Trace the Origin of a Dependency

For any dependency in any build, you can name what served it: Develocity Artifact Cache, another cache, or a repository the build downloaded it from. When Develocity Artifact Cache served it, you also learn which Edge location handed it over.

Prerequisites

Trace One Dependency in One Build

Start from the build you have a question about.

  1. Open the Build Scan of the build and go to the Dependencies section.

  2. Find the dependency and select it to open the dependency details inspector.

    The Edge location that served the dependency
    The Edge location that served the dependency

    • Reading: The details inspector shows whether the dependency was served by Develocity Artifact Cache, and from which Edge location and node. No Served by entry means the build downloaded the dependency or it was served by an unknown cache. The Repository entry below it shows which repository provides the dependency, regardless of whether it was served by a cache or downloaded directly.

Trace Dependency Origin Across Builds

The JVM Dependencies dashboard answers the same question across a wide range of builds and dependencies.

  1. Open the JVM Dependencies dashboard in Develocity Reporting and Visualization, and set the relevant filters to inspect the builds you are most interested in.

  2. Select the dependency you want to trace the origin for and scroll down to the "Details per origin" table.

    Origin split for the selected dependency
    Origin split for the selected dependency

    • Reading: A remote repository served the selected dependencies in 13.2 K builds, while Develocity Artifact Cache served them in 35.9 K and 221 builds across two Edge locations, making the cache the majority origin. The dashboard also identifies that other types of caches, such as GitHub Actions Cache or local pre-baked agent caches, served the dependency. Dependencies resolved by builds that don’t satisfy the plugin and extension prerequisites described above appear as coming from an "Unknown" origin in the dashboard.

  3. To trace the origin of each dependency version, either specify the "Version" filter or expand the "Details per versioned dependency" table.

    Origin split per dependency version
    Origin split per dependency version

    • Reading: The table aggregates all origins that provided the selected dependency version across the inspected builds. The "org.apache.logging.log4j:log4j-slf4j-impl:2.25.4" version was used briefly, by 7 CI builds, and only a remote repository served it. The superseding 2.25.5 patch reached 2.47 K builds, and its origins include an Edge location, so the cache served it alongside the repository.

Next Steps