Add Gradle Lock files (#2983)

Motivation:

Lock files will help us see what dependencies are used by every module. When we bump any dependency, it will also show what transitive dependencies are upgraded automatically.
See: https://docs.gradle.org/current/userguide/dependency_locking.html 

Modifications:

- Update main `build.gradle` to activate dependency locking;
- Add `check-lockfiles.sh` script for PRQ validation;
- Add `ci-prq.yml` step to run `check-lockfiles.sh`;
- Generate initial lockfiles;

Result:

We will be able to observe how dependency updates change all transitive dependencies.

.github/workflows/ci-prq.yml

@@ -24,6 +24,8 @@ jobs:
         run: chmod +x gradlew
       - name: Documentation Linter
         run: bash scripts/check-source-root.sh
+      - name: Gradle lockfiles validation
+        run: bash scripts/check-lockfiles.sh
       - name: Clean Gradle project
         run: ./gradlew --parallel clean
       - name: Build with Gradle

build.gradle

@@ -67,4 +67,35 @@ subprojects {
       }
     }
   }
+
+  // Configure dependency locking: https://docs.gradle.org/current/userguide/dependency_locking.html
+  dependencyLocking {
+    lockMode = LockMode.STRICT
+  }
+
+  configurations {
+    annotationProcessor {
+      resolutionStrategy.activateDependencyLocking()
+    }
+    compileClasspath {
+      resolutionStrategy.activateDependencyLocking()
+    }
+    runtimeClasspath {
+      resolutionStrategy.activateDependencyLocking()
+    }
+  }
+
+  tasks.register("resolveAndLockAll") {
+    notCompatibleWithConfigurationCache("Filters configurations at execution time")
+    doFirst {
+      assert gradle.startParameter.writeDependencyLocks :
+          "$path must be run from the command line with the `--write-locks` flag"
+    }
+    doLast {
+      configurations.findAll {
+        // Add any custom filtering on the configurations to be resolved
+        it.canBeResolved
+      }.each { it.resolve() }
+    }
+  }
 }

scripts/check-lockfiles.sh

@@ -0,0 +1,31 @@
+#!/bin/bash
+#
+# Copyright © 2024 Apple Inc. and the ServiceTalk project authors
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#   http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+#
+
+set -eu
+
+./gradlew resolveAndLockAll --write-locks
+echo ""
+
+status=$(git status --porcelain | grep 'gradle.lockfile' || true)
+if [ -n "$status" ]; then
+  echo "You MUST regenerate lockfiles using: ./gradlew resolveAndLockAll --write-locks"
+  echo "The following files are not updated:"
+  echo "$status"
+  exit 1
+else
+  echo "All Gradle lockfiles are up to date"
+fi

servicetalk-annotations/gradle.lockfile

@@ -0,0 +1,10 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.fasterxml.jackson:jackson-bom:2.16.2=compileClasspath,runtimeClasspath
+com.google.code.findbugs:jsr305:3.0.2=compileClasspath,runtimeClasspath
+com.google.protobuf:protobuf-bom:3.25.3=compileClasspath,runtimeClasspath
+io.netty:netty-bom:4.1.112.Final=compileClasspath,runtimeClasspath
+org.apache.logging.log4j:log4j-bom:2.23.1=compileClasspath,runtimeClasspath
+org.glassfish.jersey:jersey-bom:2.41=compileClasspath,runtimeClasspath
+empty=annotationProcessor,spotbugsPlugins,testAnnotationProcessor

