simplify config

Author: jack-berg

.github/workflows/oss-index-audit-daily.yml

@@ -24,11 +24,8 @@ jobs:
       - name: Set up gradle
         uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
 
-        # --max-workers=1: scan-gradle-plugin is not thread-safe when tasks run in parallel.
-        # Each ossIndexAudit task calls project.getAllprojects() and resolves configurations
-        # at execution time; concurrent tasks racing on the same configurations cause
-        # intermittent NullPointerExceptions. Running serially avoids this.
-      - run: ./gradlew ossIndexAudit --max-workers=1
+      # --no-parallel is needed to avoid OverlappingFileLockException on the shared OSS Index cache
+      - run: ./gradlew ossIndexAudit --no-configuration-cache --no-parallel --info
         id: audit
         continue-on-error: true
         env:

.gitignore

@@ -34,3 +34,6 @@ bin
 
 # Vim
 .swp
+
+# scan-gradle-plugin
+oss-index-cyclonedx-bom.json

buildSrc/src/main/kotlin/otel.java-conventions.gradle.kts

@@ -52,14 +52,7 @@ ossIndexAudit {
   username = System.getenv("SONATYPE_OSS_INDEX_USER") ?: ""
   password = System.getenv("SONATYPE_OSS_INDEX_PASSWORD") ?: ""
   outputFormat = org.sonatype.gradle.plugins.scan.ossindex.OutputFormat.JSON_CYCLONE_DX_1_4
-}
-
-// scan-gradle-plugin accesses Task.project at execution time, which is incompatible with
-// Gradle 9's configuration cache. Mark the task so Gradle discards the cache entry rather
-// than failing the build with 44 configuration cache problems.
-// https://github.com/sonatype-nexus-community/scan-gradle-plugin/issues (no Gradle 9 support yet)
-tasks.named("ossIndexAudit") {
-  notCompatibleWithConfigurationCache("scan-gradle-plugin is not compatible with Gradle 9 configuration cache")
+  isPrintBanner = false
 }
 
 val testJavaVersion = gradle.startParameter.projectProperties.get("testJavaVersion")?.let(JavaVersion::toVersion)

exporters/common/build.gradle.kts

@@ -104,13 +104,6 @@ testing {
   }
 }
 
-// Exclude the compile-stub subproject from this module's audit: the scan plugin traverses
-// Gradle subprojects at execution time, which Gradle 9 forbids without an exclusive lock.
-// compile-stub runs its own ossIndexAudit task independently.
-ossIndexAudit {
-  modulesExcluded = mutableSetOf("compile-stub")
-}
-
 tasks {
   check {
     dependsOn(testing.suites)

integration-tests/build.gradle.kts

@@ -14,9 +14,3 @@ dependencies {
   testImplementation("org.junit.jupiter:junit-jupiter-params")
   testImplementation("org.testcontainers:testcontainers-junit-jupiter")
 }
-
-// Skip ossIndexAudit: the scan plugin traverses Gradle subprojects at execution time, which
-// Gradle 9 forbids without an exclusive lock. Each subproject runs its own audit independently.
-tasks.named("ossIndexAudit") {
-  enabled = false
-}