Release immutability is now enabled for this repository, so a published
release permanently locks its Git tag to a commit, and deleting the
release does not free the tag name for reuse.
Reorder the steps so the signed tag is created and pushed before the
release is drafted, and have the draft select that existing tag. Letting
GitHub create the tag at publish time produces an unsigned, lightweight
tag pointing at whatever main resolves to at that moment - both of which
immutability then makes permanent.
Also record that the v6 major tag must never have a release attached:
immutability locks only tags that have a release of their own, which is
what keeps the conventional major-tag force-push legal.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Previously handled via `@dependabot ignore` issue comments, which don't
provide enough control. Declaring the rules in the config makes them
explicit and reviewable.
Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Consolidates seven open bot PRs into three commits.
## 1. Bump Gradle Wrapper from 9.5.1 to 9.6.1
Combines **#1008, #1009, #1010, #1011, #1012** into a single commit.
Each of those PRs bumped the wrapper in one directory; this covers all
five (15 files):
- `sources/test/init-scripts`
- `.github/workflow-samples/gradle-plugin`
- `.github/workflow-samples/groovy-dsl`
- `.github/workflow-samples/java-toolchain`
- `.github/workflow-samples/kotlin-dsl`
Each location gets the same `distributionUrl` → `gradle-9.6.1-bin.zip`
and `distributionSha256Sum` update, plus the regenerated `gradlew` /
`gradlew.bat` scripts.
## 2. Update known wrapper checksums
**#990**, unchanged, as its own commit. Adds 36 checksum entries to
`sources/src/wrapper-validation/wrapper-checksums.json`, **including the
9.6.1 checksums** — which is what lets the wrapper bump above pass
`CI-validate-wrappers`. These two are worth landing together.
## 3. Bump Develocity Gradle plugin from 4.4.2 to 4.5.0
**#1015**, unchanged, as its own commit. Updates the plugin reference
across workflow samples, init-script tests, docs, and the injected
default in `sources/src/develocity/build-scan.ts`:
```diff
-maybeExportVariable('DEVELOCITY_INJECTION_DEVELOCITY_PLUGIN_VERSION', '4.4.2')
+maybeExportVariable('DEVELOCITY_INJECTION_DEVELOCITY_PLUGIN_VERSION', '4.5.0')
```
Since this touches `sources/src`, the bundled `dist/` will change when
the update-dist bot runs.
## Verification
All three cherry-picks applied without conflicts. On the combined
branch:
- `./build` — clean
- `npm run check` (prettier + eslint) — clean
- `npm test` — 373 tests, 15 suites, all passing
Original bot authorship is preserved on all three commits.
## Superseded PRs
Once this merges, these can be closed: #1008, #1009, #1010, #1011,
#1012, #990, #1015.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Co-authored-by: bot-githubaction <bot-githubaction@gradle.com>
Supersedes #1023.
## 1. Adjust dependabot's TypeScript choices
Dependabot's group bump included two changes that we don't want to take
as-is:
- **typescript**: `5.9.3` → `7.0.2`. Pinned to **6.0.3** instead.
- **@types/node**: `25.9.2` → `26.1.1`. Downgraded to the latest 24.x
(**24.13.3**), matching the Node 24 runtime the actions target.
All other updates from #1023 are kept unchanged (`@actions/cache` 6.2.0,
`semver` 7.8.5, `@typescript-eslint/eslint-plugin` 8.65.0, `esbuild`
0.28.1, `eslint` 10.7.0, `globals` 17.7.0, `prettier` 3.9.6, `ts-jest`
29.4.12), and the branch is rebased onto current `main`.
The prettier 3.9.6 bump reformats two union types in
`sources/src/cache-service.ts`; that reformatting is included so `npm
run check` passes.
## 2. Clear 5 open security advisories
`npm audit` reported 4 high and 1 low severity advisory. All are fixable
with **semver-compatible transitive updates** — `npm audit fix` clears
them without `--force`, and `package.json` is untouched.
**Production** (bundled into `dist/`, so they ship in the actions):
| Package | Before | After | Via |
| --- | --- | --- | --- |
| `undici` | 6.24.1 | 6.28.0 | `@actions/github`, `@actions/http-client`
|
| `undici` | 7.24.5 | 7.29.0 | `cheerio` |
| `brace-expansion` | 5.0.6 | 5.0.9 | `@actions/glob` → `minimatch` |
| `brace-expansion` | 2.0.3 | 2.1.4 | `@actions/artifact` → `archiver` |
**Dev only:** `shell-quote` 1.8.4 → 1.10.0 (`npm-run-all`), `js-yaml`
3.14.2 → 3.15.1 (`ts-jest`), `@babel/core` 7.28.0 → 7.29.x (`ts-jest`,
low severity).
