RUST-133 Enable Gradle dependency locking

[romainbrenguier]

Summary

• enable Gradle dependency locking across all main projects
• enable dependency locking for buildSrc
• add the generated Gradle lockfiles

[hashicorp-vault-sonar-prod]

RUST-133

[sonar-review-alpha]

Summary

This PR enables Gradle dependency locking for the Sonar Rust project. Dependency locking pins exact versions of transitive dependencies in lockfiles, ensuring reproducible builds and preventing unexpected dependency updates. The changes apply this feature across all main projects and the buildSrc configuration, and include the generated lockfiles needed for builds to use the locked versions.

This is a configuration/tooling change that improves build reproducibility with no changes to runtime functionality.

What reviewers should know

What to focus on:

• Review the lockfile changes to ensure the locked dependency versions are sensible (no obvious mismatches or outdated pins)
• Verify that dependency locking configuration is consistently applied across all main projects and buildSrc
• Check if any documentation or CI/CD changes are needed to ensure developers understand to update lockfiles when adding/updating dependencies

Non-obvious aspects:

• Lockfiles are typically generated artifacts rather than hand-edited—ensure the generation process is documented for team members
• Gradle dependency locking requires using gradle.lockfile or similar patterns; verify the correct mechanism is used
• This may impact local development workflows—developers must regenerate lockfiles when dependency declarations change

Gotchas:

• If lockfiles are committed but not properly maintained, they can become stale and cause confusion
• Ensure the PR doesn't lock problematic transitive dependencies (inspect key dependencies in the lockfiles)

---

• Generate Walkthrough
• Generate Diagram

🗣️ Give feedback

[sonarqube-next]

Quality Gate passed for 'sonar-rust'

Issues
0 New issues
1 Fixed issue
0 Accepted issues

Measures
0 Security Hotspots
0 Dependency risks
No data about Coverage
0.0% Duplication on New Code

See analysis details on SonarQube

[sebastien-marichal]

LGTM!