Lock plugin uses dependency substitution

build.gradle

@@ -15,6 +15,17 @@
  *
  */
 
+buildscript {
+    repositories {
+        maven {
+            url "https://plugins.gradle.org/m2/"
+        }
+    }
+    dependencies {
+        classpath "com.netflix.nebula:gradle-dependency-lock-plugin:10.2.0-rc.1"
+    }
+}
+
 plugins {
     id 'nebula.plugin-plugin' version '14.5.0'
     id 'nebula.kotlin' version '1.3.61'
@@ -30,7 +41,7 @@ dependencies {
     implementation 'com.netflix.nebula:nebula-dependency-recommender:9.0.1'
 
     testImplementation gradleTestKit()
-    testRuntimeOnly 'com.netflix.nebula:gradle-dependency-lock-plugin:7.+'
+    testRuntimeOnly 'com.netflix.nebula:gradle-dependency-lock-plugin:10.+'
 }
 
 apply from: 'gradle/idea.gradle'

gradle/dependency-locks/integTestRuntimeClasspath.lockfile

@@ -2,39 +2,43 @@
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
 cglib:cglib-nodep:3.2.2
+ch.qos.logback:logback-core:1.1.3
 com.fasterxml.jackson.core:jackson-annotations:2.9.0
 com.fasterxml.jackson.core:jackson-core:2.9.9
 com.fasterxml.jackson.core:jackson-databind:2.9.9.3
+com.fasterxml.jackson.datatype:jackson-datatype-joda:2.9.9
 com.fasterxml.jackson.module:jackson-module-kotlin:2.9.9
 com.fasterxml.jackson:jackson-bom:2.9.9.20190807
+com.google.code.gson:gson:2.3.1
 com.google.guava:guava:20.0
-com.netflix.nebula:gradle-dependency-lock-plugin:7.8.0
-com.netflix.nebula:gradle-scm-plugin:5.0.3
+com.netflix.nebula:gradle-dependency-lock-plugin:10.2.0-rc.1
+com.netflix.nebula:gradle-metrics-plugin:8.4.1
+com.netflix.nebula:gradle-scm-plugin:5.1.0
+com.netflix.nebula:nebula-dependencies-comparison:0.1.8
 com.netflix.nebula:nebula-dependency-recommender:9.0.1
 com.netflix.nebula:nebula-gradle-interop:1.0.11
 com.netflix.nebula:nebula-test:7.6.0
-com.squareup.moshi:moshi:1.8.0
+com.squareup.moshi:moshi:1.9.2
 com.squareup.okio:okio:1.16.0
-commons-beanutils:commons-beanutils:1.8.0
-commons-codec:commons-codec:1.6
-commons-collections:commons-collections:3.2.1
+commons-codec:commons-codec:1.9
 commons-io:commons-io:2.5
-commons-lang:commons-lang:2.4
-commons-logging:commons-logging:1.1.1
+commons-logging:commons-logging:1.2
+io.searchbox:jest-common:0.1.7
+io.searchbox:jest:0.1.7
 javax.inject:javax.inject:1
 joda-time:joda-time:2.10
 junit:junit:4.12
-net.sf.ezmorph:ezmorph:1.0.6
-net.sf.json-lib:json-lib:2.3
-net.sourceforge.nekohtml:nekohtml:1.9.16
+net.logstash.logback:logstash-logback-encoder:4.5.1
 org.apache.commons:commons-lang3:3.8.1
-org.apache.httpcomponents:httpclient:4.2.1
-org.apache.httpcomponents:httpcore:4.2.1
+org.apache.httpcomponents:fluent-hc:4.5.1
+org.apache.httpcomponents:httpasyncclient:4.1
+org.apache.httpcomponents:httpclient:4.5.1
+org.apache.httpcomponents:httpcore-nio:4.4.1
+org.apache.httpcomponents:httpcore:4.4.3
 org.apache.maven:maven-artifact:3.6.2
 org.apache.maven:maven-builder-support:3.6.2
 org.apache.maven:maven-model-builder:3.6.2
 org.apache.maven:maven-model:3.6.2
-org.codehaus.groovy.modules.http-builder:http-builder:0.7.1
 org.codehaus.plexus:plexus-interpolation:1.25
 org.codehaus.plexus:plexus-utils:3.2.1
 org.eclipse.sisu:org.eclipse.sisu.inject:0.3.3
@@ -46,6 +50,5 @@ org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.3.61
 org.jetbrains.kotlin:kotlin-stdlib:1.3.61
 org.jetbrains:annotations:13.0
 org.objenesis:objenesis:2.4
+org.slf4j:slf4j-api:1.7.12
 org.spockframework:spock-core:1.3-groovy-2.4
-xerces:xercesImpl:2.9.1
-xml-resolver:xml-resolver:1.2

