fix(build): pin Gradle back to 9.6.1 and block the 9.7 line

[jamesarich]

Why

Main CI went red on the first non-cancelled run after Renovate's Gradle 9.7.1 wrapper bump (#6777) merged. Every intermediate main run had been concurrency-cancelled by the merge train, so the bump landed effectively untested against the full main matrix. 9.7.1 does fix the 9.7.0 ExecSpec stdout crash that motivated the original 9.6.1 pin (gradle#38787 - macOS ran :desktopApp:proguardReleaseJars green), but it breaks main two new ways:

1. shard-core / shard-feature: both die in ~10s before running a single test - the configuration-cache fingerprint crashes on reload with Class 'org.jetbrains.kotlin.gradle.internal.IsInIdeaSyncValueSource' not found (settings-plugin classloader scope). This happened on an exact CC cache-key hit (same wrapper hash, same build-files hash), i.e. 9.7.1 cannot reread entries it wrote itself. The wrapper-hash segment in gradle-setup's cache key only guards against cross-version entries, so it cannot defend against this.
2. Build Desktop Debug (windows-latest): fresh configuration fails with an Isolated Projects violation - Plugin 'org.jetbrains.compose': Project ':desktopApp' cannot access 'Project.layout' functionality on another project ':'. Windows-only: the MSI/WiX packaging path is what touches root-project layout; macOS and Linux configured fresh on 9.7.1 and passed.

The bump also silently deleted the pin-back comment and the networkTimeout=30000 / retries=3 hardening from gradle-wrapper.properties.

Failing run: https://github.com/meshtastic/Meshtastic-Android/actions/runs/32318141116

What

• Restore the 9.6.1 wrapper: distribution URL + sha256, the pre-bump wrapper jar, the network hardening, and a rewritten pin comment documenting both new 9.7.1 breakages.
• Keep scripts/verify-flatpak/desktop-offline.yaml in lockstep (9.6.1 URL + sha256); the fail-fast guard from ci: keep verify-flatpak's vendored Gradle dist in lockstep with the wrapper #6785 passes locally.
• Widen the renovate block from !/^9\.7\.0$/ to !/^9\.7\./ so Renovate cannot re-propose any 9.7.x until the line proves out on both counts (CC entry reload + Windows packageDistributionForCurrentOS under Isolated Projects).
• Refresh the stale "until BaseExecSpec streams seem to no longer conform with API on Gradle 9.7.0 gradle/gradle#38787 ships in 9.7.1" comment in reusable-check.yml.

Reverting to 9.6.1 also changes the CC cache-key prefix, which makes the poisoned 9.7.1 configuration-cache entries unreachable - no manual cache purge needed.

Testing Performed

• Full local baseline on the reverted wrapper: spotlessApply spotlessCheck detekt assembleDebug test allTests - PASS, Gradle resolved 9.6.1, 6964 tests passed / 0 failed / 240 skipped.
• verify-flatpak lockstep guard logic run locally against the changed files: LOCKSTEP-OK (dist and sha256 match between wrapper properties and the offline manifest).
• renovate.json and both touched YAML files parse clean.

🤖 Generated with Claude Code

Summary by CodeRabbit

• Bug Fixes

  • Improved Android build reliability by pinning the build system to a compatible version.
  • Increased download retries and timeout settings to make setup more resilient.
  • Updated offline verification resources to use the matching build system version.

• Chores

  • Updated automated dependency management rules to prevent incompatible versions from being introduced.
  • Clarified build configuration notes and compatibility guidance.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 0a713889-31db-48f4-b8c8-3316b15e9ec0

📥 Commits

Reviewing files that changed from the base of the PR and between be7d685 and 6364e38.

⛔ Files ignored due to path filters (1)

• gradle/wrapper/gradle-wrapper.jar is excluded by !**/*.jar

📒 Files selected for processing (4)

• .github/renovate.json
• .github/workflows/reusable-check.yml
• gradle/wrapper/gradle-wrapper.properties
• scripts/verify-flatpak/desktop-offline.yaml

Included review availability: Your plan provides up to 4 included reviews per hour; 3 remain after this review.

---

📝 Walkthrough

Walkthrough

The project pins Gradle to 9.6.1, updates the offline verification artifact and checksum, blocks all Gradle 9.7.x Renovate updates, and documents the compatibility constraint in the Android workflow.

Changes

Gradle version pinning

Layer / File(s)	Summary
Gradle runtime and offline artifact pin gradle/wrapper/gradle-wrapper.properties, scripts/verify-flatpak/desktop-offline.yaml	The Gradle Wrapper and offline verification manifest now use Gradle 9.6.1 with matching checksums. Wrapper network timeout and retry settings are updated.
Gradle update policy and workflow documentation .github/renovate.json, .github/workflows/reusable-check.yml	Renovate now blocks all Gradle 9.7.x releases. The workflow comment documents the Gradle 9.6.1 pin and Gradle 9.7.1 compatibility issues.

Estimated code review effort: 2 (Simple) | ~10 minutes

Merge Risk: ⚪ Minimal · up to 6364e

This change is merge-ready after normal checks and review; no actionable merge-blocking risk remains.

Possibly related PRs

• meshtastic/Meshtastic-Android#6611: Modifies the Gradle wrapper pin and Renovate blocking rule for Gradle 9.6.1 compatibility.
• meshtastic/Meshtastic-Android#6636: Addresses Gradle version compatibility and pinning around Gradle 9.6.1.
• meshtastic/Meshtastic-Android#6782: Updates the vendored Gradle artifact that this change reverts to 9.6.1.

Suggested reviewers: vidplace7

🚥 Pre-merge checks | ✅ 8

✅ Passed checks (8 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly summarizes the main changes: restoring Gradle 9.6.1 and blocking the Gradle 9.7 line.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Sibling Call Sites And Presence Semantics	✅ Passed	The diff changes only Gradle metadata, the wrapper JAR, and CI/Renovate text; it changes no nullable field, zero-guard, presence check, or metric default.
Tests Prove The Path, Not The End State	✅ Passed	The PR changes only Gradle, Renovate, workflow, and Flatpak configuration files; it adds or modifies no tests, so the custom test-path conditions do not apply.
Regression Coverage For Changed Behavior	✅ Passed	The diff changes only Gradle dependency pins, wrapper retry settings, Renovate/Flatpak build metadata, and comments; it changes no listed application behavior or runtime surface.
Moved Code Diffed Against Its Original	✅ Passed	The PR diff changes only configuration/comments, Gradle metadata, and a binary wrapper JAR; it deletes or adds no type/function and performs no code extraction or move.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}