These were outstanding because the lockfile pins transitive resolutions
while `.github/dependabot.yml` only bumps direct dependencies. Because
`undici` and `brace-expansion` are production dependencies, the bundled
`dist/` output will change when the update-dist bot runs.
## 3. Downgrade nock to 14.0.17
**nock 15.0.0 was published by mistake.** The registry marks it
deprecated:
> v15.0.0 was released accidentally and is unstable. Please use v14.x
until v15 is officially ready.
nock's `latest` dist-tag still points at 14.0.17 for exactly this
reason, and 15.x remains a beta line (`beta` = `15.0.0-beta.14`).
Dependabot picked up 15.0.0 in an earlier group bump simply because it
is the highest published version. This moves us to 14.0.17, pulling
`@mswjs/interceptors` 0.39.8 → 0.41.9 and adding `propagate` 2.0.1.
Dependabot will likely re-propose nock 15.0.0 on its next weekly run,
since no ignore rule was added.
## 4. Delete unused `sources/.nvmrc`
The file pinned Node `v16`, contradicting `package.json` engines
(`>=24.0.0`), the esbuild `node24` target, and `.tool-versions` (`nodejs
24.3.0`). Nothing reads it — no workflow uses `node-version-file` and
there are no other references in the repo. Stale since 5e522253.
## 5. Run CI workflows on Node 24
`ci-check-and-unit-test.yml`, `ci-update-dist.yml`, and
`update-checksums-file.yml` pinned `node-version: 20`, so `npm
clean-install` was emitting `EBADENGINE` warnings for the root package
against its own `engines: >=24.0.0`. All three now use Node 24, matching
`.github/actions/build-dist/action.yml`.
Worth noting: `ci-update-dist.yml` built `dist/` on Node 20 in its
inline steps while `build-dist/action.yml` built it on Node 24, so the
committed distribution could previously be produced under either
version.
## Verification
- `./build` — clean
- `npm run check` (prettier + eslint) — clean
- `npm test` — 373 tests, 15 suites, all passing
- `npm audit` — **found 0 vulnerabilities** (was 4 high, 1 low)
- `npx tsc --noEmit` — one pre-existing error in
`@octokit/request-error` types (`Cannot find name 'ErrorOptions'`),
identical on `main` with TypeScript 5.9.3, so not a regression. `tsc` is
not part of the build or CI.
A clean regeneration of `package-lock.json` from `package.json` was also
evaluated. It likewise yields 0 vulnerabilities and 373 passing tests,
but churns 80 transitive packages including the `@azure/core-*` /
`@azure/storage-blob` stack used by `@actions/cache`. Since it offers no
security benefit over the current lockfile, it was not adopted.
### Known-failing checks (pre-existing on `main`)
The three `smoke-tests / restore-gradle-home / … (windows-latest)` jobs
fail with `Build was not cached: unexpected execution of test task`. The
identical three jobs fail on `main` in run
[30723964208](https://github.com/gradle/actions/actions/runs/30723964208),
on the very commit this branch is based on, so they are not caused by
these changes.
## Not included
`npm outdated` also shows `eslint` 10.7.0 → 10.8.0 and `globals` 17.7.0
→ 17.8.0. Both are dev-only and dependabot's weekly npm group run will
propose them.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Partial revert of the extraction in #1027. The caching smoke test should
answer one question quickly — does a seeded cache let a later build run
`--offline`? Everything else is integration-level.
Replaces #1031 and #1030, squashed into a single commit.
## Layout
`smoke-test-restore-gradle-home.yml` — two jobs:
| job | purpose |
|---|---|
| `restore-gradle-home-seed-build` | seed the cache |
| `restore-gradle-home-dependencies-cache` | verify the restored cache
allows `--offline` |
`integ-test-restore-gradle-home.yml` — restored, wired back into
`suite-integ-test-caching`:
| job | purpose |
|---|---|
| `restore-gradle-home-seed-build` | seed the cache (duplicated, see
below) |
| `restore-gradle-home-build-cache` | local build-cache restored |
| `restore-gradle-home-no-extracted-cache-entries-restored` | build
works with cache entries skipped |
| `restore-gradle-home-pre-existing-gradle-home` | pre-existing GUH
overwritten by restore |
This file is identical to the pre-#1027 original except for the
`dependencies-cache` job, which the smoke test now owns. All four jobs
keep the `runner-os` matrix.
