From 28a77bc4a75665336abf8531a4a701b2c9402d45 Mon Sep 17 00:00:00 2001 From: soloturn Date: Sat, 22 Aug 2026 14:34:14 +0200 Subject: [PATCH 1/4] build: add nebula.release versioning and dependency locking --- build.gradle.kts | 30 +++++++++++++++++++ buildscript-gradle.lockfile | 9 ++++++ cr-core/gradle.lockfile | 56 +++++++++++++++++++++++++++++++++++ cr-destsol/gradle.lockfile | 18 +++++++++++ cr-terasology/gradle.lockfile | 18 +++++++++++ 5 files changed, 131 insertions(+) create mode 100644 buildscript-gradle.lockfile create mode 100644 cr-core/gradle.lockfile create mode 100644 cr-destsol/gradle.lockfile create mode 100644 cr-terasology/gradle.lockfile diff --git a/build.gradle.kts b/build.gradle.kts index f344325..da41713 100644 --- a/build.gradle.kts +++ b/build.gradle.kts @@ -1,9 +1,20 @@ // Copyright 2021 The Terasology Foundation // SPDX-License-Identifier: Apache-2.0 +buildscript { + repositories { + mavenCentral() + gradlePluginPortal() + } + configurations.classpath { + resolutionStrategy.activateDependencyLocking() + } +} + // For generating IntelliJ project files plugins { idea + id("nebula.release") version "21.0.0" } tasks.wrapper { @@ -16,3 +27,22 @@ group = "org.terasology" subprojects { group = "org.terasology.crashreporter" } + +// Pass -PnoLock to resolve every dependency range fresh against whatever version satisfies it in +// Gradle's already-cached repository metadata (which is itself refreshed at most once per 24h for a +// dynamic version - add --refresh-dependencies too if you need to force a check past that), ignoring +// gradle.lockfile entirely for that one build - useful for locally trying out an update before +// committing to it. Since locking isn't activated at all in that case, nothing gets checked against +// or written to the lockfile either. +// +// Locks every resolvable configuration (compileClasspath, runtimeClasspath, the test and +// annotationProcessor classpaths, etc.), not just compileClasspath - otherwise dependencies unique +// to those other configurations could still silently float to a newer version picked up from their +// declared range, undermining the "everyone's build uses the same versions" guarantee this is for. +if (!project.hasProperty("noLock")) { + subprojects { + dependencyLocking { + lockAllConfigurations() + } + } +} diff --git a/buildscript-gradle.lockfile b/buildscript-gradle.lockfile new file mode 100644 index 0000000..d22fb49 --- /dev/null +++ b/buildscript-gradle.lockfile @@ -0,0 +1,9 @@ +# This is a Gradle generated file for dependency locking. +# Manual edits can break the build and are not advised. +# This file is expected to be part of source control. +# To regenerate this file, run: ./gradlew dependencies --write-locks +com.fasterxml.jackson:jackson-bom:2.14.2=classpath +com.github.zafarkhaja:java-semver:0.9.0=classpath +com.netflix.nebula:nebula-release-plugin:21.0.0=classpath +nebula.release:nebula.release.gradle.plugin:21.0.0=classpath +empty= diff --git a/cr-core/gradle.lockfile b/cr-core/gradle.lockfile new file mode 100644 index 0000000..527e0d3 --- /dev/null +++ b/cr-core/gradle.lockfile @@ -0,0 +1,56 @@ +# This is a Gradle generated file for dependency locking. +# Manual edits can break the build and are not advised. +# This file is expected to be part of source control. +# To regenerate this file, run: ./gradlew :cr-core:dependencies --write-locks +ch.qos.logback:logback-classic:1.6.0=testRuntimeClasspath +ch.qos.logback:logback-core:1.6.0=testRuntimeClasspath +com.github.oowekyala.ooxml:nice-xml-messages:3.1=pmd +com.google.code.findbugs:jsr305:3.0.2=checkstyle,compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.google.code.gson:gson:2.8.9=pmd +com.google.errorprone:error_prone_annotations:2.11.0=checkstyle,compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.google.guava:failureaccess:1.0.1=checkstyle,compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.google.guava:guava:31.1-jre=checkstyle,compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=checkstyle,compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.google.j2objc:j2objc-annotations:1.3=checkstyle,compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.puppycrawl.tools:checkstyle:10.2=checkstyle +commons-beanutils:commons-beanutils:1.9.4=checkstyle +commons-codec:commons-codec:1.11=checkstyle,compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +commons-collections:commons-collections:3.2.2=checkstyle +commons-logging:commons-logging:1.