servicetalk-benchmarks/gradle.lockfile

@@ -0,0 +1,39 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.fasterxml.jackson.core:jackson-annotations:2.16.2=compileClasspath,runtimeClasspath
+com.fasterxml.jackson.core:jackson-core:2.16.2=compileClasspath,runtimeClasspath
+com.fasterxml.jackson.core:jackson-databind:2.16.2=compileClasspath,runtimeClasspath
+com.fasterxml.jackson:jackson-bom:2.16.2=compileClasspath,runtimeClasspath
+com.google.code.findbugs:jsr305:3.0.2=compileClasspath,runtimeClasspath
+com.google.protobuf:protobuf-bom:3.25.3=compileClasspath,runtimeClasspath
+io.netty.incubator:netty-incubator-transport-classes-io_uring:0.0.25.Final=runtimeClasspath
+io.netty.incubator:netty-incubator-transport-native-io_uring:0.0.25.Final=runtimeClasspath
+io.netty:netty-bom:4.1.112.Final=compileClasspath,runtimeClasspath
+io.netty:netty-buffer:4.1.112.Final=compileClasspath,runtimeClasspath
+io.netty:netty-codec-dns:4.1.112.Final=runtimeClasspath
+io.netty:netty-codec-http2:4.1.112.Final=runtimeClasspath
+io.netty:netty-codec-http:4.1.112.Final=compileClasspath,runtimeClasspath
+io.netty:netty-codec:4.1.112.Final=compileClasspath,runtimeClasspath
+io.netty:netty-common:4.1.112.Final=compileClasspath,runtimeClasspath
+io.netty:netty-handler:4.1.112.Final=compileClasspath,runtimeClasspath
+io.netty:netty-resolver-dns-classes-macos:4.1.112.Final=runtimeClasspath
+io.netty:netty-resolver-dns-native-macos:4.1.112.Final=runtimeClasspath
+io.netty:netty-resolver-dns:4.1.112.Final=runtimeClasspath
+io.netty:netty-resolver:4.1.112.Final=compileClasspath,runtimeClasspath
+io.netty:netty-tcnative-boringssl-static:2.0.65.Final=runtimeClasspath
+io.netty:netty-tcnative-classes:2.0.65.Final=runtimeClasspath
+io.netty:netty-transport-classes-epoll:4.1.112.Final=runtimeClasspath
+io.netty:netty-transport-classes-kqueue:4.1.112.Final=runtimeClasspath
+io.netty:netty-transport-native-epoll:4.1.112.Final=runtimeClasspath
+io.netty:netty-transport-native-kqueue:4.1.112.Final=runtimeClasspath
+io.netty:netty-transport-native-unix-common:4.1.112.Final=compileClasspath,runtimeClasspath
+io.netty:netty-transport:4.1.112.Final=compileClasspath,runtimeClasspath
+net.sf.jopt-simple:jopt-simple:5.0.4=compileClasspath,runtimeClasspath
+org.apache.commons:commons-math3:3.6.1=compileClasspath,runtimeClasspath
+org.apache.logging.log4j:log4j-bom:2.23.1=compileClasspath,runtimeClasspath
+org.glassfish.jersey:jersey-bom:2.41=compileClasspath,runtimeClasspath
+org.jctools:jctools-core:4.0.3=runtimeClasspath
+org.openjdk.jmh:jmh-core:1.37=compileClasspath,runtimeClasspath
+org.slf4j:slf4j-api:1.7.36=runtimeClasspath
+empty=annotationProcessor,jmhAnnotationProcessor,shadow,spotbugsPlugins,testAnnotationProcessor

servicetalk-bom/gradle.lockfile

@@ -0,0 +1,4 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+empty=annotationProcessor,classpath,compileClasspath,runtimeClasspath,testAnnotationProcessor,testCompileClasspath,testRuntimeClasspath

servicetalk-buffer-api/gradle.lockfile

@@ -0,0 +1,10 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.fasterxml.jackson:jackson-bom:2.16.2=compileClasspath,runtimeClasspath
+com.google.code.findbugs:jsr305:3.0.2=compileClasspath,runtimeClasspath
+com.google.protobuf:protobuf-bom:3.25.3=compileClasspath,runtimeClasspath
+io.netty:netty-bom:4.1.112.Final=compileClasspath,runtimeClasspath
+org.apache.logging.log4j:log4j-bom:2.23.1=compileClasspath,runtimeClasspath
+org.glassfish.jersey:jersey-bom:2.41=compileClasspath,runtimeClasspath
+empty=annotationProcessor,spotbugsPlugins,testAnnotationProcessor,testFixturesAnnotationProcessor

servicetalk-buffer-netty/gradle.lockfile

@@ -0,0 +1,14 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.fasterxml.jackson:jackson-bom:2.16.2=compileClasspath,runtimeClasspath
+com.google.code.findbugs:jsr305:3.0.2=compileClasspath,runtimeClasspath
+com.google.protobuf:protobuf-bom:3.25.3=compileClasspath,runtimeClasspath
+io.netty:netty-bom:4.1.112.Final=compileClasspath,runtimeClasspath
+io.netty:netty-buffer:4.1.112.Final=compileClasspath,runtimeClasspath
+io.netty:netty-common:4.1.112.Final=compileClasspath,runtimeClasspath
+org.apache.logging.log4j:log4j-bom:2.23.1=compileClasspath,runtimeClasspath
+org.glassfish.jersey:jersey-bom:2.41=compileClasspath,runtimeClasspath
+org.jctools:jctools-core:4.0.3=runtimeClasspath
+org.slf4j:slf4j-api:1.7.36=compileClasspath,runtimeClasspath
+empty=annotationProcessor,spotbugsPlugins,testAnnotationProcessor

