Repository navigation
Fix dependency verification with a cold Gradle cache - #284
Merged
Merged
Conversation
A cold Gradle cache resolves the metadata of the jackson and junit BOMs that lose conflict resolution on the build script classpath. A warm cache does not, which is why CI passed and the release failed.
The release job resolves dependencies without a warm cache, so CI needs to do the same to catch missing verification metadata before a release.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
The 1.10.0 release failed in the Build step (run) because dependency verification rejected 11 metadata files on the build script classpath:
com.fasterxml:oss-parent:70com.fasterxml.jackson:jackson-base:2.20.2and2.21.4com.fasterxml.jackson:jackson-bom:2.20.2com.fasterxml.jackson:jackson-parent:2.20org.junit:junit-bom5.10.0, 5.11.4, 5.13.1, 5.13.4 and 5.14.1These are BOMs pulled in by the Gradle plugins that lose conflict resolution. Gradle only resolves their metadata when the cache is cold. CI passed because
setup-gradlerestored a warm cache. The release job did not have these files cached.Changes
gradle/verification-metadata.xml. They were generated from a fresh Gradle home, and all 11 checksums match the files on Maven Central.Dependency verification (no cache)CI job that runsbuildPlugin(the same build as the release job) withcache-disabled: true, so this kind of gap fails CI instead of the release.Testing
buildPlugin,signPluginandverifyPluginSignaturepass with verification enforced (throwaway signing key).The failed release stopped before anything was pushed, so it can be re-run once this is merged.