How to Launch a Scan on Java/Scala/Kotlin

For Gradle-based projects in Java, Scala, or Kotlin, generating a gradle.lockfile ensures consistent dependencies that CybeDefend can accurately scan. SBT-based Scala projects can also pin versions in .sbt.lock or a centralized method.

​

Gradle Lockfiles

1. Enable Gradle Locking
   You can enable dependency locking in one of two ways:

   Option A: In your gradle.properties, set:

   Copy

   systemProp.gradle.useLocks=true
   systemProp.gradle.dependencyVerification=strict
   

   Option B: Modify your build.gradle file to add:

   Copy

   configurations.all {
     resolutionStrategy.activateDependencyLocking()
   }
   

   Or for Kotlin DSL projects (build.gradle.kts):

   Copy

   configurations.all {
     resolutionStrategy.activateDependencyLocking()
   }
   

2. Generate Lockfiles
   Run one of these commands:

   Copy

   ./gradlew dependencies --write-locks
   

   or

   Copy

   ./gradlew resolveAndLockAll
   

   This creates lockfiles in the gradle/dependency-locks directory.

3. Commit
   Check in the lockfiles so that your entire team and CybeDefend sees fixed dependency versions.

​

Why You Should Use Lockfiles

Using a lockfile is critical for secure and predictable builds. A lockfile contains a fixed version and a hash for each dependency and sub-dependency in your project.

1. Supply Chain Protection
   Lockfiles prevent malicious package injections. This is crucial as supply chain attacks are rising.
2. Predictable Builds
   Everyone uses the exact same package versions, avoiding “it works on my machine” inconsistencies.
3. Performance Gains
   With dependency versions locked, build tools skip the usual resolution step, making builds faster.

​

SBT Lock for Scala

1. Add the sbt-lock Plugin
   In your project/plugins.sbt, add:

   Copy

   addSbtPlugin("software.purpledragon" % "sbt-dependency-lock" % "1.5.1")
   

2. Generate the Lockfile
   Run:

   Copy

   sbt dependencyLockWrite
   

   This creates a build.sbt.lock or dependencies.sbt.lock file.

3. Commit the Lockfile
   Add this file to your repository to maintain pinned Scala library versions.

​

Supported Files