> ## Documentation Index
> Fetch the complete documentation index at: https://docs.cybedefend.com/llms.txt
> Use this file to discover all available pages before exploring further.

# How to Launch a Scan on Java/Scala/Kotlin

> Optimize SCA scanning by using Gradle lockfiles and pinned versions for Java, Scala, or Kotlin builds.

For **Gradle-based** projects in Java, Scala, or Kotlin, generating a `gradle.lockfile` ensures consistent dependencies that CybeDefend can accurately scan. SBT-based Scala projects can also pin versions in `.sbt.lock` or a centralized method.

## Gradle Lockfiles

1. **Enable Gradle Locking**\
   You can enable dependency locking in one of two ways:

   **Option A**: In your `gradle.properties`, set:

   ```properties theme={null}
   systemProp.gradle.useLocks=true
   systemProp.gradle.dependencyVerification=strict
   ```

   **Option B**: Modify your `build.gradle` file to add:

   ```groovy theme={null}
   configurations.all {
     resolutionStrategy.activateDependencyLocking()
   }
   ```

   Or for Kotlin DSL projects (`build.gradle.kts`):

   ```kotlin theme={null}
   configurations.all {
     resolutionStrategy.activateDependencyLocking()
   }
   ```

2. **Generate Lockfiles**\
   Run one of these commands:

   ```bash theme={null}
   ./gradlew dependencies --write-locks
   ```

   or

   ```bash theme={null}
   ./gradlew resolveAndLockAll
   ```

   This creates lockfiles in the `gradle/dependency-locks` directory.

3. **Commit**\
   Check in the lockfiles so that your entire team and CybeDefend sees fixed dependency versions.

## Why You Should Use Lockfiles

Using a **lockfile** is critical for secure and predictable builds. A lockfile contains a **fixed version** and a **hash** for each dependency and sub-dependency in your project.

1. **Supply Chain Protection**\
   Lockfiles prevent malicious package injections. This is crucial as supply chain attacks are rising.
2. **Predictable Builds**\
   Everyone uses the exact same package versions, avoiding “it works on my machine” inconsistencies.
3. **Performance Gains**\
   With dependency versions locked, build tools skip the usual resolution step, making builds faster.

<Note>
  Lockfiles are never edited manually. They’re generated and updated by your package manager and committed to your repository, ensuring consistent environments for all teammates.
</Note>

## SBT Lock for Scala

1. **Add the sbt-lock Plugin**\
   In your `project/plugins.sbt`, add:
   ```scala theme={null}
   addSbtPlugin("software.purpledragon" % "sbt-dependency-lock" % "1.5.1")
   ```

2. **Generate the Lockfile**\
   Run:

   ```bash theme={null}
   sbt dependencyLockWrite
   ```

   This creates a `build.sbt.lock` or `dependencies.sbt.lock` file.

3. **Commit the Lockfile**\
   Add this file to your repository to maintain pinned Scala library versions.

## Supported Files

| Lang       | File Examples                                                           |
| ---------- | ----------------------------------------------------------------------- |
| **Java**   | `gradle.lockfile`, `pom.xml`, `.jar`, `.war`, `.ear`                    |
| **Scala**  | `build.sbt`, `plugins.sbt`, `.sbt.lock`, `dependencies.scala`, `.scala` |
| **Kotlin** | `gradle.lockfile`, `.kts` files (Gradle Kotlin DSL)                     |

<Note>
  Some older build tools or frameworks may require additional steps. The primary goal is to produce a stable lock or pinned version set for each submodule.
</Note>

<Tip>
  For multi-module Gradle projects, run <code>./gradlew :module:dependencies --write-locks</code> for each module to ensure all dependencies are properly locked.
</Tip>