Skip to content

AutoInstallState uses a process-global mutable singleton (project-isolation violation) #1351

Description

@runningcode

Problem

AutoInstallState is a process-global mutable singleton (@Volatile private var instance, reset via BuildFinishedListenerService.onClose). During auto-install, each project's configuration writes to this shared singleton:

with(AutoInstallState.getInstance(gradle)) {
  this.sentryVersion = installSentrySdk(...)
  this.enabled = true
}

Mutating shared, build-wide state from within per-project configuration is the classic project-isolation antipattern — under strict Isolated Projects, projects cannot share mutable state like this. The class comment even acknowledges the fragility around Gradle daemon reuse.

Where

  • plugin-build/src/main/kotlin/io/sentry/android/gradle/autoinstall/AutoInstallState.kt
  • Written from plugin-build/src/main/kotlin/io/sentry/android/gradle/autoinstall/AutoInstall.kt (installDependencieswithDependencies)

Suggested direction

Replace the singleton with a properly scoped Gradle BuildService (or otherwise per-project state), so the auto-install version/enabled flags aren't shared through process-global mutable state. Verify behavior under both configuration cache and Isolated Projects.

Context

Surfaced while reviewing #1349 (fix: use BOM version for Sentry installs). That PR only passes a value through AutoInstallState and does not introduce the issue — this is a pre-existing liability tracked separately. See the isolated projects status notes.

Metadata

Metadata

Assignees

Labels

No labels
No labels

Fields

No fields configured for issues without a type.

Projects

No projects

Milestone

No milestone

Relationships

None yet

Development

No branches or pull requests

Issue actions