Inconsistencies between local & CI machines grpc [1.23.0]

[iamdanfox]

What happened?

FAILURE: Build failed with an exception.

* What went wrong:
Execution failed for task ':verifyLocks'.
> Found dependencies whose dependents changed:
  -io.grpc:grpc-api:1.23.0 (5 constraints: 02360e50)
  +io.grpc:grpc-api:1.23.0 (5 constraints: 4a352adc)
  -io.grpc:grpc-core:1.23.0 (1 constraints: 7f098fa3)
  +io.grpc:grpc-core:1.23.0 (1 constraints: c708ee8f)
  -io.netty:netty-codec-http2:4.1.38.Final (1 constraints: a10b58e3)
  +io.netty:netty-codec-http2:4.1.38.Final (1 constraints: e90a73cb)
  
  Please run './gradlew --write-locks'.

Locally (mac):

$ ./gradlew why --hash 7f098fa3

> Task :why
io.grpc:grpc-core:1.23.0
        io.grpc:grpc-netty -> [1.23.0]

This square bracket version seems to be what's in the upstream POM: https://repo1.maven.org/maven2/io/grpc/grpc-netty/1.23.0/grpc-netty-1.23.0.pom, and it seems like the grpc repo intentionally sets this.

On CI (linux)

$ ./gradlew why --hash c708ee8f

> Task :why
io.grpc:grpc-core:1.23.0
	io.grpc:grpc-netty -> 1.23.0

This repros with java 8 and 11.

Running find ~/.gradle/caches/ -path '*grpc*' -delete seems to solve this sometimes?

What did you want to happen?

Local and CI should always be consistent. Unsure if this is a gradle bug, or if the upstream artifacts are actually mutable somehow??