Fix cross-base delta contamination with base commit stamping

Delta bundles can corrupt Gradle builds when the base bundle changes
between PR builds (e.g. after a rebase). The delta's cached metadata
(module-artifact.bin, transforms, configuration cache) may reference
files that exist in the old base but not the new one.

Root cause: Gradle stores dependency jars under files-2.1/{group}/
{module}/{version}/{sha1}/ where the version directory depends on
which module version wins dependency conflict resolution. When a delta
is built on base A (where guava resolves to 33.5.0-jre) and applied
to base B (where guava resolves to 33.5.0-android), the delta's
module-artifact.bin tells Gradle the jar is already cached at a path
that doesn't exist in base B, causing 'File/directory does not exist'
errors during artifact transforms.

Fixes:
1. Base commit stamping: record which base commit a delta was built on
   (both as a __base_commit__ tar entry and as S3 x-amz-meta-base-commit
   metadata). At restore time, discard the delta if the current base
   differs. This is checked in both the integrated restore (--branch)
   and standalone restore-delta paths.

2. Exclude module-artifact.bin and resource-at-url.bin from delta bundles.
   These Gradle metadata DBs are rewritten every build (BTree compaction)
   and a stale copy can cause Gradle to skip downloading artifacts that
   don't exist in the current base. Same rationale as the existing
   module-metadata.bin exclusion.

The .cache-base-commit marker file is written to GRADLE_USER_HOME after
base restore and read by save-delta to stamp outgoing deltas.

Includes integration test (TestIntegrationDeltaBaseCommitStamping) that
verifies delta skip on base mismatch and delta apply on base match.
Test fails without the fix.

Author: joshfriend

cmd/gradle-cache/integration_test.go

@@ -318,6 +318,25 @@ func gitInit(t *testing.T, projectDir string) {
 	}
 }
 
+func gitCommit(t *testing.T, projectDir, message string) {
+	t.Helper()
+	for _, args := range [][]string{
+		{"add", "."},
+		{"commit", "-m", message},
+	} {
+		cmd := exec.Command("git", append([]string{"-C", projectDir}, args...)...)
+		cmd.Env = append(os.Environ(),
+			"GIT_AUTHOR_NAME=Test",
+			"GIT_AUTHOR_EMAIL=test@test.com",
+			"GIT_COMMITTER_NAME=Test",
+			"GIT_COMMITTER_EMAIL=test@test.com",
+		)
+		if out, err := cmd.CombinedOutput(); err != nil {
+			t.Fatalf("git %v: %v\n%s", args, err, out)
+		}
+	}
+}
+
 func gitRevParse(t *testing.T, projectDir string) string {
 	t.Helper()
 	cmd := exec.Command("git", "-C", projectDir, "rev-parse", "HEAD")
@@ -975,6 +994,160 @@ public class IncludedPlugin implements Plugin<Project> {
 	}
 }
 
