From c74be3f63a30aa01ef0b2191feffcd71b1378fb0 Mon Sep 17 00:00:00 2001 From: Sean Li Date: Fri, 31 Jul 2026 16:25:02 -0700 Subject: [PATCH] Lock only runtimeClasspath so lockfiles stay reproducible Dependency locking was activated for any configuration whose name ends in "runtimeclasspath", which also matched testRuntimeClasspath. But resolveAndLockAll only resolves runtimeClasspath, so test lock state was never written by our own regeneration task and every lockfile on main contains runtimeClasspath entries exclusively. Gradle 9.6.1 (#4780) started emitting a header in each lockfile pointing at "./gradlew :project:dependencies --write-locks". That task resolves every configuration in the project, so anything following the hint writes testRuntimeClasspath lock state that resolveAndLockAll cannot subsequently refresh or remove, since Gradle only rewrites state for configurations resolved in the current build. #4797 and #4798 each picked up ~640 lines of such entries across 19 lockfiles while changing no resolved dependency. Narrowing the predicate to an exact match makes both commands produce identical output. This is a no-op for current coverage: runtimeClasspath is the only configuration present in any checked-in lockfile. --- buildSrc/src/main/kotlin/ai.java-conventions.gradle.kts | 6 +++++- 1 file changed, 5 insertions(+), 1 deletion(-) diff --git a/buildSrc/src/main/kotlin/ai.java-conventions.gradle.kts b/buildSrc/src/main/kotlin/ai.java-conventions.gradle.kts index 7fef177d84..270fd23995 100644 --- a/buildSrc/src/main/kotlin/ai.java-conventions.gradle.kts +++ b/buildSrc/src/main/kotlin/ai.java-conventions.gradle.kts @@ -174,7 +174,11 @@ dependencyCheck { if (!path.startsWith(":smoke-tests")) { configurations.configureEach { - if (name.lowercase().endsWith("runtimeclasspath")) { + // only lock runtimeClasspath, which is what resolveAndLockAll resolves and + // what actually ships; endsWith("runtimeclasspath") also matched + // testRuntimeClasspath, which Dependabot resolves and locks even though our + // own regeneration task never does + if (name == "runtimeClasspath") { resolutionStrategy.activateDependencyLocking() } }