fix(ci): bump verify-flatpak's vendored Gradle dist to 9.7.1 to match the wrapper - #6782
Conversation
… the wrapper The offline flatpak build vendors the exact Gradle distribution named in gradle-wrapper.properties, and the wrapper verifies it against distributionSha256Sum. #6777 bumped the wrapper to 9.7.1 without the coupled pin here, so every PR now fails both build-flatpak arches with a checksum mismatch (expected 9.7.1's acd53f…, got the vendored 9.6.1's 9c0f7f…). Renovate manages the wrapper but has no manager for this yaml. Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
|
No actionable comments were generated in the recent review. 🎉 ℹ️ Recent review info⚙️ Run configurationConfiguration used: Path: .coderabbit.yaml Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
Included review availability: Your plan provides up to 4 included reviews per hour; 0 remain after this review. 📝 WalkthroughWalkthroughThe offline Flatpak configuration updates its bundled Gradle binary from version 9.6.1 to 9.7.1 and replaces the SHA-256 checksum. ChangesGradle bundle update
Estimated code review effort: 1 (Trivial) | ~2 minutes Merge Risk: ⚪ Minimal · up to The vendored Gradle distribution and checksum are updated to match the wrapper, restoring the offline Flatpak verification path. No actionable merge-blocking risk remains after normal checks and review. Suggested reviewers: 🚥 Pre-merge checks | ✅ 8✅ Passed checks (8 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
…rapper The offline flatpak manifest vendors the exact gradle-<version>-bin.zip that gradle-wrapper.properties pins, verified by distributionSha256Sum. When Renovate bumped the wrapper to 9.7.1 (#6777) without this file, every PR touching the trigger paths failed both build-flatpak arches 15+ minutes in with "Verification of Gradle distribution failed!". - Add a Renovate custom manager that mirrors wrapper bumps into the manifest's distribution URL in the same PR (shared depName "gradle"). The sha256 cannot be auto-updated: the gradle-version datasource has no digest support and the hosted app disallows postUpgradeTasks. - Extend the 9.7.0 block rule to match by depName so the custom manager can never propose the blocked version on its own. - Add a guard step at the top of generate-sources that diffs the manifest's dist filename and sha256 against the wrapper and fails in seconds with a message naming both files, instead of silently letting the drift through to the flatpak build. - Bump the vendored dist to 9.7.1 (same content as #6782) so the guard passes regardless of merge order. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
…rapper The offline flatpak manifest vendors the exact gradle-<version>-bin.zip that gradle-wrapper.properties pins, verified by distributionSha256Sum. When Renovate bumped the wrapper to 9.7.1 (#6777) without this file, every PR touching the trigger paths failed both build-flatpak arches 15+ minutes in with "Verification of Gradle distribution failed!" (hand-fixed by #6782). - Add a Renovate custom manager that mirrors wrapper bumps into the manifest's distribution URL in the same PR (shared depName "gradle"). The sha256 cannot be auto-updated: the gradle-version datasource has no digest support and the hosted app disallows postUpgradeTasks. - Extend the 9.7.0 block rule to match by depName so the custom manager can never propose the blocked version on its own. - Add a guard step at the top of generate-sources that diffs the manifest's dist filename and sha256 against the wrapper and fails in seconds with a message naming both files, instead of silently letting the drift through to the flatpak build. - Update the manifest's pin comment to document the new coupling. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
Why
#6777 bumped
gradle-wrapper.propertiesto Gradle 9.7.1, butscripts/verify-flatpak/desktop-offline.yamlvendors the distribution zip for the offline flatpak build and stayed at 9.6.1 — its own comment says "Update together." The wrapper now verifies the vendored zip against 9.7.1's checksum and fails: every PR since the bump fails bothbuild-flatpakarches withExpected acd53f… / Actual 9c0f7f…(observed on #6779 andrenovate/gradle-9.x).🛠️ Change
One coupled pin:
url→gradle-9.7.1-bin.zip,sha256→acd53f1e…(the same valuedistributionSha256Sumon main verifies every wrapper download against).Renovate has no manager for this yaml — follow-up candidate: a
customManagersregex entry so the next wrapper bump updates both sides atomically.Testing Performed
Pin now matches main's
gradle-wrapper.propertiesexactly (version,-binflavor, sha). Verification is this PR's ownbuild-flatpakchecks, which exercise the changed path directly — they fail on main's tip without this change.🤖 Generated with Claude Code
Summary by CodeRabbit