+// TestIntegrationDeltaBaseCommitStamping verifies that deltas built on one base
+// commit are skipped when restored against a different base commit.
+//
+// The scenario:
+//  1. Build on commit A → save base bundle
+//  2. Restore base A, build (simulated PR build) → save delta (stamped with commit A)
+//  3. Create commit B → save base bundle
+//  4. Restore base B + delta from step 2 → delta MUST be skipped (base mismatch)
+//  5. Verify delta from same base IS applied (base match)
+//
+// This prevents cross-base contamination where stale delta metadata (e.g.
+// module-artifact.bin, transforms, configuration cache) references files that
+// exist in the old base but not the new one.
+func TestIntegrationDeltaBaseCommitStamping(t *testing.T) {
+	if testing.Short() {
+		t.Skip("skipping integration test in short mode")
+	}
+	for _, tool := range []string{"java", "tar"} {
+		if _, err := exec.LookPath(tool); err != nil {
+			t.Skipf("%s not available", tool)
+		}
+	}
+
+	binaryPath := filepath.Join(t.TempDir(), "gradle-cache")
+	buildCmd := exec.Command("go", "build", "-o", binaryPath, ".")
+	buildCmd.Dir = "."
+	if out, err := buildCmd.CombinedOutput(); err != nil {
+		t.Fatalf("go build failed: %v\n%s", err, out)
+	}
+
+	backend, cleanupBackend := backendArgs(t)
+	defer cleanupBackend()
+
+	ctx := integrationContextFrom(t, "gradle-project")
+
+	// ── Step 1: Build and save base A ───────────────────────────────────
+	t.Log("Step 1: Building and saving base A...")
+	gradleRun(t, ctx.projectDir, ctx.gradlew, ctx.gradleUserHome, "build")
+	commitA := gitRevParse(t, ctx.projectDir)
+
+	saveArgs := append([]string{"--log-level", "debug", "save"}, backend...)
+	saveArgs = append(saveArgs,
+		"--cache-key", ctx.cacheKey,
+		"--commit", commitA,
+		"--gradle-user-home", ctx.gradleUserHome,
+		"--included-build", "build-logic",
+	)
+	runCLI(t, binaryPath, ctx, saveArgs...)
+
+	// ── Step 2: Restore base A, mutate, build, save delta ───────────────
+	t.Log("Step 2: Restoring base A, building, saving delta...")
+	clearGradleState(t, ctx)
+
+	restoreArgs := append([]string{"--log-level", "debug", "restore"}, backend...)
+	restoreArgs = append(restoreArgs,
+		"--cache-key", ctx.cacheKey,
+		"--ref", commitA,
+		"--git-dir", ctx.projectDir,
+		"--gradle-user-home", ctx.gradleUserHome,
+		"--included-build", "build-logic",
+	)
+	runCLI(t, binaryPath, ctx, restoreArgs...)
+
+	// Verify .cache-base-commit was written by restore.
+	baseCommitFile := filepath.Join(ctx.gradleUserHome, ".cache-base-commit")
+	if data, err := os.ReadFile(baseCommitFile); err != nil {
+		t.Fatalf("expected .cache-base-commit after restore: %v", err)
+	} else if got := strings.TrimSpace(string(data)); got != commitA {
+		t.Fatalf(".cache-base-commit = %q, want %q", got, commitA)
+	}
+
+	// Mutate build to create new cache entries for the delta.
+	appendToFile(t, filepath.Join(ctx.projectDir, "build.gradle.kts"), "\n// delta change\n")
+	gradleRun(t, ctx.projectDir, ctx.gradlew, ctx.gradleUserHome, "build")
+
+	saveDeltaArgs := append([]string{"--log-level", "debug", "save-delta"}, backend...)
+	saveDeltaArgs = append(saveDeltaArgs,
+		"--cache-key", ctx.cacheKey,
+		"--branch", "stamp-test-branch",
+		"--gradle-user-home", ctx.gradleUserHome,
+		"--project-dir", ctx.projectDir,
+		"--included-build", "build-logic",
+	)
+	saveDeltaOut := runCLI(t, binaryPath, ctx, saveDeltaArgs...)
+	if !strings.Contains(saveDeltaOut, "stamped with base commit") {
+		t.Log("  Warning: delta save did not log base commit stamp")
+	}
+
+	// ── Step 3: Create commit B, save base B ────────────────────────────
+	t.Log("Step 3: Creating commit B, building and saving base B...")
+	ctxB := integrationContextFrom(t, "gradle-project")
+	// Make commit B different from commit A.
+	appendToFile(t, filepath.Join(ctxB.projectDir, "build.gradle.kts"), "\n// base B\n")
+	gitCommit(t, ctxB.projectDir, "base B change")
+	gradleRun(t, ctxB.projectDir, ctxB.gradlew, ctxB.gradleUserHome, "build")
+	commitB := gitRevParse(t, ctxB.projectDir)
+
+	if commitA == commitB {
+		t.Fatal("commitA and commitB must be different")
+	}
+
+	saveBArgs := append([]string{"--log-level", "debug", "save"}, backend...)
+	saveBArgs = append(saveBArgs,
+		"--cache-key", ctx.cacheKey,
+		"--commit", commitB,
+		"--gradle-user-home", ctxB.gradleUserHome,
+		"--included-build", "build-logic",
+	)
+	runCLI(t, binaryPath, ctxB, saveBArgs...)
+
+	// ── Step 4: Restore base B + delta from step 2 → delta SKIPPED ──────
+	t.Log("Step 4: Restoring base B + delta (should be skipped)...")
+	clearGradleState(t, ctx)
+
+	restoreBArgs := append([]string{"--log-level", "debug", "restore"}, backend...)
+	restoreBArgs = append(restoreBArgs,
+		"--cache-key", ctx.cacheKey,
+		"--ref", commitB,
+		"--git-dir", ctxB.projectDir,
+		"--gradle-user-home", ctx.gradleUserHome,
+		"--included-build", "build-logic",
+	)
+	runCLI(t, binaryPath, ctx, restoreBArgs...)
+
+	restoreDeltaArgs := append([]string{"--log-level", "debug", "restore-delta"}, backend...)
+	restoreDeltaArgs = append(restoreDeltaArgs,
+		"--cache-key", ctx.cacheKey,
+		"--branch", "stamp-test-branch",
+		"--gradle-user-home", ctx.gradleUserHome,
+		"--project-dir", ctx.projectDir,
+		"--included-build", "build-logic",
+	)
+	restoreDeltaOut := runCLI(t, binaryPath, ctx, restoreDeltaArgs...)
+
+	if !strings.Contains(restoreDeltaOut, "skipping delta") {
+		t.Fatal("expected delta to be skipped when base commit differs")
+	}
+	t.Log("  Delta correctly skipped on base mismatch ✓")
+
+	// ── Step 5: Restore base A + delta → delta APPLIED ──────────────────
+	t.Log("Step 5: Restoring base A + delta (should be applied)...")
+	clearGradleState(t, ctx)
+	runCLI(t, binaryPath, ctx, restoreArgs...)
+
+	restoreDeltaOut = runCLI(t, binaryPath, ctx, restoreDeltaArgs...)
+	if strings.Contains(restoreDeltaOut, "skipping delta") {
+		t.Fatal("expected delta to be applied when base commit matches")
+	}
+	if !strings.Contains(restoreDeltaOut, "applied delta") {
+		t.Fatal("expected 'applied delta' in output when base matches")
+	}
+	t.Log("  Delta correctly applied on base match ✓")
+}
+
 func appendToFile(t *testing.T, path, content string) {
 	t.Helper()
 	f, err := os.OpenFile(path, os.O_APPEND|os.O_WRONLY, 0o644)

