Composite build fails when dependencies are locked and global dependency substitution rules are disabled

[strguntbr]

Current Behavior

./gradlew build fails for a composite build when dependencies are locked and global dependency substitution rules are disabled.
When the root build has a dependency on the included build, gradle writes the dependency to the lockfile (if dependency substitution is disabled). But when reading the lockfile it seems to filter out this dependency (even though dependency substitution is disabled).
Thus the build fails with the following error:

> Could not resolve all files for configuration ':compileClasspath'.
   > Resolved 'at.ctrlbreak:library1:1.0' which is not part of the dependency lock state

Expected Behavior

The composite build should not fail

Context (optional)

This seems to happen because when loading the lockfile in org.gradle.internal.locking.DefaultDependencyLockingProvider#loadLockState(java.lang.String) the dependency is not added to the result. The root cause seems to be that org.gradle.internal.locking.DefaultDependencyLockingProvider#isSubstitutedInComposite ignores the fact that dependency substitution is disabled and returns true.

I found a workaround/hack that fixes the build (at least with gradle 8.7):
Defining a dependency substitution for the included build that just substitutes an imaginary module with the library1 project ('includeBuild("library1") { dependencySubstitution { substitute(module("foo:bar")).using(project(":")) } }') makes the build work.

This seems to work because in org.gradle.composite.internal.IncludedBuildDependencySubstitutionsBuilder#build(org.gradle.internal.build.IncludedBuildState) the available modules are not added to the context if the substitution rules may add project dependency (which is achieved by adding the substitution of the imaginary module). In that case the subsitution rule actions are registered instead of adding the available modules.

Not sure how long this workaround will work, as I'm not sure it this behavior is intended or a bug on it's own that might be fixed any time.

Steps to Reproduce

Assume the following setup:

• The root project (call it reproducer-project) has an included build (call it library1).
• Reproducer-project has a dependency on library1 but global dependency substitution is disabled for all configurations in reproducer-project (configurations.all { resolutionStrategy.useGlobalDependencySubstitutionRules = false }).
• Dependency locking is activated for all configurations in reproducer-project (configurations.all { resolutionStrategy.activateDependencyLocking() }).
• The lockfile for reproducer-project has been written by executing ./gradlew dependencies --write-locks
• Library1 has been published to a repository that is configured in reproducer-project

When trying to build the project now by calling (./gradlew build) the build fails because it resolves library1 with (according to the error message) is not part of the dependency lock state. When having a look at the gradle.lockfile one can however see that it actually is part of the lockfile.

A project demonstrating the bug has been prepared at https://github.com/strguntbr/gradle-composite-build-bug

Gradle version

8.7

Build scan URL (optional)

No response

Your Environment (optional)

No response

[ov7a]

The issue is in the backlog of the relevant team and is prioritized by them.

---

Related:

• Error in dependency resolution in composite build with dependency locking and dependency substitution  #16254