Repositories and Metadata

Lazy credentials (e.g. credentials(PasswordCredentials::class) resolved through providers) are only required when the repo is actually used. Gradle then fails fast at configuration time with a clear error if a credential is missing — but only for tasks that need it.

Add a credentials {} block to the repository and read username/password from gradle.properties or the environment instead of inlining them. With a named repo, Gradle can also auto-map <name>Username/<name>Password properties.

Project-dependency repositories go in each project's repositories {} (or centrally in dependencyResolutionManagement in settings). Plugin repositories for the plugins {} block go in pluginManagement { repositories {} } in settings.gradle.kts. They're separate lookup paths.

Make every module in a family (e.g. all Jackson modules) belongsTo a shared virtual platform. Gradle then aligns them to one consistent version, so you never mix 2.13 and 2.15 of related modules.

@CacheableRule tells Gradle it may cache the rule's output across builds. The rule must be a pure function of its inputs — no env/file reads. To use external data, inject it via an @Inject constructor parameter so Gradle tracks it for invalidation.

Declare that two equivalent modules provide the same capability (e.g. give old google-collections Guava's capability). Gradle then detects the conflict and you resolve it by choosing one module, avoiding duplicate classes on the classpath.

A variant carries attributes, capabilities, files, and two dependency lists: dependencies (modules this variant actually needs) and dependencyConstraints (version recommendations/limits applied only if that module is pulled in by someone else).

The attributesSchema declares each attribute and how Gradle compares values. A compatibility rule decides whether a producer value is acceptable for what the consumer asked. A disambiguation rule picks the best one when several are acceptable.

The producer exposes variants through consumable configurations carrying attributes. The consumer asks for artifacts through a resolvable configuration carrying requested attributes. Variant selection matches the consumer's attributes against the producer's consumable variants.

Persist and restore GRADLE_USER_HOME (the modules-2 cache) as a CI cache keyed on lockfiles, keep release builds on fixed/locked versions, and use --offline once the cache is warm to make builds fast and network-independent.

The authentication {} block picks which auth scheme Gradle uses for a repo. Adding create<BasicAuthentication>("basic") forces Gradle to send Basic credentials preemptively instead of waiting for a 401 challenge.

GMM exposes the published variants and their attributes. When resolution fails, you compare the consumer's requested attributes against each variant's attributes — usually with dependencyInsight or by reading the .module file — and reconcile the mismatch via attributes, capabilities, or a component metadata rule.