ci: keep verify-flatpak's vendored Gradle dist in lockstep with the wrapper

[jamesarich]

Renovate wrapper bumps kept breaking the offline flatpak build silently: #6777 bumped the wrapper to 9.7.1 without touching the vendored distribution pin in scripts/verify-flatpak/desktop-offline.yaml, and every PR that triggered verify-flatpak then failed both build-flatpak arches 15+ minutes in with "Verification of Gradle distribution failed!" (hand-fixed by #6782). This wires the two files together so they cannot drift silently again. Rebased on #6782, so the manifest change here is only the pin-comment update.

🧹 Chores

• Renovate custom manager (.github/renovate.json): mirrors gradle-wrapper.properties bumps into the manifest's distribution URL. It shares depName gradle and the gradle-version datasource with the built-in gradle-wrapper manager, so both files update in the same Renovate branch/PR. The sha256: line cannot be auto-updated: the gradle-version datasource has no digest support and the hosted Mend app disallows postUpgradeTasks, so the sha still needs a one-line hand copy from distributionSha256Sum.
• 9.7.0 block rule now matches by depName across both managers, so the new custom manager can never propose a wrapper-blocked version on its own.
• Fail-fast guard at the top of generate-sources in verify-flatpak.yml: compares the manifest's dist filename (version AND flavor) and sha256 against gradle-wrapper.properties, failing in seconds with an error that names both files and where the correct sha lives. A wrapper-bump PR now goes red at the guard instead of after two full flatpak builds.
• Manifest pin comment updated to document the coupling (Renovate bumps the URL, the sha is copied by hand, CI guards the pair).

Note: the guard makes drift loud and early, but it only hard-blocks automerge if verify-flatpak is enforced; #6777 landed with the workflow red.

Testing Performed

• renovate-config-validator on Renovate 44.35.2 (current hosted line): config validates clean. An older cached 37.x rejects managerFilePatterns, so the validation was rerun against latest deliberately.
• The custom manager's matchStrings regex tested against the manifest: extracts exactly 9.7.1 and does not match dest-filename: "gradle-bin.zip".
• Guard script extracted verbatim from the workflow YAML and exercised in three states: in-sync (passes), the 9.6.1 vs 9.7.1 drift that was on main before fix(ci): bump verify-flatpak's vendored Gradle dist to 9.7.1 to match the wrapper #6782 (fails with the full message), and the future Renovate case of URL bumped with a stale sha (fails).
• Guard step passed on the PR's own verify-flatpak run (run 32317760527) before the rebase.
• actionlint and shellcheck clean.
• No Kotlin or build files touched, so no Gradle verification needed (Spotless targets only Kotlin sources).

🤖 Generated with Claude Code

[coderabbitai]

Warning

Review limit reached

@jamesarich, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 13 minutes

Limit details: You’ve used all 4 included reviews currently available.

You've used all free OSS reviews for now. Wait for the free limit to reset to keep reviewing this public repository.

How can I continue?

Wait for the limit to reset, then comment @coderabbitai review or push new commits to the PR.

An organization admin can change what happens after included review limits in Billing.

How do review limits work?

CodeRabbit enforces per-developer PR review limits within each organization.

For paid Pro and Pro+ reviews, CodeRabbit uses a developer's included PR review attempts over the past 7 days to set the current hourly allowance. At typical activity levels, the full plan allowance applies. Higher sustained activity can lower the allowance until earlier attempts leave the 7-day window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: bd17fe67-782a-4d71-9fe4-72864c42919b

📥 Commits

Reviewing files that changed from the base of the PR and between afffc5c and 8ca9b9e.

📒 Files selected for processing (3)

• .github/renovate.json
• .github/workflows/verify-flatpak.yml
• scripts/verify-flatpak/desktop-offline.yaml

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[codecov]

⚠️ JUnit XML file not found

The CLI was unable to find any JUnit XML files to upload.
For more help, visit our troubleshooting guide.