## Notes
**The seed job is duplicated, with distinct cache keys.** The smoke
suite uses `smoke-test-restore-gradle-home-*`; the integ suite keeps
`restore-gradle-home-*`. This matters: `smoke-tests` and
`caching-integ-tests` run concurrently in `ci-integ-test.yml`, so
sharing a key would have both suites racing to write the same entry.
**Distinct workflow `name:`.** The smoke workflow is `Smoke test restore
Gradle Home`, so the two don't appear identically in the Actions UI.
**One thing to be aware of for the future:**
`restore-gradle-home-pre-existing-gradle-home` cannot pass on Windows.
Pre-creating `~/.gradle` is what stops `setup-gradle` relocating the
Gradle User Home to `D:\a\.gradle`, so the job looks for a cache entry
rooted at a different path than the seed build saved and never matches
it. The caching integ suite runs ubuntu-only, so this is not a problem
today — but adding Windows to that suite would surface it.
## Verification
All workflow YAML parses, and every local `uses:` reference resolves —
no dangling paths after the rename and re-add.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Follow-up to #1027, which added Windows coverage for the caching smoke
tests. `basic-cache-verify-build` failed on Windows for a reason
unrelated to #1013.
## Root cause
The Windows seed job **never uploaded a cache entry, but reported that
it did**. `gh cache list` showed no `setup-java-Windows-*` entry at all,
despite the job logging `Basic caching saved entry with key:
setup-java-Windows-x64-gradle-594edf…`. The keys were never the problem
— seed and verify requested the identical key.
The seed build leaves a Gradle daemon running, holding the `*.lock`
files in the Gradle User Home. On Windows those locks are mandatory, so
`tar` cannot read them:
```
/usr/bin/tar: ../../.gradle/caches/modules-2/modules-2.lock: Read error at byte 0,
while reading 38 bytes: Device or resource busy
/usr/bin/tar: Exiting with failure status due to previous errors
```
38 bytes is exactly Gradle's lock-file header — the region the daemon
holds via `FileChannel.lock()`. On Linux the lock is advisory and tar
reads straight through, which is why this only ever failed on Windows.
`cache.saveCache()` catches the tar failure, logs it, and returns `-1`
rather than throwing. `BasicCacheService.save()` ignored the return
value, so the seed job went green and the failure surfaced only later —
as a plugin resolution error in the verify job, pointing nowhere near
caching.
## Changes
**1. Warn when the save fails.** Check the returned `cacheId` and, when
it is `-1`, emit a warning and report `(Entry not saved: save failed)`
in the job summary. Caching failures still do not fail the build.
**2. Run the seed build with `--no-daemon`.** Daemon management for
enhanced caching lives in the `gradle-actions-caching` library; basic
caching leaves it to the workflow, so the smoke test now ensures no
daemon is holding locks when the post-action save runs.
## Not related to #1013
The enhanced provider fails differently on Windows — every entry dies at
path validation, before tar runs (`Path Validation Error: Path(s)
specified in the action for caching do(es) not exist`). Same symptom,
different mechanism; that one is unchanged here and is still expected to
be red.
## Verification
`npm run check` and `npm test` pass locally (373 tests). The real check
is this PR's Windows run: `basic-cache-seed-build` and
`basic-cache-verify-build` should both be green on `windows-latest`,
while the `restore-gradle-home-*` Windows jobs stay red pending the
#1013 fix.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
## Why
Issue #1013 revealed that caching was **never storing content on
Windows**. Nothing caught it because the integ-tests lost their multi-OS
matrices: these workflows used to default to `'["ubuntu-latest",
"windows-latest", "macos-latest"]'`, narrowed to ubuntu-only in bcd07e66
/ d74ee73e (Aug 2024). The Windows code path has been dark ever since.
## What
Extract the two cheapest caching tests — `restore-gradle-home` and
`basic-cache-provider` — into a new `suite-smoke-test-caching` workflow,
and run that suite on both `ubuntu-latest` and `windows-latest`.