gradle/dependency-locks/testRuntimeClasspath.lockfile

@@ -2,39 +2,43 @@
 # Manual edits can break the build and are not advised.
 # This file is expected to be part of source control.
 cglib:cglib-nodep:3.2.2
+ch.qos.logback:logback-core:1.1.3
 com.fasterxml.jackson.core:jackson-annotations:2.9.0
 com.fasterxml.jackson.core:jackson-core:2.9.9
 com.fasterxml.jackson.core:jackson-databind:2.9.9.3
+com.fasterxml.jackson.datatype:jackson-datatype-joda:2.9.9
 com.fasterxml.jackson.module:jackson-module-kotlin:2.9.9
 com.fasterxml.jackson:jackson-bom:2.9.9.20190807
+com.google.code.gson:gson:2.3.1
 com.google.guava:guava:20.0
-com.netflix.nebula:gradle-dependency-lock-plugin:7.8.0
-com.netflix.nebula:gradle-scm-plugin:5.0.3
+com.netflix.nebula:gradle-dependency-lock-plugin:10.2.0-rc.1
+com.netflix.nebula:gradle-metrics-plugin:8.4.1
+com.netflix.nebula:gradle-scm-plugin:5.1.0
+com.netflix.nebula:nebula-dependencies-comparison:0.1.8
 com.netflix.nebula:nebula-dependency-recommender:9.0.1
 com.netflix.nebula:nebula-gradle-interop:1.0.11
 com.netflix.nebula:nebula-test:7.6.0
-com.squareup.moshi:moshi:1.8.0
+com.squareup.moshi:moshi:1.9.2
 com.squareup.okio:okio:1.16.0
-commons-beanutils:commons-beanutils:1.8.0
-commons-codec:commons-codec:1.6
-commons-collections:commons-collections:3.2.1
+commons-codec:commons-codec:1.9
 commons-io:commons-io:2.5
-commons-lang:commons-lang:2.4
-commons-logging:commons-logging:1.1.1
+commons-logging:commons-logging:1.2
+io.searchbox:jest-common:0.1.7
+io.searchbox:jest:0.1.7
 javax.inject:javax.inject:1
 joda-time:joda-time:2.10
 junit:junit:4.12
-net.sf.ezmorph:ezmorph:1.0.6
-net.sf.json-lib:json-lib:2.3
-net.sourceforge.nekohtml:nekohtml:1.9.16
+net.logstash.logback:logstash-logback-encoder:4.5.1
 org.apache.commons:commons-lang3:3.8.1
-org.apache.httpcomponents:httpclient:4.2.1
-org.apache.httpcomponents:httpcore:4.2.1
+org.apache.httpcomponents:fluent-hc:4.5.1
+org.apache.httpcomponents:httpasyncclient:4.1
+org.apache.httpcomponents:httpclient:4.5.1
+org.apache.httpcomponents:httpcore-nio:4.4.1
+org.apache.httpcomponents:httpcore:4.4.3
 org.apache.maven:maven-artifact:3.6.2
 org.apache.maven:maven-builder-support:3.6.2
 org.apache.maven:maven-model-builder:3.6.2
 org.apache.maven:maven-model:3.6.2
-org.codehaus.groovy.modules.http-builder:http-builder:0.7.1
 org.codehaus.plexus:plexus-interpolation:1.25
 org.codehaus.plexus:plexus-utils:3.2.1
 org.eclipse.sisu:org.eclipse.sisu.inject:0.3.3
@@ -46,6 +50,5 @@ org.jetbrains.kotlin:kotlin-stdlib-jdk8:1.3.61
 org.jetbrains.kotlin:kotlin-stdlib:1.3.61
 org.jetbrains:annotations:13.0
 org.objenesis:objenesis:2.4
+org.slf4j:slf4j-api:1.7.12
 org.spockframework:spock-core:1.3-groovy-2.4
-xerces:xercesImpl:2.9.1
-xml-resolver:xml-resolver:1.2

src/integTest/groovy/nebula/plugin/resolutionrules/AlignAndSubstituteRulesSpec.groovy

@@ -1017,6 +1017,64 @@ class AlignAndSubstituteRulesSpec extends IntegrationTestKitSpec {
         coreAlignment << [false, true]
     }
 