servicetalk-capacity-limiter-api/gradle.lockfile

@@ -0,0 +1,12 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.fasterxml.jackson:jackson-bom:2.16.2=compileClasspath,runtimeClasspath
+com.google.code.findbugs:jsr305:3.0.2=compileClasspath,runtimeClasspath
+com.google.protobuf:protobuf-bom:3.25.3=compileClasspath,runtimeClasspath
+io.netty:netty-bom:4.1.112.Final=compileClasspath,runtimeClasspath
+org.apache.logging.log4j:log4j-bom:2.23.1=compileClasspath,runtimeClasspath
+org.glassfish.jersey:jersey-bom:2.41=compileClasspath,runtimeClasspath
+org.jctools:jctools-core:4.0.3=runtimeClasspath
+org.slf4j:slf4j-api:1.7.36=compileClasspath,runtimeClasspath
+empty=annotationProcessor,spotbugsPlugins,testAnnotationProcessor

servicetalk-circuit-breaker-api/gradle.lockfile

@@ -0,0 +1,10 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.fasterxml.jackson:jackson-bom:2.16.2=runtimeClasspath
+com.google.code.findbugs:jsr305:3.0.2=runtimeClasspath
+com.google.protobuf:protobuf-bom:3.25.3=runtimeClasspath
+io.netty:netty-bom:4.1.112.Final=runtimeClasspath
+org.apache.logging.log4j:log4j-bom:2.23.1=runtimeClasspath
+org.glassfish.jersey:jersey-bom:2.41=runtimeClasspath
+empty=annotationProcessor,compileClasspath,spotbugsPlugins,testAnnotationProcessor

servicetalk-circuit-breaker-resilience4j/gradle.lockfile

@@ -0,0 +1,15 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.fasterxml.jackson:jackson-bom:2.16.2=compileClasspath,runtimeClasspath
+com.google.code.findbugs:jsr305:3.0.2=runtimeClasspath
+com.google.protobuf:protobuf-bom:3.25.3=compileClasspath,runtimeClasspath
+io.github.resilience4j:resilience4j-circuitbreaker:1.7.1=compileClasspath,runtimeClasspath
+io.github.resilience4j:resilience4j-core:1.7.1=compileClasspath,runtimeClasspath
+io.netty:netty-bom:4.1.112.Final=compileClasspath,runtimeClasspath
+io.vavr:vavr-match:0.10.2=compileClasspath,runtimeClasspath
+io.vavr:vavr:0.10.2=compileClasspath,runtimeClasspath
+org.apache.logging.log4j:log4j-bom:2.23.1=compileClasspath,runtimeClasspath
+org.glassfish.jersey:jersey-bom:2.41=compileClasspath,runtimeClasspath
+org.slf4j:slf4j-api:1.7.36=runtimeClasspath
+empty=annotationProcessor,spotbugsPlugins,testAnnotationProcessor

servicetalk-client-api-internal/gradle.lockfile

@@ -0,0 +1,12 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.fasterxml.jackson:jackson-bom:2.16.2=compileClasspath,runtimeClasspath
+com.google.code.findbugs:jsr305:3.0.2=compileClasspath,runtimeClasspath
+com.google.protobuf:protobuf-bom:3.25.3=compileClasspath,runtimeClasspath
+io.netty:netty-bom:4.1.112.Final=compileClasspath,runtimeClasspath
+org.apache.logging.log4j:log4j-bom:2.23.1=compileClasspath,runtimeClasspath
+org.glassfish.jersey:jersey-bom:2.41=compileClasspath,runtimeClasspath
+org.jctools:jctools-core:4.0.3=runtimeClasspath
+org.slf4j:slf4j-api:1.7.36=compileClasspath,runtimeClasspath
+empty=annotationProcessor,spotbugsPlugins,testAnnotationProcessor

servicetalk-client-api/gradle.lockfile

@@ -0,0 +1,12 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.fasterxml.jackson:jackson-bom:2.16.2=compileClasspath,runtimeClasspath
+com.google.code.findbugs:jsr305:3.0.2=compileClasspath,runtimeClasspath
+com.google.protobuf:protobuf-bom:3.25.3=compileClasspath,runtimeClasspath
+io.netty:netty-bom:4.1.112.Final=compileClasspath,runtimeClasspath
+org.apache.logging.log4j:log4j-bom:2.23.1=compileClasspath,runtimeClasspath
+org.glassfish.jersey:jersey-bom:2.41=compileClasspath,runtimeClasspath
+org.jctools:jctools-core:4.0.3=runtimeClasspath
+org.slf4j:slf4j-api:1.7.36=compileClasspath,runtimeClasspath
+empty=annotationProcessor,spotbugsPlugins,testAnnotationProcessor

