fix(android): Generate modules.json into build folder instead of source tree (#6753)

* fix(android): Generate sentry.options.json into build folder instead of source tree

The Android Gradle plugin copied `sentry.options.json` into the version-controlled
`src/main/assets` during builds via a task with no declared inputs/outputs. That broke
Gradle's up-to-date checks and build caching for the asset-merge tasks and required a
cleanup task to remove the file afterward, which could leave the file behind on a failed
build.

Replace it with a typed `generateSentryOptions` task that writes into
`build/generated/sentry/options` with declared inputs/outputs (source file plus the
SENTRY_ENVIRONMENT/RELEASE/DIST overrides), registered as a generated assets source via
the AGP Variant API, with a classic sourceSets fallback for older AGP. Nothing is written
into the source tree anymore, and asset merging is now correctly cached.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs(changelog): Reference PR #6751

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(android): Wire lint tasks to generateSentryOptions and clear opt-out output

The lint model/analysis tasks read the generated assets dir without a declared
dependency on generateSentryOptions, which Gradle 9 fails as an implicit
dependency error. Declare it explicitly.

Also make the SENTRY_COPY_OPTIONS_FILE opt-out an @input instead of onlyIf, so
disabling it re-runs the task and clears the output dir rather than leaving a
stale generated file to be packaged.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(android): Warn on stale sentry.options.json left in src/main/assets

Older plugin versions copied the file into src/main/assets; a crashed build
could leave it behind, where it now shadows or conflicts with the generated
copy. Emit a configuration-time warning pointing the user to remove it. Never
delete it automatically — the file may be intentional.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(android): Generate modules.json into build folder instead of source tree

The Android Gradle plugin collected `modules.json` into the version-controlled
`src/main/assets` directory on release builds via an `Exec` task with no declared
inputs/outputs, then removed it afterward with a cleanup task. That broke
up-to-date checks and build caching for asset merging, and a failed build could
leave the file behind in the source tree.

Replace it with a typed `CollectModulesTask` that writes into
`build/generated/sentry/modules/<variant>`, registered as a generated assets
source via the AGP Variant API (with a classic source-set fallback), so AGP
merges and orders it into `merge<Variant>Assets` with correct up-to-date/caching
behavior. Lint tasks depend on it explicitly (Gradle 9 rejects the previously
implicit dependency), and the source-map cleanup now runs after it.

Mirrors the `sentry.options.json` fix (#6751); closes the same anti-pattern for
`modules.json` from #6750.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* docs(changelog): Reference PR #6753

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(android): Scope modules.json fallback to variant source set and warn on stale copy

Addresses review feedback on the modules.json generated-assets change:

- Source-set fallback (old AGP < 7.3) now registers each variant's generated
  modules dir into that variant's own source set instead of the shared "main".
  Adding per-variant dirs to "main" leaked modules.json into debug and caused a
  duplicate-asset merge conflict between multiple non-debug variants. Because each
  variant is now isolated, no dedup guard is required (unlike the shared-dir
  options fallback). The primary AGP 7.3+ variant-API path was already scoped and
  is unchanged.
- Warn on a stale modules.json left in src/main/assets by older plugin versions
  (mirrors the sentry.options.json warning), since a leftover copy would clash
  with the generated one during asset merge on upgrade.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(android): Scope modules lint dependency to the exact variant and fingerprint the collect-modules script

Addresses two review findings on the modules.json generation change:

- The lint-task dependency used a loose `it.name.contains(variantCapitalized)`
  substring match, so a longer build type whose name ends in a shorter one
  (e.g. `qaRelease` vs `release`) would have its lint tasks pull in the wrong
  variant's modules task. Match the variant as a full task-name segment via the
  known AGP lint verbs / `generate<Variant>Lint…` prefix instead, mirroring the
  exact match already used for the `merge<Variant>Assets` fallback wiring.
- `collectModulesScript` was an `@Input` on the path string only, which does not
  fingerprint the script's content — editing it in place (e.g. an SDK upgrade at
  the same path) would not re-run the task. Make it `@Internal` and add
  `collectModulesScriptFiles` (`@InputFiles`, RELATIVE path sensitivity) to
  fingerprint content, tolerating a missing script as an empty input.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* refactor(android): Make the modules lint-dependency matcher verb-agnostic

Match a variant's whole AGP lint family by the `Lint` camelCase word boundary
(name starts with the lowercase `lint` verb, or embeds a capital-L `Lint`
segment) scoped to that variant, instead of an allowlist of lint verbs plus a
generator-prefix regex.

This covers `updateLintBaseline*`, `*UnitTest` lint models, and any future AGP
lint task without relying on those tasks transitively depending on an
allowlisted `lintAnalyze*` task. The word boundary — rather than a
case-insensitive `lint` substring — excludes unrelated `ktlint*` tasks (e.g.
`ktlintReleaseCheck`), which must not be made to depend on the modules task and
pull in the JS bundler. Cross-variant matches (e.g. `release` inside
`qaRelease`/`releaseStaging`) are excluded precisely using the set of processed
variant names, which is complete by the time lint tasks are realized.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* fix(android): Order and re-key modules collection to avoid source-map races

The CollectModulesTask was decoupled from the source-map upload chain so it
runs via mergeAssets, which introduced two races with the upload flow:

- The upload rewrites the source map in place (copy-debugid) in its doFirst,
  while the modules task reads that same file. With nothing ordering them, a
  parallel / configuration-cache build could read a half-written map and fail
  JSON parsing. Order the upload strictly after the modules task.

- The "clean up extra sourcemap" task deletes the source map after uploading.
  Fingerprinting that (deleted) map as the task input invalidated the modules
  task on every rebuild and could package an empty modules.json when an
  up-to-date bundle task didn't regenerate the map. Fingerprint the stable
  bundle instead (it changes iff the JS/module list changes) and read the map
  at execution as an @internal input.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* perf(android): Resolve collect-modules script path lazily

`resolveSentryReactNativeSDKPath` spawns a blocking `node --print
require.resolve(...)` subprocess. It was hoisted into the plain body of
`processVariant`, which the AGP `onVariants` callback runs at configuration
time for every non-debug variant on every Gradle invocation (including debug
builds and `./gradlew tasks`). Its result also feeds only the fallback branch,
so it was wasted whenever `collectModulesScript` is configured.

Move the resolution into the CollectModulesTask config block and into the `?:`
fallback only, so the node subprocess runs lazily (when the task is realized)
and conditionally (when no explicit script path is set) — restoring the
pre-refactor behavior where it lived inside the Exec task's config block.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: antonis

CHANGELOG.md

@@ -18,6 +18,7 @@
 - Declare optional peer dependencies so imports resolve under strict and Plug'n'Play package managers ([#6729](https://github.com/getsentry/sentry-react-native/pull/6729))
 - Honor `shutdownTimeout` on iOS ([#6749](https://github.com/getsentry/sentry-react-native/pull/6749))
 - Android Gradle plugin no longer writes generated `sentry.options.json` into your source tree during builds ([#6751](https://github.com/getsentry/sentry-react-native/pull/6751))
+- Android Gradle plugin no longer writes generated `modules.json` into your source tree during release builds ([#6753](https://github.com/getsentry/sentry-react-native/pull/6753))
 - Fix Mac Catalyst linking the wrong `Sentry.xcframework` slice ([#6758](https://github.com/getsentry/sentry-react-native/pull/6758))
 
 ### Internal