fix(build): scope JitPack to its own coordinate namespaces - #1359
Merged
Conversation
Five Dependabot PRs went red at once with the same configuration-phase
failure:
> Could not resolve org.gradle:gradle-tooling-api:5.2.1
Required by: buildscript of root project 'Flipcash'
> com.ahasbini.tools:android-opencv-gradle-plugin:0.1.3-dev
> Could not GET 'https://jitpack.io/org/gradle/gradle-tooling-api/5.2.1/...'
> Read timed out
`gradle-tooling-api` is only published to repo.gradle.org, which the
buildscript already declares. The problem is ordering: JitPack sits ahead
of it and is queried for every artifact, and a read timeout aborts
resolution instead of falling through to the next repository the way a
404 does. So a JitPack blip fails the build before the artifact is looked
for where it actually lives.
Restrict all three JitPack declarations to the com.github, com.gitlab and
com.bitbucket namespaces JitPack serves. Nothing in the build resolves
from JitPack today: the OpenCV plugin comes from gradlePluginPortal, and
every other non-Central group resolves from Central, Google or
maven.fpregistry.io. Keeping the repository declared but filtered leaves
a JitPack-style dependency working without putting JitPack in the path of
everything else.
Verified with forced-refresh resolution against the network:
`buildEnvironment` resolves the plugin and its transitive
gradle-tooling-api, and `:apps:flipcash:app:dependencies` resolves the
debug runtime classpath with no failures.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Five Dependabot PRs (#1352, #1353, #1354, #1355, #1356) went red within the same five-minute window, all with the same configuration-phase failure:
Nothing was compiled and no test ran, so those PRs got no signal on the bumps they were meant to exercise.
Why a JitPack blip breaks an unrelated artifact
gradle-tooling-api:5.2.1is published only torepo.gradle.org/gradle/libs-releases, which the buildscript already declares:gradle-tooling-api:5.2.1dl.google.comrepo1.maven.orgplugins.gradle.org/m2jitpack.iorepo.gradle.org/gradle/libs-releasesThe problem is ordering. JitPack sits ahead of
repo.gradle.org, so it is queried for every artifact, and a read timeout aborts resolution rather than falling through to the next repository the way a 404 does. Resolution never reaches the repository that has the artifact.retries=0ingradle-wrapper.propertiesis unrelated here. It only covers the wrapper distribution download.The change
All three JitPack declarations (root buildscript,
pluginManagement,dependencyResolutionManagement) are restricted to thecom.github,com.gitlabandcom.bitbucketnamespaces JitPack serves, so Gradle no longer makes a network call to JitPack for anything else.Nothing in the build resolves from JitPack today. The OpenCV plugin, which looked like the obvious JitPack consumer, resolves from gradlePluginPortal and 404s on JitPack. Every other non-Central group resolves from Central, Google or
maven.fpregistry.io. Removing the repository outright would also work, but filtering keeps a future JitPack-style dependency working without putting JitPack in the resolution path of everything else.No resolved version changes. Both checks below ran with
--refresh-dependencies, so the answers came from the network rather than the local cache:./gradlew buildEnvironment --refresh-dependenciesresolvescom.ahasbini.tools:android-opencv-gradle-plugin:0.1.3-dev -> org.gradle:gradle-tooling-api:5.2.1, the exact path that was failing../gradlew :apps:flipcash:app:dependencies --configuration debugRuntimeClasspath --refresh-dependenciessucceeds with noFAILEDmarkers, including for the non-Central groupsdev.theolm,dev.bmcreations,com.fingerprint.android,com.ionspin.kotlinandorg.kin.sdk.android.A JitPack outage can no longer fail a build that does not depend on JitPack.