servicetalk-concurrent-api-internal/gradle.lockfile

@@ -0,0 +1,12 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.fasterxml.jackson:jackson-bom:2.16.2=compileClasspath,runtimeClasspath
+com.google.code.findbugs:jsr305:3.0.2=compileClasspath,runtimeClasspath
+com.google.protobuf:protobuf-bom:3.25.3=compileClasspath,runtimeClasspath
+io.netty:netty-bom:4.1.112.Final=compileClasspath,runtimeClasspath
+org.apache.logging.log4j:log4j-bom:2.23.1=compileClasspath,runtimeClasspath
+org.glassfish.jersey:jersey-bom:2.41=compileClasspath,runtimeClasspath
+org.jctools:jctools-core:4.0.3=runtimeClasspath
+org.slf4j:slf4j-api:1.7.36=compileClasspath,runtimeClasspath
+empty=annotationProcessor,spotbugsPlugins,testAnnotationProcessor

servicetalk-concurrent-api-test/gradle.lockfile

@@ -0,0 +1,12 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.fasterxml.jackson:jackson-bom:2.16.2=compileClasspath,runtimeClasspath
+com.google.code.findbugs:jsr305:3.0.2=compileClasspath,runtimeClasspath
+com.google.protobuf:protobuf-bom:3.25.3=compileClasspath,runtimeClasspath
+io.netty:netty-bom:4.1.112.Final=compileClasspath,runtimeClasspath
+org.apache.logging.log4j:log4j-bom:2.23.1=compileClasspath,runtimeClasspath
+org.glassfish.jersey:jersey-bom:2.41=compileClasspath,runtimeClasspath
+org.jctools:jctools-core:4.0.3=runtimeClasspath
+org.slf4j:slf4j-api:1.7.36=runtimeClasspath
+empty=annotationProcessor,spotbugsPlugins,testAnnotationProcessor

servicetalk-concurrent-api/gradle.lockfile

@@ -0,0 +1,12 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.fasterxml.jackson:jackson-bom:2.16.2=compileClasspath,runtimeClasspath
+com.google.code.findbugs:jsr305:3.0.2=compileClasspath,runtimeClasspath
+com.google.protobuf:protobuf-bom:3.25.3=compileClasspath,runtimeClasspath
+io.netty:netty-bom:4.1.112.Final=compileClasspath,runtimeClasspath
+org.apache.logging.log4j:log4j-bom:2.23.1=compileClasspath,runtimeClasspath
+org.glassfish.jersey:jersey-bom:2.41=compileClasspath,runtimeClasspath
+org.jctools:jctools-core:4.0.3=runtimeClasspath
+org.slf4j:slf4j-api:1.7.36=compileClasspath,runtimeClasspath
+empty=annotationProcessor,spotbugsPlugins,testAnnotationProcessor,testFixturesAnnotationProcessor

servicetalk-concurrent-internal/gradle.lockfile

@@ -0,0 +1,12 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.fasterxml.jackson:jackson-bom:2.16.2=compileClasspath,runtimeClasspath
+com.google.code.findbugs:jsr305:3.0.2=compileClasspath,runtimeClasspath
+com.google.protobuf:protobuf-bom:3.25.3=compileClasspath,runtimeClasspath
+io.netty:netty-bom:4.1.112.Final=compileClasspath,runtimeClasspath
+org.apache.logging.log4j:log4j-bom:2.23.1=compileClasspath,runtimeClasspath
+org.glassfish.jersey:jersey-bom:2.41=compileClasspath,runtimeClasspath
+org.jctools:jctools-core:4.0.3=runtimeClasspath
+org.slf4j:slf4j-api:1.7.36=compileClasspath,runtimeClasspath
+empty=annotationProcessor,spotbugsPlugins,testAnnotationProcessor,testFixturesAnnotationProcessor

