Support Android/Gradle dependencies and project toolchains

.changepacks/changepack_log_android_gradle_toolchains.json

@@ -0,0 +1,15 @@
+{
+  "changes": {
+    "bridge/node/package.json": "Minor",
+    "bridge/python/pyproject.toml": "Minor",
+    "crates/cli/Cargo.toml": "Minor",
+    "crates/core/Cargo.toml": "Minor",
+    "crates/node/Cargo.toml": "Minor",
+    "crates/rust/Cargo.toml": "Minor",
+    "crates/python/Cargo.toml": "Minor",
+    "crates/github/Cargo.toml": "Minor",
+    "crates/docker/Cargo.toml": "Minor"
+  },
+  "note": "Add static Android/Gradle and project toolchain updates, explicit local tool queries, compatibility-aware selection, integrity checks, recoverable transactions, structured diagnostics, and deterministic cross-platform packaging regressions. Minimum supported Rust is now 1.88; legacy JSON output remains available with --json-legacy.",
+  "date": "2026-10-01T01:43:51Z"
+}

.github/workflows/CI.yml

@@ -19,6 +19,9 @@ env:
   FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: true
 
 jobs:
+  project-regressions:
+    uses: ./.github/workflows/project-regressions.yml
+
   test:
     name: Test
     runs-on: ${{ matrix.platform }}
@@ -111,6 +114,7 @@ jobs:
       pull-requests: write
       contents: write
     needs:
+      - project-regressions
       - test
       - coverage-test
     steps:
@@ -125,6 +129,7 @@ jobs:
     outputs:
       changepacks: ${{ steps.changepacks.outputs.changepacks }}
       release_assets_urls: ${{ steps.changepacks.outputs.release_assets_urls }}
+      pending_releases: ${{ steps.changepacks.outputs.pending_releases }}
 
   # node
   node-build:
@@ -363,6 +368,31 @@ jobs:
           upload_url: ${{ fromJson(needs.changepacks.outputs.release_assets_urls)['bridge/python/pyproject.toml'] }}
           asset_path: "*/*.whl"
 
+  finalize-releases:
+    name: Finalize published releases
+    runs-on: ubuntu-latest
+    needs: [changepacks, node-publish, python-publish, upload-assets]
+    permissions:
+      contents: write
+    # Current changepacks creates durable draft receipts for downstream npm/PyPI
+    # publishers. Publish those releases only after their packages and assets
+    # are available; failed publication must leave the drafts recoverable.
+    if: >-
+      ${{ always() && github.ref == 'refs/heads/main'
+          && needs.changepacks.result == 'success'
+          && needs.changepacks.outputs.pending_releases != ''
+          && needs.changepacks.outputs.pending_releases != '{}'
+          && (needs.node-publish.result == 'success'
+              || !contains(needs.changepacks.outputs.pending_releases, 'bridge/node/package.json'))
+          && (needs.python-publish.result == 'success'
+              || !contains(needs.changepacks.outputs.pending_releases, 'bridge/python/pyproject.toml'))
+          && (needs.upload-assets.result == 'success'
+              || !contains(needs.changepacks.outputs.changepacks, 'crates/cli/Cargo.toml')) }}
+    steps:
+      - uses: changepacks/action@main
+        with:
+          finalize_releases: ${{ needs.changepacks.outputs.pending_releases }}
+
   upload-assets:
     needs: changepacks
     if: ${{ contains(needs.changepacks.outputs.changepacks, 'crates/cli/Cargo.toml') }}

.github/workflows/project-regressions.yml

@@ -0,0 +1,66 @@
+name: Project regression tests
+
+on:
+  workflow_dispatch:
+  workflow_call:
+
+permissions:
+  contents: read
+
+jobs:
+  minimum-rust:
+    name: Minimum Rust 1.88
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          toolchain: "1.88.0"
+      - run: cargo check --locked --workspace --all-targets --all-features
+      - run: cargo test --locked --workspace
+
+  project-regressions:
+    name: Deterministic regressions (${{ matrix.os }})
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+        with:
+          components: rustfmt, clippy
+      - name: Format
+        run: cargo fmt --all -- --check
+      - name: Lint
+        run: cargo clippy --locked --workspace --all-targets --all-features -- -D warnings
+      - name: Fixed-response tests and native filesystem regressions
+        run: cargo test --locked --workspace
+      - name: Both CLI aliases
+        run: |
+          cargo run --locked -p dependency-check-updates --bin dcu -- --help
+          cargo run --locked -p dependency-check-updates --bin dependency-check-updates -- --help
+      - uses: oven-sh/setup-bun@v2
+      - uses: actions/setup-node@v7
+        with:
+          node-version: 22
+      - name: Fixed-response native bridge and packed npm installation
+        run: |
+          bun install --frozen-lockfile --ignore-scripts
+          bun run --cwd bridge/node test
+      - uses: astral-sh/setup-uv@v10.0.1
+        with:
+          enable-cache: false
+      - name: Build and install Python wheel, exercise both aliases
+        run: |
+          uvx --from "maturin>=1.8,<2" maturin build --locked --manifest-path bridge/python/Cargo.toml --out target/wheel-smoke
+          uv run --no-project python bridge/python/test_wheel.py target/wheel-smoke
+
+  crate-packaging:
+    name: Verify distributable Rust crates
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: dtolnay/rust-toolchain@stable
+      - run: cargo package --locked --workspace --exclude dependency-check-updates-napi --exclude dependency-check-updates-python-bridge