetadata +org.jetbrains.kotlin:kotlin-gradle-plugin-model:2.1.21=compileClasspath,compileOnlyDependenciesMetadata +org.jetbrains.kotlin:kotlin-gradle-plugin:2.1.21=compileClasspath,compileOnlyDependenciesMetadata +org.jetbrains.kotlin:kotlin-gradle-plugins-bom:2.1.21=compileClasspath,compileOnlyDependenciesMetadata +org.jetbrains.kotlin:kotlin-klib-commonizer-embeddable:2.1.21=kotlinKlibCommonizerClasspath +org.jetbrains.kotlin:kotlin-metadata-jvm:2.0.0=compileClasspath,compileOnlyDependenciesMetadata,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +org.jetbrains.kotlin:kotlin-native-utils:2.1.21=compileClasspath,compileOnlyDependenciesMetadata +org.jetbrains.kotlin:kotlin-reflect:1.6.10=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinKlibCommonizerClasspath +org.jetbrains.kotlin:kotlin-reflect:1.9.22=dokkaGfmPlugin,dokkaGfmRuntime,dokkaHtmlPlugin,dokkaHtmlRuntime,dokkaJavadocPlugin,dokkaJavadocRuntime,dokkaJekyllPlugin,dokkaJekyllRuntime +org.jetbrains.kotlin:kotlin-reflect:2.1.0=testRuntimeClasspath +org.jetbrains.kotlin:kotlin-script-runtime:2.1.21=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath +org.jetbrains.kotlin:kotlin-scripting-common:2.1.21=kotlinBuildToolsApiClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest +org.jetbrains.kotlin:kotlin-scripting-compiler-embeddable:2.1.21=kotlinBuildToolsApiClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest +org.jetbrains.kotlin:kotlin-scripting-compiler-impl-embeddable:2.1.21=kotlinBuildToolsApiClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest +org.jetbrains.kotlin:kotlin-scripting-jvm:2.1.21=kotlinBuildToolsApiClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest +org.jetbrains.kotlin:kotlin-stdlib-common:1.9.22=dokkaGfmPlugin,dokkaGfmRuntime,dokkaHtmlPlugin,dokkaHtmlRuntime,dokkaJavadocPlugin,dokkaJavadocRuntime,dokkaJekyllPlugin,dokkaJekyllRuntime +org.jetbrains.kotlin:kotlin-stdlib-common:2.0.0=compileClasspath,compileOnlyDependenciesMetadata +org.jetbrains.kotlin:kotlin-stdlib-common:2.1.21=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.8.20=dokkaGfmRuntime,dokkaHtmlRuntime,dokkaJavadocRuntime,dokkaJekyllRuntime +org.jetbrains.kotlin:kotlin-stdlib-jdk7:1.9.0=dokkaGfmPlugin,dokkaHtmlPlugin,dokkaJavadocPlugin,dokkaJekyllPlugin +org.jetbrains.kotlin:kotlin-stdlib-jdk7:2.1.0=testRuntimeClasspath +org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.8.20=dokkaGfmRuntime,dokkaHtmlRuntime,dokkaJavadocRuntime,dokkaJekyllRuntime +org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.9.0=dokkaGfmPlugin,dokkaHtmlPlugin,dokkaJavadocPlugin,dokkaJekyllPlugin +org.jetbrains.kotlin:kotlin-stdlib-jdk8:2.1.0=testRuntimeClasspath +org.jetbrains.kotlin:kotlin-stdlib:1.9.22=dokkaGfmPlugin,dokkaGfmRuntime,dokkaHtmlPlugin,dokkaHtmlRuntime,dokkaJavadocPlugin,dokkaJavadocRuntime,dokkaJekyllPlugin,dokkaJekyllRuntime +org.jetbrains.kotlin:kotlin-stdlib:2.0.0=compileClasspath,compileOnlyDependenciesMetadata +org.jetbrains.kotlin:kotlin-stdlib:2.1.21=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +org.jetbrains.kotlin:kotlin-test-junit:2.1.21=testCompileClasspath,testRuntimeClasspath +org.jetbrains.kotlin:kotlin-test:2.1.21=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +org.jetbrains.kotlin:kotlin-tooling-core:2.1.21=compileClasspath,compileOnlyDependenciesMetadata +org.jetbrains.kotlin:kotlin-util-io:2.1.21=compileClasspath,compileOnlyDependenciesMetadata +org.jetbrains.kotlinx:kotlinx-coroutines-bom:1.7.3=dokkaGfmPlugin,dokkaGfmRuntime,dokkaHtmlPlugin,dokkaHtmlRuntime,dokkaJavadocPlugin,dokkaJavadocRuntime,dokkaJekyllPlugin,dokkaJekyllRuntime +org.jetbrains.kotlinx:kotlinx-coroutines-core-jvm:1.7.3=dokkaGfmPlugin,dokkaGfmRuntime,dokkaHtmlPlugin,dokkaHtmlRuntime,dokkaJavadocPlugin,dokkaJavadocRuntime,dokkaJekyllPlugin,dokkaJekyllRuntime +org.jetbrains.kotlinx:kotlinx-coroutines-core-jvm:1.8.0=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinKlibCommonizerClasspath +org.jetbrains.kotlinx:kotlinx-coroutines-core:1.7.3=dokkaGfmPlugin,dokkaGfmRuntime,dokkaHtmlPlugin,dokkaHtmlRuntime,dokkaJavadocPlugin,dokkaJavadocRuntime,dokkaJekyllPlugin,dokkaJekyllRuntime +org.jetbrains.kotlinx:kotlinx-html-jvm:0.9.1=dokkaGfmPlugin,dokkaHtmlPlugin,dokkaJavadocPlugin,dokkaJekyllPlugin +org.jetbrains:annotations:13.0=kotlinBuildToolsApiClasspath,kotlinCompilerClasspath,kotlinCompilerPluginClasspathMain,kotlinCompilerPluginClasspathTest,kotlinKlibCommonizerClasspath,testCompileClasspath +org.jetbrains:annotations:23.0.0=dokkaGfmPlugin,dokkaGfmRuntime,dokkaHtmlPlugin,dokkaHtmlRuntime,dokkaJavadocPlugin,dokkaJavadocRuntime,dokkaJekyllPlugin,dokkaJekyllRuntime +org.jetbrains:annotations:24.0.0=testRuntimeClasspath +org.jetbrains:annotations:24.0.1=compileClasspath,compileOnlyDependenciesMetadata +org.jetbrains:markdown-jvm:0.5.2=dokkaGfmPlugin,dokkaHtmlPlugin,dokkaJavadocPlugin,dokkaJekyllPlugin +org.jetbrains:markdown:0.5.2=dokkaGfmPlugin,dokkaHtmlPlugin,dokkaJavadocPlugin,dokkaJekyllPlugin +org.json:json:20231013=testRuntimeClasspath +org.jsoup:jsoup:1.16.1=dokkaGfmPlugin,dokkaHtmlPlugin,dokkaJavadocPlugin,dokkaJekyllPlugin +org.jspecify:jspecify:1.0.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +org.jvnet.staxex:stax-ex:1.8.1=testRuntimeClasspath +org.mockito:mockito-core:2.23.0=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +org.objenesis:objenesis:2.6=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +org.ow2.asm:asm-analysis:9.4=compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata +org.ow2.asm:asm-analysis:9.7.1=testRuntimeClasspath +org.ow2.asm:asm-commons:9.4=compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata +org.ow2.asm:asm-commons:9.7.1=testRuntimeClasspath +org.ow2.asm:asm-tree:9.4=compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata +org.ow2.asm:asm-tree:9.7.1=testRuntimeClasspath +org.ow2.asm:asm-util:9.4=compileClasspath,implementationDependenciesMetadata,runtimeClasspath,testCompileClasspath,testImplementationDependenciesMetadata +org.ow2.asm:asm-util:9.7.1=testRuntimeClasspath +org.ow2.asm:asm:9.4=implementationDependenciesMetadata,runtimeClasspath +org.ow2.asm:asm:9.7.1=compileClasspath,compileOnlyDependenciesMetadata +org.ow2.asm:asm:9.8=testCompileClasspath,testImplementationDependenciesMetadata,testRuntimeClasspath +org.slf4j:slf4j-api:1.7.30=testRuntimeClasspath +org.slf4j:slf4j-api:1.7.36=compileClasspath,compileOnlyDependenciesMetadata +org.tensorflow:tensorflow-lite-metadata:0.2.0=testRuntimeClasspath +empty=annotationProcessor,apiDependenciesMetadata,compileOnlyAar,dokkaPlugin,dokkaRuntime,fixtureClasspath,implementationAar,intransitiveDependenciesMetadata,kotlinCompilerPluginClasspath,kotlinNativeCompilerPluginClasspath,kotlinScriptDef,kotlinScriptDefExtensions,runtimeOnlyAar,testAnnotationProcessor,testApiDependenciesMetadata,testCompileOnlyAar,testCompileOnlyDependenciesMetadata,testIntransitiveDependenciesMetadata,testKotlinScriptDef,testKotlinScriptDefExtensions,testRuntimeOnlyAar diff --git a/plugin-build/gradle/verification-metadata.xml b/plugin-build/gradle/verification-metadata.xml new file mode 100644 index 000000000..50e61461c --- /dev/null +++ b/plugin-build/gradle/verification-metadata.xml @@ -0,0 +1,3262 @@ + + + + true + false + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + + diff --git a/plugin-build/settings-gradle.lockfile b/plugin-build/settings-gradle.lockfile new file mode 100644 index 000000000..709a43f74 --- /dev/null +++ b/plugin-build/settings-gradle.lockfile @@ -0,0 +1,4 @@ +# This is a Gradle generated file for dependency locking. +# Manual edits can break the build and are not advised. +# This file is expected to be part of source control. +empty=incomingCatalogForLibs0 From 574cc5122d08b13f278f50e0e9286588d3c6c52f Mon Sep 17 00:00:00 2001 From: Nelson Osacky Date: Wed, 3 Jun 2026 17:30:14 +0200 Subject: [PATCH 2/5] docs(changelog): Point entry to the correct PR number Co-Authored-By: Claude Opus 4.8 (1M context) --- CHANGELOG.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/CHANGELOG.md b/CHANGELOG.md index 227602105..730692b69 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -34,7 +34,7 @@ ### Internal Changes 🔧 -- Pin the plugin's build dependencies with Gradle dependency locking and SHA-256 dependency verification ([#1248](https://github.com/getsentry/sentry-android-gradle-plugin/pull/1248)) +- Pin the plugin's build dependencies with Gradle dependency locking and SHA-256 dependency verification ([#1256](https://github.com/getsentry/sentry-android-gradle-plugin/pull/1256)) ## 6.9.0 From 644a45bf08c96b0187e4a640e2b858c6f9876d5d Mon Sep 17 00:00:00 2001 From: Nelson Osacky Date: Thu, 4 Jun 2026 13:48:24 +0200 Subject: [PATCH 3/5] build(plugin): Exempt the version matrix from dependency pinning (GRADLE-104) The compatibility test matrix overrides AGP/Kotlin/Gradle versions, which deliberately diverges from the lockfile and verification metadata of the canonical build. Guard dependency locking so it only applies when no VERSION_AGP/VERSION_KOTLIN override is set, and disable dependency verification on the matrix and standalone integration-test steps. Canonical builds (pre-merge, publish, distribution) keep strict locking and verification. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/integration-tests-sentry-cli.yml | 4 +++- .github/workflows/test-matrix-agp-gradle.yaml | 4 +++- plugin-build/build.gradle.kts | 10 +++++++++- 3 files changed, 15 insertions(+), 3 deletions(-) diff --git a/.github/workflows/integration-tests-sentry-cli.yml b/.github/workflows/integration-tests-sentry-cli.yml index b8e525448..29adb212c 100644 --- a/.github/workflows/integration-tests-sentry-cli.yml +++ b/.github/workflows/integration-tests-sentry-cli.yml @@ -35,4 +35,6 @@ jobs: - name: Start server and run integration test for sentry-cli commands run: | test/integration-test-server-start.sh & - ./gradlew -p plugin-build integrationTest --tests "*IntegrationTest" + # Verification is disabled here because the standalone `-p plugin-build` build + # resolves buildscript-classpath artifacts not captured in the metadata. + ./gradlew -p plugin-build integrationTest --tests "*IntegrationTest" --dependency-verification=off diff --git a/.github/workflows/test-matrix-agp-gradle.yaml b/.github/workflows/test-matrix-agp-gradle.yaml index fcd79c24e..0c8050bb3 100644 --- a/.github/workflows/test-matrix-agp-gradle.yaml +++ b/.github/workflows/test-matrix-agp-gradle.yaml @@ -71,7 +71,9 @@ jobs: cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }} - name: Build the Release variants and integrationTest - run: gradle assembleRelease bundleRelease integrationTest + # Verification is disabled here because the matrix deliberately overrides + # AGP/Kotlin/Gradle versions, resolving artifacts not in the metadata. + run: gradle assembleRelease bundleRelease integrationTest --dependency-verification=off - name: Check sentry-debug-meta.properties inside APKs run: | diff --git a/plugin-build/build.gradle.kts b/plugin-build/build.gradle.kts index a319872a2..0af7f2883 100644 --- a/plugin-build/build.gradle.kts +++ b/plugin-build/build.gradle.kts @@ -67,7 +67,15 @@ dependencies { testImplementation(libs.zip4j) } -dependencyLocking { lockAllConfigurations() } +// The compatibility test matrix (test-matrix-agp-gradle.yaml) overrides AGP/Kotlin/Gradle +// versions via env vars, which deliberately diverges from the lockfile. Only lock the +// canonical build; matrix builds resolve their own versions. +val isVersionOverrideBuild = + System.getenv("VERSION_AGP") != null || System.getenv("VERSION_KOTLIN") != null + +if (!isVersionOverrideBuild) { + dependencyLocking { lockAllConfigurations() } +} tasks.register("resolveAndLockAll") { notCompatibleWithConfigurationCache("Filters configurations at execution time") From 36a6a8c975015c92d7033041070d34900d392c69 Mon Sep 17 00:00:00 2001 From: Nelson Osacky Date: Tue, 9 Jun 2026 13:08:44 +0200 Subject: [PATCH 4/5] docs(contributing): Explain regenerating dependency locks (GRADLE-104) Adding, removing, or bumping a dependency in plugin-build invalidates the lockfile and verification metadata, and STRICT-mode locking fails the build until both are regenerated. Document the single command that rewrites them and point the dependencyLocking block at the new section. Co-Authored-By: Claude Opus 4.8 (1M context) --- CONTRIBUTING.md | 20 ++++++++++++++++++++ plugin-build/build.gradle.kts | 2 ++ 2 files changed, 22 insertions(+) diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 4a683ffc7..ca6aaefce 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -7,6 +7,26 @@ We suggest opening an issue to discuss bigger changes before investing on a big The project currently requires you run JDK version `17` and the Android SDK. +# Updating dependencies in `plugin-build` + +The published plugin build (`plugin-build`) pins its full transitive +dependency graph for supply-chain hardening: resolved versions are recorded +in `plugin-build/gradle.lockfile` and a SHA-256 checksum for every artifact +in `plugin-build/gradle/verification-metadata.xml`. Locking runs in STRICT +mode, so any drift fails the build. + +Whenever you add, remove, or bump a dependency in +`plugin-build/build.gradle.kts`, regenerate both files and commit them: + +```bash +./gradlew -p plugin-build resolveAndLockAll --write-locks --write-verification-metadata sha256 +``` + +Review the diff before committing — new transitive artifacts should look like +they belong. The compatibility test matrix overrides AGP/Kotlin/Gradle +versions via env vars and deliberately skips locking, so you only need to +regenerate against the canonical build. + # Overriding `sentry-cli` for local development If you want to use a local version of the sentry-cli for testing integration with the plugin, you can do so by setting the `cli.executable` property in the `sentry.properties` file of the target project. diff --git a/plugin-build/build.gradle.kts b/plugin-build/build.gradle.kts index 0af7f2883..043e2a39c 100644 --- a/plugin-build/build.gradle.kts +++ b/plugin-build/build.gradle.kts @@ -73,6 +73,8 @@ dependencies { val isVersionOverrideBuild = System.getenv("VERSION_AGP") != null || System.getenv("VERSION_KOTLIN") != null +// Regenerate the lockfile and verification metadata after changing dependencies; see +// CONTRIBUTING.md. if (!isVersionOverrideBuild) { dependencyLocking { lockAllConfigurations() } } From 630801b6974b3c61bc3b8eaad260849de018cb72 Mon Sep 17 00:00:00 2001 From: Nelson Osacky Date: Tue, 9 Jun 2026 13:09:06 +0200 Subject: [PATCH 5/5] ci(deps): Regenerate locks on Dependabot Gradle PRs (GRADLE-104) Dependabot bumps versions in the catalog but cannot regenerate the plugin-build lockfile or verification metadata, so its Gradle PRs fail STRICT-mode locking and checksum verification. Run resolveAndLockAll with --write-locks and --write-verification-metadata on those PRs and push the regenerated files back via the deploy key so CI revalidates them. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/update-dependency-locks.yml | 68 +++++++++++++++++++ 1 file changed, 68 insertions(+) create mode 100644 .github/workflows/update-dependency-locks.yml diff --git a/.github/workflows/update-dependency-locks.yml b/.github/workflows/update-dependency-locks.yml new file mode 100644 index 000000000..fe574a691 --- /dev/null +++ b/.github/workflows/update-dependency-locks.yml @@ -0,0 +1,68 @@ +name: Update Dependency Locks + +# Dependabot bumps versions in gradle/libs.versions.toml but cannot regenerate +# the plugin-build lockfile or verification metadata (it has no support for the +# latter, and its lockfile support breaks with version catalogs). Without this, +# every Dependabot Gradle PR fails STRICT-mode locking and checksum verification. +# This job regenerates both and pushes them back onto the Dependabot branch. + +on: + pull_request: + +# The job pushes via CI_DEPLOY_KEY (SSH), so the GITHUB_TOKEN needs no write +# scopes. dependabot/fetch-metadata reads PR metadata via the API, which +# requires pull-requests: read. +permissions: + contents: read + pull-requests: read + +jobs: + regenerate: + name: Regenerate lockfile and verification metadata + # Dependabot-triggered runs read secrets from the Dependabot secret store, so + # CI_DEPLOY_KEY must be added there (Settings -> Secrets -> Dependabot), not + # only to Actions secrets. + if: github.actor == 'dependabot[bot]' + runs-on: ubuntu-latest + steps: + - name: Fetch Dependabot metadata + id: metadata + uses: dependabot/fetch-metadata@25dd0e34f4fe68f24cc83900b1fe3fe149efef98 # v3.1.0 + + - name: Check out PR branch + if: steps.metadata.outputs.package-ecosystem == 'gradle' + uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6 + with: + ref: ${{ github.head_ref }} + # Pushing with the deploy key (rather than GITHUB_TOKEN) re-triggers CI + # so the regenerated files are validated. + ssh-key: ${{ secrets.CI_DEPLOY_KEY }} + + - name: Setup Gradle + if: steps.metadata.outputs.package-ecosystem == 'gradle' + uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # pin@v6 + + - name: Set up Java + if: steps.metadata.outputs.package-ecosystem == 'gradle' + uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5 + with: + distribution: 'temurin' + java-version: '17' + + - name: Regenerate lockfile and verification metadata + if: steps.metadata.outputs.package-ecosystem == 'gradle' + run: ./gradlew -p plugin-build resolveAndLockAll --write-locks --write-verification-metadata sha256 + + - name: Commit and push if changed + if: steps.metadata.outputs.package-ecosystem == 'gradle' + run: | + files="plugin-build/gradle.lockfile plugin-build/settings-gradle.lockfile plugin-build/gradle/verification-metadata.xml" + if git diff --quiet -- $files; then + echo "No lockfile or verification metadata changes." + exit 0 + fi + git config user.name "github-actions[bot]" + git config user.email "github-actions[bot]@users.noreply.github.com" + git add $files + git commit -m "build(plugin): Regenerate dependency locks and verification metadata" + git push