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +info.picocli:picocli:4.6.3=checkstyle +net.bytebuddy:byte-buddy-agent:1.17.7=testCompileClasspath,testRuntimeClasspath +net.bytebuddy:byte-buddy:1.17.7=testCompileClasspath,testRuntimeClasspath +net.sf.saxon:Saxon-HE:10.7=pmd +net.sf.saxon:Saxon-HE:11.3=checkstyle +net.sourceforge.pmd:pmd-ant:7.0.0-rc4=pmd +net.sourceforge.pmd:pmd-core:7.0.0-rc4=pmd +net.sourceforge.pmd:pmd-java:7.0.0-rc4=pmd +org.antlr:antlr4-runtime:4.10.1=checkstyle +org.antlr:antlr4-runtime:4.9.1=pmd +org.apache.commons:commons-lang3:3.8.1=pmd +org.apache.httpcomponents:httpclient:4.5.13=checkstyle,compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +org.apache.httpcomponents:httpcore:4.4.13=checkstyle,compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +org.apache.httpcomponents:httpmime:4.5.13=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +org.apiguardian:apiguardian-api:1.1.2=testCompileClasspath +org.checkerframework:checker-qual:2.5.2=pmd +org.checkerframework:checker-qual:3.12.0=checkstyle,compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +org.javassist:javassist:3.28.0-GA=checkstyle +org.junit.jupiter:junit-jupiter-api:5.10.1=testCompileClasspath,testRuntimeClasspath +org.junit.jupiter:junit-jupiter-engine:5.10.1=testRuntimeClasspath +org.junit.jupiter:junit-jupiter-params:5.10.1=testCompileClasspath,testRuntimeClasspath +org.junit.platform:junit-platform-commons:1.10.1=testCompileClasspath,testRuntimeClasspath +org.junit.platform:junit-platform-engine:1.10.1=testRuntimeClasspath +org.junit.platform:junit-platform-launcher:1.10.1=testRuntimeClasspath +org.junit:junit-bom:5.10.1=testCompileClasspath,testRuntimeClasspath +org.mockito:mockito-core:5.23.0=testCompileClasspath,testRuntimeClasspath +org.objenesis:objenesis:3.3=testRuntimeClasspath +org.opentest4j:opentest4j:1.3.0=testCompileClasspath,testRuntimeClasspath +org.ow2.asm:asm:9.5=pmd +org.pcollections:pcollections:3.1.3=pmd +org.reflections:reflections:0.10.2=checkstyle +org.slf4j:jul-to-slf4j:1.7.36=pmd +org.slf4j:slf4j-api:2.0.18=testCompileClasspath,testRuntimeClasspath +org.terasology.config:codemetrics:2.2.0=codeMetrics +org.xmlresolver:xmlresolver:4.2.0=checkstyle +org:jpastebin:1.0.1=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +empty=annotationProcessor,testAnnotationProcessor diff --git a/cr-destsol/gradle.lockfile b/cr-destsol/gradle.lockfile new file mode 100644 index 0000000..449c26e --- /dev/null +++ b/cr-destsol/gradle.lockfile @@ -0,0 +1,18 @@ +# This is a Gradle generated file for dependency locking. +# Manual edits can break the build and are not advised. +# This file is expected to be part of source control. +# To regenerate this file, run: ./gradlew :cr-destsol:dependencies --write-locks +com.google.code.findbugs:jsr305:3.0.2=runtimeClasspath,testRuntimeClasspath +com.google.errorprone:error_prone_annotations:2.11.0=runtimeClasspath,testRuntimeClasspath +com.google.guava:failureaccess:1.0.1=runtimeClasspath,testRuntimeClasspath +com.google.guava:guava:31.1-jre=runtimeClasspath,testRuntimeClasspath +com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=runtimeClasspath,testRuntimeClasspath +com.google.j2objc:j2objc-annotations:1.3=runtimeClasspath,testRuntimeClasspath +commons-codec:commons-codec:1.11=runtimeClasspath,testRuntimeClasspath +commons-logging:commons-logging:1.2=runtimeClasspath,testRuntimeClasspath +org.apache.httpcomponents:httpclient:4.5.13=runtimeClasspath,testRuntimeClasspath +org.apache.httpcomponents:httpcore:4.4.13=runtimeClasspath,testRuntimeClasspath +org.apache.httpcomponents:httpmime:4.5.13=runtimeClasspath,testRuntimeClasspath +org.checkerframework:checker-qual:3.12.0=runtimeClasspath,testRuntimeClasspath +org:jpastebin:1.0.1=runtimeClasspath,testRuntimeClasspath +empty=annotationProcessor,compileClasspath,testAnnotationProcessor,testCompileClasspath diff --git a/cr-terasology/gradle.lockfile b/cr-terasology/gradle.lockfile new file mode 100644 index 0000000..6d93355 --- /dev/null +++ b/cr-terasology/gradle.lockfile @@ -0,0 +1,18 @@ +# This is a Gradle generated file for dependency locking. +# Manual edits can break the build and are not advised. +# This file is expected to be part of source control. +# To regenerate this file, run: ./gradlew :cr-terasology:dependencies --write-locks +com.google.code.findbugs:jsr305:3.0.2=runtimeClasspath,testRuntimeClasspath +com.google.errorprone:error_prone_annotations:2.11.0=runtimeClasspath,testRuntimeClasspath +com.google.guava:failureaccess:1.0.1=runtimeClasspath,testRuntimeClasspath +com.google.guava:guava:31.1-jre=runtimeClasspath,testRuntimeClasspath +com.google.guava:listenablefuture:9999.0-empty-to-avoid-conflict-with-guava=runtimeClasspath,testRuntimeClasspath +com.google.j2objc:j2objc-annotations:1.3=runtimeClasspath,testRuntimeClasspath +commons-codec:commons-codec:1.11=runtimeClasspath,testRuntimeClasspath +commons-logging:commons-logging:1.2=runtimeClasspath,testRuntimeClasspath +org.apache.httpcomponents:httpclient:4.5.13=runtimeClasspath,testRuntimeClasspath +org.apache.httpcomponents:httpcore:4.4.13=runtimeClasspath,testRuntimeClasspath +org.apache.httpcomponents:httpmime:4.5.13=runtimeClasspath,testRuntimeClasspath +org.checkerframework:checker-qual:3.12.0=runtimeClasspath,testRuntimeClasspath +org:jpastebin:1.0.1=runtimeClasspath,testRuntimeClasspath +empty=annotationProcessor,compileClasspath,testAnnotationProcessor,testCompileClasspath From b0aed3733d0ac9df59c9a45b035fc208ada0bd6a Mon Sep 17 00:00:00 2001 From: Cervator Date: Mon, 28 Sep 2026 11:19:44 -0400 Subject: [PATCH 2/4] build: keep dependency locking, drop nebula.release Terasology, gestalt and this repo all version from a hand-edited SNAPSHOT string that Jenkins publishes from long-lived branches. nebula.release would make CrashReporter the one Maven-published repo versioned from git tags, and a plain `publish` on master would ship `5.2.0-dev.N+sha` in place of today's `5.2.0-SNAPSHOT`. Locking stands on its own. Co-Authored-By: Claude Fable 5.1 --- build.gradle.kts | 1 - buildscript-gradle.lockfile | 6 +----- 2 files changed, 1 insertion(+), 6 deletions(-) diff --git a/build.gradle.kts b/build.gradle.kts index da41713..63a4308 100644 --- a/build.gradle.kts +++ b/build.gradle.kts @@ -14,7 +14,6 @@ buildscript { // For generating IntelliJ project files plugins { idea - id("nebula.release") version "21.0.0" } tasks.wrapper { diff --git a/buildscript-gradle.lockfile b/buildscript-gradle.lockfile index d22fb49..3799ce8 100644 --- a/buildscript-gradle.lockfile +++ b/buildscript-gradle.lockfile @@ -2,8 +2,4 @@ # Manual edits can break the build and are not advised. # This file is expected to be part of source control. # To regenerate this file, run: ./gradlew dependencies --write-locks -com.fasterxml.jackson:jackson-bom:2.14.2=classpath -com.github.zafarkhaja:java-semver:0.9.0=classpath -com.netflix.nebula:nebula-release-plugin:21.0.0=classpath -nebula.release:nebula.release.gradle.plugin:21.0.0=classpath -empty= +empty=classpath From 51e076f38ae833eb727cf2689a58dcefab78e7ff Mon Sep 17 00:00:00 2001 From: Cervator Date: Wed, 30 Sep 2026 10:52:09 -0400 Subject: [PATCH 3/4] build: regenerate lockfiles for the Jackson dependencies from #70 Jenkins PR-68 #7 failed lock verification on `jackson-bom`, `jackson-core`, `jackson-databind`, `jackson-annotations` once master carried #70. Rebased onto master, then `./gradlew dependencies --write-locks` per