How can I use repositories in my android module's build.gradle not in Top-level(Project's) build.gradle?

Question

I have a library module. it is using a library from

allprojects {
    repositories {
        maven {
            url = uri("https://jitpack.io/")
        }
    }
}

sync only successful if i add jitpack dependency in project level build.gradle. now, i dont want to force my library users to add jitpack dependency in their project level build.gradle. so, i am trying to add repositories in library module itself.

i tried below code in my library.

plugins {
    id("com.android.library")
}

repositories {
    google()
    maven {
        url = uri("https://jitpack.io/")
    }
}

android {
    // ...
}

dependencies {
    // from jitpack
    implementation("https://github.com/a914-gowtham/compose-ratingbar")
    // ...
}

Answer 1

A build has - and has to have - the full control over where the dependencies it depends on directly and transitively are resolved from.

JitPack for example is broken by design for the use-case of proper publishing and not really suitable for that. It is only suitable for quickly trying out some intermediate builds. Besides that it is super slow, especially when a version is requested first and may even make the build tool time out and remember JitPack does not have the dependency. And I also have seen various outages of it. Besides that it manipulates the libraries it provides and thereby destroying some in serious ways. ...

These are some versions why for example a user of your library could prefer to get the dependency from another place, like an own repository server where he deploys all the libraries he needs.

Another reason might be company guidelines that enforce that no public server may be used to get dependencies, for example due to risk of outages, or risk of malicious content being added, ...

There might even be networks that are behind proxies that forbid such external requests and only allow internal repositories with the dependencies that are needed.

Or maybe an architect wants to control which libraries are allowed to make it into the built products.

There are many reasons why a project should have the full control over which repositories are used to pull direct and transitive dependencies from and I listed some of them that you understand why the situation is like it is.

Due to for example these reasons, a consumer of your library has to specify the repository where the dependeny is pulled from himself, be it JitPack or a sane alternative.

---

PS: Any use of allprojects { ... } or subprojects { ... } is a code smell and should be avoided. You should use convention plugins instead.