{ lib
, writeShellScriptBin
, gradle
, jq
, yq-go
}:

writeShellScriptBin "update-locks" ''
  set -eu -o pipefail
  set -x
  ${gradle}/bin/gradle dependencies --write-locks
  ${gradle}/bin/gradle --write-verification-metadata sha256 dependencies
  ${yq-go}/bin/yq -p=xml -o=json gradle/verification-metadata.xml \
    | ${jq}/bin/jq '."verification-metadata".components.component' \
    | ${jq}/bin/jq '[ .[] | { group: ."+@group", name: ."+@name", version: ."+@version", artifacts: [([.artifact] | flatten | .[] | {(."+@name"): .sha256."+@value"})] | add } ]' > deps.json
  rm gradle/verification-metadata.xml
''