chore(deps): bump org.sonarqube from 3.5.0.2730 to 6.2.0.5505

.circleci/config.yml

@@ -9,7 +9,7 @@ commands:
       - restore_cache:
           key: v1-gradle-wrapper-{{ arch }}-{{ checksum "gradle/wrapper/gradle-wrapper.properties" }}
       - restore_cache:
-          key: v1-gradle-cache-{{ arch }}-{{ checksum "build.gradle.kts" }}-{{ checksum "settings.gradle.kts" }}-{{ checksum "gradle.properties" }}-{{ checksum "app/build.gradle.kts" }}-{{ checksum "gradle/libs.versions.toml" }}
+          key: v1-gradle-cache-{{ arch }}-{{ checksum "build.gradle.kts" }}-{{ checksum "settings.gradle.kts" }}-{{ checksum "gradle.properties" }}-{{ checksum "app/build.gradle.kts" }}-{{ checksum "gradle/libs.versions.toml" }}-{{ checksum "gradle/verification-metadata.xml" }}-{{ checksum "gradle/verification-keyring.keys" }}-{{ checksum "gradle/verification-metadata.gpg" }}
   restore_bundler_cache:
     steps:
       - restore_cache:

.github/workflows/android.yml

@@ -28,7 +28,7 @@ jobs:
         uses: actions/cache@v3
         with:
           path: ~/.gradle/caches
-          key: ${{ runner.OS }}-gradle-caches-cache-${{ hashFiles('build.gradle.kts', 'settings.gradle.kts', 'gradle/libs.versions.toml') }}
+          key: ${{ runner.OS }}-gradle-caches-cache-${{ hashFiles('build.gradle.kts', 'settings.gradle.kts', 'gradle/libs.versions.toml', 'gradle/verification-metadata.xml', 'gradle/verification-keyring.keys', 'gradle/verification-metadata.gpg') }}
           restore-keys: |
             ${{ runner.OS }}-gradle-caches-cache-
       - name: generate ksProp file

README.md

@@ -71,7 +71,21 @@ Since this uses the gradle scanner, the sonar properties are defined in root pro
 On one hand, the Sonar scanner requires local paths for `sonar.sources` and `sonar.binaries` properties, on the other hand it requires absolute path for `sonar.androidLint.reportPaths` and `sonar.coverage.jacoco.xmlReportPaths`.
 More info on official Sonar docs: [SonarScanner for Gradle](https://docs.sonarcloud.io/advanced-setup/ci-based-analysis/sonarscanner-for-gradle/) 
 
-
+
+## Dependency Verification
+
+This project uses [Gradle Dependency Verification](https://docs.gradle.org/current/userguide/dependency_verification.html) to check the authenticity dependencies.
+
+The following files are committed to the repository:
+- `gradle/verification-metadata.xml`
+- `gradle/verification-keyring.keys`
+- `gradle/verification-metadata.gpg`
+**For contributors: if you add or update dependencies, regenerate these files with:**
+```
+./gradlew --write-verification-metadata pgp,sha256 --export-keys
+```
+Then commit the updated files.
+This improves supply chain security and hopefully helps prevent unauthorized dependency changes.
 
  ## Knows Issues
 - Jacoco coverage report is incorrect

gradle/libs.versions.toml

@@ -113,4 +113,4 @@ firebase-crashlytics-gradle = { module = "com.google.firebase:firebase-crashlyti
 android-application = { id = "com.android.application", version.ref = "gradle" }
 kotlin-android = { id = "org.jetbrains.kotlin.android", version.ref = "kotlin" }
 kotlin-compose = { id = "org.jetbrains.kotlin.plugin.compose", version.ref = "kotlin" }
-sonarqube = { id = "org.sonarqube", version = "3.5.0.2730" }
+sonarqube = { id = "org.sonarqube", version = "6.2.0.5505" }