+    @Issue("Based on https://github.com/nebula-plugins/gradle-nebula-integration/issues/11")
+    @Unroll
+    def 'apply a static version via dependencySubstitution for 1 direct dep and align results | core alignment #coreAlignment'() {
+        // this uses the same mechanism as the dependency lock plugin with resolutionStrategy.dependencySubstitution
+        given:
+        def graph = new DependencyGraphBuilder()
+                .addModule('test.nebula:c:0.5.0')
+                .build()
+        mavenrepo = new GradleDependencyGenerator(graph, "${projectDir}/testrepogen").generateTestMavenRepo()
+
+        rulesJsonFile << """
+            {
+                "align": [
+                    $alignRuleForTestNebula
+                ]
+            }
+            """.stripIndent()
+
+        buildFile << """
+            dependencies {
+                implementation 'test.nebula:a:1.0.0'
+                implementation 'test.nebula:b:0.5.0'
+                implementation 'test.nebula:c:1.0.0'
+            }
+            configurations.all { conf ->
+                def resolutionStrategySubstitution = conf.resolutionStrategy.dependencySubstitution
+                def substitutedModule = resolutionStrategySubstitution.module("test.nebula:a")
+                def withModule = resolutionStrategySubstitution.module("test.nebula:a:0.5.0")
+                resolutionStrategySubstitution.substitute(substitutedModule)
+                    .because("$reason")
+                    .with(withModule)
+            }
+            """.stripIndent()
+
+        when:
+        def result = runTasks(*tasks(coreAlignment))
+
+        then:
+        writeOutputToProjectDir(result.output)
+
+        if (coreAlignment) {
+            def substitutedVersion = '0.5.0'
+            dependencyInsightContains(result.output, "test.nebula:a", substitutedVersion)
+            dependencyInsightContains(result.output, "test.nebula:b", substitutedVersion)
+            dependencyInsightContains(result.output, "test.nebula:c", substitutedVersion)
+
+            assert result.output.contains("belongs to platform aligned-platform:rules-0-for-test.nebula-or-test.nebula.ext:$substitutedVersion")
+        } else {
+            dependencyInsightContains(result.output, "test.nebula:a", resultingVersion)
+            dependencyInsightContains(result.output, "test.nebula:b", resultingVersion)
+            dependencyInsightContains(result.output, "test.nebula:c", resultingVersion)
+        }
+
+        where:
+        resultingVersion = "1.0.0"
+        coreAlignment << [false, true]
+    }
+
     @Issue("Based on https://github.com/nebula-plugins/gradle-nebula-integration/issues/11")
     @Unroll
     def 'apply a static version via details.useVersion for each dependency and align results | core alignment #coreAlignment'() {
@@ -1176,6 +1234,66 @@ class AlignAndSubstituteRulesSpec extends IntegrationTestKitSpec {
         coreAlignment << [false, true]
     }
 
+    @Issue("Based on https://github.com/nebula-plugins/gradle-nebula-integration/issues/11")
+    @Unroll
+    def 'apply a static version via dependencySubstitution for 1 direct dep and align results without conflict resolution involved | core alignment #coreAlignment'() {
+        // this uses the same mechanism as the dependency lock plugin with resolutionStrategy.dependencySubstitution
+        given:
+        def graph = new DependencyGraphBuilder()
+                .addModule('test.nebula:c:0.5.0')
+                .addModule(new ModuleBuilder('test.other:brings-a:1.0.0').addDependency('test.nebula:a:1.0.0').build())
+                .build()
+        mavenrepo = new GradleDependencyGenerator(graph, "${projectDir}/testrepogen").generateTestMavenRepo()
+
+        rulesJsonFile << """
+            {
+                "align": [
+                    $alignRuleForTestNebula
+                ]
+            }
+            """.stripIndent()
+
+        buildFile << """
+            dependencies {
+                implementation 'test.other:brings-a:1.0.0'
+                implementation 'test.nebula:b:0.5.0'
+                implementation 'test.nebula:c:1.0.0'
+            }
+            configurations.all { conf ->
+                def resolutionStrategySubstitution = conf.resolutionStrategy.dependencySubstitution
+                def substitutedModule = resolutionStrategySubstitution.module("test.nebula:c")
+                def withModule = resolutionStrategySubstitution.module("test.nebula:c:0.5.0")
+                resolutionStrategySubstitution.substitute(substitutedModule)
+                    .because("$reason")
+                    .with(withModule)
+            }
+            """.stripIndent()
+
+        when:
+
+        def result = runTasks(*tasks(coreAlignment))
+
+        then:
+        writeOutputToProjectDir(result.output)
+
+        if (coreAlignment) {
+            def substitutedVersion = '0.5.0'
+            dependencyInsightContains(result.output, "test.nebula:a", substitutedVersion)
+            dependencyInsightContains(result.output, "test.nebula:b", substitutedVersion)
+            dependencyInsightContains(result.output, "test.nebula:c", substitutedVersion)
+
+            assert result.output.contains("belongs to platform aligned-platform:rules-0-for-test.nebula-or-test.nebula.ext:$substitutedVersion")
+        } else {
+            dependencyInsightContains(result.output, "test.nebula:a", resultingVersion)
+            dependencyInsightContains(result.output, "test.nebula:b", resultingVersion)
+            dependencyInsightContains(result.output, "test.nebula:c", resultingVersion)
+        }
+
+        where:
+        resultingVersion = "1.0.0"
+        coreAlignment << [false, true]
+    }
+
     @Unroll
     def 'statically defined dependency: sub & align all versions higher than x and align | core alignment #coreAlignment'() {
         given: