Consolidates seven open bot PRs into three commits.
## 1. Bump Gradle Wrapper from 9.5.1 to 9.6.1
Combines **#1008, #1009, #1010, #1011, #1012** into a single commit.
Each of those PRs bumped the wrapper in one directory; this covers all
five (15 files):
- `sources/test/init-scripts`
- `.github/workflow-samples/gradle-plugin`
- `.github/workflow-samples/groovy-dsl`
- `.github/workflow-samples/java-toolchain`
- `.github/workflow-samples/kotlin-dsl`
Each location gets the same `distributionUrl` → `gradle-9.6.1-bin.zip`
and `distributionSha256Sum` update, plus the regenerated `gradlew` /
`gradlew.bat` scripts.
## 2. Update known wrapper checksums
**#990**, unchanged, as its own commit. Adds 36 checksum entries to
`sources/src/wrapper-validation/wrapper-checksums.json`, **including the
9.6.1 checksums** — which is what lets the wrapper bump above pass
`CI-validate-wrappers`. These two are worth landing together.
## 3. Bump Develocity Gradle plugin from 4.4.2 to 4.5.0
**#1015**, unchanged, as its own commit. Updates the plugin reference
across workflow samples, init-script tests, docs, and the injected
default in `sources/src/develocity/build-scan.ts`:
```diff
-maybeExportVariable('DEVELOCITY_INJECTION_DEVELOCITY_PLUGIN_VERSION', '4.4.2')
+maybeExportVariable('DEVELOCITY_INJECTION_DEVELOCITY_PLUGIN_VERSION', '4.5.0')
```
Since this touches `sources/src`, the bundled `dist/` will change when
the update-dist bot runs.
## Verification
All three cherry-picks applied without conflicts. On the combined
branch:
- `./build` — clean
- `npm run check` (prettier + eslint) — clean
- `npm test` — 373 tests, 15 suites, all passing
Original bot authorship is preserved on all three commits.
## Superseded PRs
Once this merges, these can be closed: #1008, #1009, #1010, #1011,
#1012, #990, #1015.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: bot-githubaction <bot-githubaction@gradle.com>
## Why
Issue #1013 revealed that caching was **never storing content on
Windows**. Nothing caught it because the integ-tests lost their multi-OS
matrices: these workflows used to default to `'["ubuntu-latest",
"windows-latest", "macos-latest"]'`, narrowed to ubuntu-only in bcd07e66
/ d74ee73e (Aug 2024). The Windows code path has been dark ever since.
## What
Extract the two cheapest caching tests — `restore-gradle-home` and
`basic-cache-provider` — into a new `suite-smoke-test-caching` workflow,
and run that suite on both `ubuntu-latest` and `windows-latest`.
Both tests seed a cache in one job and then verify it in a dependent job
with an `--offline` build, so a cache that stores nothing fails the
verify job rather than passing silently.
- Rename `integ-test-{restore-gradle-home,basic-cache-provider}` →
`smoke-test-*` and drop them from `suite-integ-test-caching`
- Add the new suite to both `CI-integ-test` and `CI-integ-test-full`,
each with its own concurrency group matching the sibling suites
- Include `smoke-tests` in the `integ-test-success` aggregate gate
- Ignore the generated `task-configured.txt` marker in
`workflow-samples`
- Drop a dead `needs.determine-suite` guard on the `build-distribution`
step — `CI-integ-test` has no such job, so it always evaluated to true
The suite runs on Windows in PR CI (not just `CI-integ-test-full`)
specifically so the failure is visible on this PR and the fix can be
verified the same way.
## Expected result
This PR is expected to be **red on Windows**.
`restore-gradle-home-dependencies-cache` and `basic-cache-verify-build`
should fail with dependency-resolution errors under `--offline` — that
is the bug from #1013 being caught. The ubuntu legs should stay green.
Cross-OS cache keys are safe: both providers include `RUNNER_OS` in the
key (`sources/src/cache-service-basic.ts:146`), so the matrix legs don't
collide.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
With this change, the caching functionality of `setup-gradle` and
`dependency-submission` is now provided by `gradle-actions-caching`, a
closed-source library distributed under our [Terms of
Use](https://gradle.com/legal/terms-of-use/). The rest of the action
implementation remains open source.
Using `setup-gradle` or `dependency-submission` with caching enabled
involves loading and using the `gradle-actions-caching` component,
requiring acceptance of the [Terms of
Use](https://gradle.com/legal/terms-of-use/). There are no functional
changes to caching provided by these actions: all workflows will
continue to function as before.
The non-caching aspects of action implementation remain open source. By
running these actions with caching disabled they can be used without
ever loading `gradle-actions-caching` or accepting the license terms.
Supporting the caching infrastructure in this project requires a
substantial engineering investment by Gradle Technologies, which we can
sustain thanks to Develocity, our commercial offering. Caching
technologies are a core part of the Develocity offering, and the caching
in `setup-gradle` fits squarely in that space.
This licensing change lets us continue to build advanced capabilities
that go beyond what we would offer as open source. Proper
production-ready Configuration Cache support will be the first
capability. Improving build performance for self-hosted runners will
follow.
We may introduce functionality restrictions in future updates. However,
caching functionality will remain free for public repositories.
We have a long-standing commitment to open source, as maintainers of
Gradle Build Tool, and by [sponsoring the open source
community](https://gradle.com/oss-sponsored-by-develocity/) with free
Develocity licenses. Public repositories are primarily used by open
source projects, and we remain committed to supporting them.
- Implementation of caching logic to save and restore Gradle User Home
content has been removed, replaced by the `gradle-actions-caching`
component.
- The `@actions/caching` library is still used to cache Gradle
distributions that are downloaded and provisioned by `setup-gradle`.
This PR updates to the latest version of `@actions/caching`, and removes
the patch that is no longer required.
- License notices are now displayed in documentation, logs and the
generated Job Summary.
Bumps the gradle group with 1 update in the /.github/workflow-samples/groovy-dsl directory: com.gradle.common-custom-user-data-gradle-plugin.
Bumps the gradle group with 1 update in the /.github/workflow-samples/kotlin-dsl directory: com.gradle.common-custom-user-data-gradle-plugin.
Bumps the gradle group with 1 update in the /sources/test/init-scripts directory: com.gradle.common-custom-user-data-gradle-plugin.
Updates `com.gradle.common-custom-user-data-gradle-plugin` from 2.3 to 2.4.0
Updates `com.gradle.common-custom-user-data-gradle-plugin` from 2.3 to 2.4.0
Updates `com.gradle.common-custom-user-data-gradle-plugin` from 2.3 to 2.4.0
---
updated-dependencies:
- dependency-name: com.gradle.common-custom-user-data-gradle-plugin
dependency-version: 2.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gradle
- dependency-name: com.gradle.common-custom-user-data-gradle-plugin
dependency-version: 2.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gradle
- dependency-name: com.gradle.common-custom-user-data-gradle-plugin
dependency-version: 2.4.0
dependency-type: direct:production
update-type: version-update:semver-minor
dependency-group: gradle
...
Signed-off-by: dependabot[bot] <support@github.com>
