Guardrails / build

The Gradle wrapper is no older than the floor

build/gradle-version-floor@v1

The Gradle version the wrapper pins is at or above the floor the team sets, so the build runs on a toolchain that is still supported.

Id	build/gradle-version-floor
Version	v1
Category	build
Default severity	warning
Interpreter	python3
Timeout	30 seconds
Violations tolerated	0
Collects	gradle

Collectors

This guardrail gathers nothing itself. It depends on the collectors below, which the CLI runs once per build before any check, and reads what they found out of GUARDRAIL_FACTS. A collector that collects nothing skips this guardrail rather than failing it.

Collector	Gathers	Inputs it is given
gradle	The Gradle build in the project directory: its settings and manifest, every included project, the wrapper and the distribution it pins, the version catalog, and every dependency the build files declare or the lock files resolve, with the versions its platforms supply.	projectDir

The inputs above are this guardrail's own, passed straight through. Configuring one in buildnote.json changes what is collected, and two guardrails configured the same way share the one collection.

Configuration

{
  "guardrails": {
      "failOn": "error",
      "comment": true,
      "checks": [
          {
              "use": "build/gradle-version-floor@v1",
              "severity": "warning",
              "with": {
                  "projectDir": ".",
                  "minVersion": "8.0"
              },
              "exemptions": []
          }
      ]
  }
}

Inputs

Input	Description	Default	Environment variable
projectDir	Directory the Gradle build is read from, relative to the directory the CLI runs in.	.	GUARDRAIL_INPUT_PROJECTDIR
minVersion	Oldest Gradle version the wrapper may pin.	8.0	GUARDRAIL_INPUT_MINVERSION

How to fix

Upgrade the wrapper, which rewrites the properties and the scripts together:

./gradlew wrapper --gradle-version 9.0.0 --distribution-type bin
./gradlew wrapper --gradle-version 9.0.0 --distribution-type bin

Run it twice: the first run writes the new properties and the second runs under the new wrapper and finishes the job.

A Gradle far behind the floor is not only missing fixes. It caps the JDK the build can run on, and each release it falls further behind turns the eventual upgrade from a version bump into a migration.

More in build

• build/dependency-updates-configured. The repository configures a tool that opens the dependency update, so upgrades arrive as reviewable pull requests rather than as a task nobody has time for.
• build/runs-on-hosted-ci. The artifact was built by a CI platform rather than on somebody's workstation, so the build is attributable and repeatable.
• build/wrapper-distribution-verified. The Gradle wrapper pins the checksum of the distribution it downloads, so the toolchain cannot be swapped underneath the build.

All 4 build guardrails