cmd/gradle-cache/testdata/android-project/app/build.gradle

@@ -0,0 +1,18 @@
+plugins {
+    id 'com.android.application'
+}
+
+android {
+    namespace 'com.example.cachetest'
+    compileSdk 36
+
+    defaultConfig {
+        applicationId 'com.example.cachetest'
+        minSdk 21
+        targetSdk 36
+    }
+}
+
+dependencies {
+    implementation 'androidx.core:core:1.16.0'
+}

cmd/gradle-cache/testdata/android-project/app/src/main/AndroidManifest.xml

@@ -0,0 +1,2 @@
+<?xml version="1.0" encoding="utf-8"?>
+<manifest />

cmd/gradle-cache/testdata/android-project/app/src/main/java/com/example/App.java

@@ -0,0 +1,7 @@
+package com.example;
+
+public class App {
+    public String greet() {
+        return "Hello";
+    }
+}

cmd/gradle-cache/testdata/android-project/app/src/main/res/values/strings.xml

@@ -0,0 +1,4 @@
+<?xml version="1.0" encoding="utf-8"?>
+<resources>
+    <string name="app_name">CacheTest</string>
+</resources>

cmd/gradle-cache/testdata/android-project/build.gradle

@@ -0,0 +1,3 @@
+plugins {
+    id 'com.android.application' version '8.9.3' apply false
+}

cmd/gradle-cache/testdata/android-project/gradle.properties

@@ -0,0 +1,2 @@
+android.useAndroidX=true
+org.gradle.caching=true

cmd/gradle-cache/testdata/android-project/gradle/wrapper/gradle-wrapper.properties

@@ -0,0 +1,7 @@
+distributionBase=GRADLE_USER_HOME
+distributionPath=wrapper/dists
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.4.1-bin.zip
+networkTimeout=10000
+validateDistributionUrl=true
+zipStoreBase=GRADLE_USER_HOME
+zipStorePath=wrapper/dists