Problem
AutoInstallState is a process-global mutable singleton (@Volatile private var instance, reset via BuildFinishedListenerService.onClose). During auto-install, each project's configuration writes to this shared singleton:
with(AutoInstallState.getInstance(gradle)) {
this.sentryVersion = installSentrySdk(...)
this.enabled = true
}
Mutating shared, build-wide state from within per-project configuration is the classic project-isolation antipattern — under strict Isolated Projects, projects cannot share mutable state like this. The class comment even acknowledges the fragility around Gradle daemon reuse.
Where
plugin-build/src/main/kotlin/io/sentry/android/gradle/autoinstall/AutoInstallState.kt
- Written from
plugin-build/src/main/kotlin/io/sentry/android/gradle/autoinstall/AutoInstall.kt (installDependencies → withDependencies)
Suggested direction
Replace the singleton with a properly scoped Gradle BuildService (or otherwise per-project state), so the auto-install version/enabled flags aren't shared through process-global mutable state. Verify behavior under both configuration cache and Isolated Projects.
Context
Surfaced while reviewing #1349 (fix: use BOM version for Sentry installs). That PR only passes a value through AutoInstallState and does not introduce the issue — this is a pre-existing liability tracked separately. See the isolated projects status notes.
Problem
AutoInstallStateis a process-global mutable singleton (@Volatile private var instance, reset viaBuildFinishedListenerService.onClose). During auto-install, each project's configuration writes to this shared singleton:Mutating shared, build-wide state from within per-project configuration is the classic project-isolation antipattern — under strict Isolated Projects, projects cannot share mutable state like this. The class comment even acknowledges the fragility around Gradle daemon reuse.
Where
plugin-build/src/main/kotlin/io/sentry/android/gradle/autoinstall/AutoInstallState.ktplugin-build/src/main/kotlin/io/sentry/android/gradle/autoinstall/AutoInstall.kt(installDependencies→withDependencies)Suggested direction
Replace the singleton with a properly scoped Gradle
BuildService(or otherwise per-project state), so the auto-install version/enabled flags aren't shared through process-global mutable state. Verify behavior under both configuration cache and Isolated Projects.Context
Surfaced while reviewing #1349 (fix: use BOM version for Sentry installs). That PR only passes a value through
AutoInstallStateand does not introduce the issue — this is a pre-existing liability tracked separately. See the isolated projects status notes.