build: Align SDK modules to one version through sentry-bom

CHANGELOG.md

@@ -16,6 +16,9 @@
 
 ### Behavioral Changes
 
+- Gradle builds now resolve all Sentry SDK modules to the same version, the highest one present, because every module depends on `sentry-bom` as a platform ([#6466](https://github.com/getsentry/sentry-java/pull/6466))
+  - Before, a build could mix module versions, for example a newer `sentry-android-core` with an older `sentry-android-fragment`, which failed at runtime. Maven builds resolve as before.
+  - `sentry-bom` now also includes `sentry-android-distribution`.
 - Idle spans, including those produced by `SentryTraced`, now let any idle parent transaction finish after the idle timeout (3s by default) with status `ok`, rather than waiting for the deadline (30s by default) and reporting `deadline_exceeded` ([#6396](https://github.com/getsentry/sentry-java/pull/6396))
   - If you use `SentryTraced`, expect shorter durations and lower failure rates for affected `ui.load` and navigation transactions, plus changes to metrics measured over the transaction's lifetime, such as slow and frozen frames.
   - Cold and warm app start, TTID, and TTFD remain unchanged.

build-logic/src/main/kotlin/io/sentry/gradle/SentryPublishPlugin.kt

@@ -16,6 +16,9 @@ import org.gradle.kotlin.dsl.configure
 class SentryPublishPlugin : Plugin<Project> {
   override fun apply(project: Project) {
     project.configurePublishing(DistributionContainer::configureForJvm)
+    // the BOMs are java-platform projects, so they do not depend on themselves
+    project.plugins.withId("java-library") { project.alignWithBom("api") }
+    project.plugins.withId("com.android.library") { project.alignWithBom("api") }
   }
 }
 
@@ -26,9 +29,21 @@ class SentryPublishPlugin : Plugin<Project> {
 class SentryMultiplatformPublishPlugin : Plugin<Project> {
   override fun apply(project: Project) {
     project.configurePublishing(DistributionContainer::configureForMultiplatform)
+    project.plugins.withId("org.jetbrains.kotlin.multiplatform") {
+      project.alignWithBom("commonMainApi")
+    }
   }
 }
 
+/**
+ * With sentry-bom as a platform, Gradle resolves all SDK modules of a consumer to one version, the
+ * highest one present.
+ */
+private fun Project.alignWithBom(configuration: String) {
+  val bom = dependencies.project(mapOf("path" to ":sentry-bom"))
+  dependencies.add(configuration, dependencies.platform(bom))
+}
+
 private fun Project.configurePublishing(
   configureDistributions: DistributionContainer.(Project) -> Unit
 ) {

sentry-bom/build.gradle.kts

@@ -13,8 +13,7 @@ dependencies {
         !it.name.startsWith("sentry-samples") &&
           it.name != project.name &&
           !it.name.endsWith("-bom") &&
-          !it.name.contains("test", ignoreCase = true) &&
-          !it.name.contains("sentry-android-distribution")
+          !it.name.contains("test", ignoreCase = true)
       }
       .forEach { project ->
         evaluationDependsOn(project.path)