project. Co-Authored-By: Claude Fable 5.1 --- cr-core/gradle.lockfile | 4 ++++ cr-destsol/gradle.lockfile | 4 ++++ cr-terasology/gradle.lockfile | 4 ++++ 3 files changed, 12 insertions(+) diff --git a/cr-core/gradle.lockfile b/cr-core/gradle.lockfile index 527e0d3..b7d2293 100644 --- a/cr-core/gradle.lockfile +++ b/cr-core/gradle.lockfile @@ -4,6 +4,10 @@ # To regenerate this file, run: ./gradlew :cr-core:dependencies --write-locks ch.qos.logback:logback-classic:1.6.0=testRuntimeClasspath ch.qos.logback:logback-core:1.6.0=testRuntimeClasspath +com.fasterxml.jackson.core:jackson-annotations:2.22=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.fasterxml.jackson.core:jackson-core:2.22.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.fasterxml.jackson.core:jackson-databind:2.22.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath +com.fasterxml.jackson:jackson-bom:2.22.2=compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath com.github.oowekyala.ooxml:nice-xml-messages:3.1=pmd com.google.code.findbugs:jsr305:3.0.2=checkstyle,compileClasspath,runtimeClasspath,testCompileClasspath,testRuntimeClasspath com.google.code.gson:gson:2.8.9=pmd diff --git a/cr-destsol/gradle.lockfile b/cr-destsol/gradle.lockfile index 449c26e..815da04 100644 --- a/cr-destsol/gradle.lockfile +++ b/cr-destsol/gradle.lockfile @@ -2,6 +2,10 @@ # Manual edits can break the build and are not advised. # This file is expected to be part of source control. # To regenerate this file, run: ./gradlew :cr-destsol:dependencies --write-locks +com.fasterxml.jackson.core:jackson-annotations:2.22=runtimeClasspath,testRuntimeClasspath +com.fasterxml.jackson.core:jackson-core:2.22.2=runtimeClasspath,testRuntimeClasspath +com.fasterxml.jackson.core:jackson-databind:2.22.2=runtimeClasspath,testRuntimeClasspath +com.fasterxml.jackson:jackson-bom:2.22.2=runtimeClasspath,testRuntimeClasspath com.google.code.findbugs:jsr305:3.0.2=runtimeClasspath,testRuntimeClasspath com.google.errorprone:error_prone_annotations:2.11.0=runtimeClasspath,testRuntimeClasspath com.google.guava:failureaccess:1.0.1=runtimeClasspath,testRuntimeClasspath diff --git a/cr-terasology/gradle.lockfile b/cr-terasology/gradle.lockfile index 6d93355..5c825ee 100644 --- a/cr-terasology/gradle.lockfile +++ b/cr-terasology/gradle.lockfile @@ -2,6 +2,10 @@ # Manual edits can break the build and are not advised. # This file is expected to be part of source control. # To regenerate this file, run: ./gradlew :cr-terasology:dependencies --write-locks +com.fasterxml.jackson.core:jackson-annotations:2.22=runtimeClasspath,testRuntimeClasspath +com.fasterxml.jackson.core:jackson-core:2.22.2=runtimeClasspath,testRuntimeClasspath +com.fasterxml.jackson.core:jackson-databind:2.22.2=runtimeClasspath,testRuntimeClasspath +com.fasterxml.jackson:jackson-bom:2.22.2=runtimeClasspath,testRuntimeClasspath com.google.code.findbugs:jsr305:3.0.2=runtimeClasspath,testRuntimeClasspath com.google.errorprone:error_prone_annotations:2.11.0=runtimeClasspath,testRuntimeClasspath com.google.guava:failureaccess:1.0.1=runtimeClasspath,testRuntimeClasspath From 11f5ff34523844a2ae07ae40eba6d4dc225cebd9 Mon Sep 17 00:00:00 2001 From: Cervator Date: Wed, 30 Sep 2026 14:00:26 -0400 Subject: [PATCH 4/4] build: pin lockfiles to LF so Windows clones stop reporting them dirty Seen on a Windows clone with `core.autocrlf=true`: every `--write-locks` left `buildscript-gradle.lockfile` flagged modified with an empty diff, because Gradle emits LF and Git expected CRLF. Co-Authored-By: Claude Fable 5.1 --- .gitattributes | 3 +++ 1 file changed, 3 insertions(+) create mode 100644 .gitattributes diff --git a/.gitattributes b/.gitattributes new file mode 100644 index 0000000..1d382a1 --- /dev/null +++ b/.gitattributes @@ -0,0 +1,3 @@ +# Gradle writes lockfiles with LF on every --write-locks; without this, a Windows clone with +# core.autocrlf=true reports them modified after each regeneration even when nothing changed. +*.lockfile text eol=lf