Parse native Gradle dependencies.lock files generated by gradle dependencies --write-locks

Proposal

The Nebula project contributed a basic dependency locking mechanism in Gradle 4.8. Since it's bundled in, it might be easier for users to enable this, so we should support the lock files as a dependency input.

Implementation

  1. Have the Gradle parser check for some magic bytes that identify the basic lock file.
  2. The lock file has a very basic grammar.
    • Lines that start with # are comments. There are no multi-line comments.
    • All other lines have the format <namespace>:<package>:<version>=<configuration>.
  3. Add an e2e test for this kind of lock file.
  4. Document support for this in the project's README.md.
  5. Write a migration guide for users that use the built in Gradle locking mechanism.
    • The documentation must mention that these lock files will result in empty dependency paths for the detected dependencies.
  6. Create a release post with this new information
Edited by 🤖 GitLab Bot 🤖