Support Gradle lockfiles

[rahulsom]

Since gradle 4.9, or 4.10, Gradle has been supporting dependency locking through lock files.
It would be nice if the dependabot supported those lockfiles instead of updating the build.gradle.

[greysteil]

This is going to be a big one, but I'm definitely 👍 on tackling it. The best docs I've seen on it are in https://docs.gradle.org/current/userguide/userguide.pdf.

Note, in order to achieve this Dependabot will either have to shift to cloning Gradle repos or get very good at writing sanitized build.gradle files. Either should be achievable, but this is a medium sized project.

Thanks for the feedback @rahulsom!

[feelepxyz]

@rahulsom just pinned it 👌

[amq]

Now that Gradle supports single-file locks, it should be probably simpler.

[tbroyer]

…and single-file locks are becoming the default in Gradle 7.

(that's actually 3 lockfiles possibly: settings-gradle.lockfile, buildscript-gradle.lockfile, and gradle.lockfile)

[chenrui333]

Is this still on the roadmap somewhere?

[peadarom]

Can this please be prioritized?

[usmonster]

In case it's relevant, here's the equivalent issue for Renovate: renovatebot/renovate#5534.