servicetalk-concurrent-jdkflow/gradle.lockfile

@@ -0,0 +1,12 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.fasterxml.jackson:jackson-bom:2.16.2=compileClasspath,runtimeClasspath
+com.google.code.findbugs:jsr305:3.0.2=compileClasspath,runtimeClasspath
+com.google.protobuf:protobuf-bom:3.25.3=compileClasspath,runtimeClasspath
+io.netty:netty-bom:4.1.112.Final=compileClasspath,runtimeClasspath
+org.apache.logging.log4j:log4j-bom:2.23.1=compileClasspath,runtimeClasspath
+org.glassfish.jersey:jersey-bom:2.41=compileClasspath,runtimeClasspath
+org.jctools:jctools-core:4.0.3=runtimeClasspath
+org.slf4j:slf4j-api:1.7.36=compileClasspath,runtimeClasspath
+empty=annotationProcessor,spotbugsPlugins,testAnnotationProcessor

servicetalk-concurrent-reactivestreams/gradle.lockfile

@@ -0,0 +1,15 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.fasterxml.jackson:jackson-bom:2.16.2=compileClasspath,runtimeClasspath
+com.google.code.findbugs:jsr305:3.0.2=compileClasspath,runtimeClasspath
+com.google.protobuf:protobuf-bom:3.25.3=compileClasspath,runtimeClasspath
+io.netty:netty-bom:4.1.112.Final=compileClasspath,runtimeClasspath
+io.netty:netty-buffer:4.1.112.Final=compileClasspath,runtimeClasspath
+io.netty:netty-common:4.1.112.Final=compileClasspath,runtimeClasspath
+org.apache.logging.log4j:log4j-bom:2.23.1=compileClasspath,runtimeClasspath
+org.glassfish.jersey:jersey-bom:2.41=compileClasspath,runtimeClasspath
+org.jctools:jctools-core:4.0.3=runtimeClasspath
+org.reactivestreams:reactive-streams:1.0.4=compileClasspath,runtimeClasspath
+org.slf4j:slf4j-api:1.7.36=compileClasspath,runtimeClasspath
+empty=annotationProcessor,spotbugsPlugins,testAnnotationProcessor,testFixturesAnnotationProcessor

servicetalk-concurrent-test-internal/gradle.lockfile

@@ -0,0 +1,12 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.fasterxml.jackson:jackson-bom:2.16.2=compileClasspath,runtimeClasspath
+com.google.code.findbugs:jsr305:3.0.2=compileClasspath,runtimeClasspath
+com.google.protobuf:protobuf-bom:3.25.3=compileClasspath,runtimeClasspath
+io.netty:netty-bom:4.1.112.Final=compileClasspath,runtimeClasspath
+org.apache.logging.log4j:log4j-bom:2.23.1=compileClasspath,runtimeClasspath
+org.glassfish.jersey:jersey-bom:2.41=compileClasspath,runtimeClasspath
+org.jctools:jctools-core:4.0.3=runtimeClasspath
+org.slf4j:slf4j-api:1.7.36=runtimeClasspath
+empty=annotationProcessor,spotbugsPlugins,testAnnotationProcessor

servicetalk-concurrent/gradle.lockfile

@@ -0,0 +1,10 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.fasterxml.jackson:jackson-bom:2.16.2=compileClasspath,runtimeClasspath
+com.google.code.findbugs:jsr305:3.0.2=compileClasspath,runtimeClasspath
+com.google.protobuf:protobuf-bom:3.25.3=compileClasspath,runtimeClasspath
+io.netty:netty-bom:4.1.112.Final=compileClasspath,runtimeClasspath
+org.apache.logging.log4j:log4j-bom:2.23.1=compileClasspath,runtimeClasspath
+org.glassfish.jersey:jersey-bom:2.41=compileClasspath,runtimeClasspath
+empty=annotationProcessor,spotbugsPlugins,testAnnotationProcessor

servicetalk-context-api/gradle.lockfile

@@ -0,0 +1,10 @@
+# This is a Gradle generated file for dependency locking.
+# Manual edits can break the build and are not advised.
+# This file is expected to be part of source control.
+com.fasterxml.jackson:jackson-bom:2.16.2=compileClasspath,runtimeClasspath
+com.google.code.findbugs:jsr305:3.0.2=compileClasspath,runtimeClasspath
+com.google.protobuf:protobuf-bom:3.25.3=compileClasspath,runtimeClasspath
+io.netty:netty-bom:4.1.112.Final=compileClasspath,runtimeClasspath
+org.apache.logging.log4j:log4j-bom:2.23.1=compileClasspath,runtimeClasspath
+org.glassfish.jersey:jersey-bom:2.41=compileClasspath,runtimeClasspath
+empty=annotationProcessor,spotbugsPlugins,testAnnotationProcessor