From d4ebab0547bfbe724d049a26afdf28691e4fa4a1 Mon Sep 17 00:00:00 2001 From: Filip Hrisafov Date: Thu, 12 Nov 2026 20:52:25 +0100 Subject: [PATCH 1/2] Add missing build script metadata to dependency verification A cold Gradle cache resolves the metadata of the jackson and junit BOMs that lose conflict resolution on the build script classpath. A warm cache does not, which is why CI passed and the release failed. --- gradle/verification-metadata.xml | 45 ++++++++++++++++++++++++++++++++ 1 file changed, 45 insertions(+) diff --git a/gradle/verification-metadata.xml b/gradle/verification-metadata.xml index 3b7df2d..3e223ef 100644 --- a/gradle/verification-metadata.xml +++ b/gradle/verification-metadata.xml @@ -21,16 +21,41 @@ + + + + + + + + + + + + + + + + + + + + + + + + + @@ -976,25 +1001,45 @@ + + + + + + + + + + + + + + + + + + + + From 6758dbd6b04c7912927e3c86fcef3bae567aa001 Mon Sep 17 00:00:00 2001 From: Filip Hrisafov Date: Thu, 12 Nov 2026 21:06:03 +0100 Subject: [PATCH 2/2] Check dependency verification with a cold Gradle cache in CI The release job resolves dependencies without a warm cache, so CI needs to do the same to catch missing verification metadata before a release. --- .github/workflows/main.yml | 20 ++++++++++++++++++++ 1 file changed, 20 insertions(+) diff --git a/.github/workflows/main.yml b/.github/workflows/main.yml index ecec3c7..de5baf4 100644 --- a/.github/workflows/main.yml +++ b/.github/workflows/main.yml @@ -36,3 +36,23 @@ jobs: with: fail_ci_if_error: true token: ${{ secrets.CODECOV_TOKEN }} + + # Runs the release build without the Gradle cache. A warm cache can skip dependency + # verification for metadata that a fresh cache (like the one in the release job) resolves. + verify_dependencies: + name: 'Dependency verification (no cache)' + runs-on: ubuntu-latest + steps: + - name: 'Checkout' + uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0 + - name: 'Set up JDK' + uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0 + with: + distribution: 'zulu' + java-version: 21 + - name: Setup Gradle + uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0 + with: + cache-disabled: true + - name: 'Build plugin' + run: ./gradlew --warning-mode=all buildPlugin