Both tests seed a cache in one job and then verify it in a dependent job
with an `--offline` build, so a cache that stores nothing fails the
verify job rather than passing silently.
- Rename `integ-test-{restore-gradle-home,basic-cache-provider}` →
`smoke-test-*` and drop them from `suite-integ-test-caching`
- Add the new suite to both `CI-integ-test` and `CI-integ-test-full`,
each with its own concurrency group matching the sibling suites
- Include `smoke-tests` in the `integ-test-success` aggregate gate
- Ignore the generated `task-configured.txt` marker in
`workflow-samples`
- Drop a dead `needs.determine-suite` guard on the `build-distribution`
step — `CI-integ-test` has no such job, so it always evaluated to true
The suite runs on Windows in PR CI (not just `CI-integ-test-full`)
specifically so the failure is visible on this PR and the fix can be
verified the same way.
## Expected result
This PR is expected to be **red on Windows**.
`restore-gradle-home-dependencies-cache` and `basic-cache-verify-build`
should fail with dependency-resolution errors under `--offline` — that
is the bug from #1013 being caught. The ubuntu legs should stay green.
Cross-OS cache keys are safe: both providers include `RUNNER_OS` in the
key (`sources/src/cache-service-basic.ts:146`), so the matrix legs don't
collide.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>
Pass develocityAccessToken and develocityServerUrl the
`gradle-actions-caching`: required to support project-entry caching
(build-logic + configuration-cache), which has experimental support in
'gradle-actions-cache@v0.8.0. This support is not yet released and will
be available as a restricted trial.
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Render the configuration-cache restore-state in the caching Job Summary,
driven by the new `CacheReport.configurationCache` field produced by the
`gradle-actions-caching` provider.
## What's here
- `cache-service.ts`: add a `ConfigurationCacheStatus` type
(`not-active` / `restored` / `not-restored` / `restore-incomplete`) and
an optional `configurationCache` field on `CacheReport`.
- `caching-report.ts`: a `CONFIG_CACHE_COPY` map and a prominent status
line in `renderCachingReport`, beside the cleanup line. The `not-active`
case links to the `#cache-encryption-key` docs.
## Cross-repo dependency
The field is populated by gradle/actions-caching PR #75 ("Restore
configuration-cache support for simple builds"). This rendering compiles
independently (it uses this repo's own `CacheReport` type) and renders
nothing until the vendored `gradle-actions-caching` bundle is refreshed
from that branch — so this should land with/after the vendor refresh.
## Verification
`npm run check` clean; full Jest suite (366 tests) passes, including 3
new rendering tests.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Redesigns the caching section of the Job Summary into a single,
consistent layout across every cache provider and state, and integrates
the provider message into the report rather than appending it
disconnected at the bottom.
## Motivation
The caching report was produced by three divergent code paths (NoOp /
basic / enhanced), each rendering its own markdown:
- **Explicitly disabled** → a one-line message, no expand, no provider
note.
- **Enhanced** (incl. skipped-due-to-existing-home) → a full `<details>`
block.
- **Basic** → a one-line message with **no** expandable details at all.
The Enhanced/Basic provider note floated at the very bottom,
disconnected from the report.
## What changed
`save()` now returns structured `CacheReport` data instead of
pre-rendered HTML, and a single renderer (`caching-report.ts`) produces
one unified layout for all variants:
- **Section heading**: `#### <icon> Gradle Caching — <Provider>
(<status>)`
- **Status line** explaining what the cache did
- **Integrated provider note** woven in under the heading — now shown
**unconditionally** (no longer gated on license acceptance)
- **Expandable cache-entry details** when there are entries — basic
caching now gets this too
The two disabled variants (explicitly disabled, and skipped due to a
pre-existing Gradle User Home) render as **compact callouts with no
expandable section**.
### Main repo
- `caching-report.ts` (new): central renderer + all framing copy + entry
table/`<pre>` helpers.
- `cache-service.ts`: `CacheReport` / `CacheEntryReport` / status types;
`save()` returns `CacheReport`.
- `cache-service-loader.ts`: `NoOp` returns a report;
`LicenseWarningCacheService` removed; new `getProviderNote()`.
- `cache-service-basic.ts`: builds a `CacheReport`.
- `job-summary.ts` / `setup-gradle.ts`: thread `CacheReport` +
`ProviderNote`.
- `configuration.ts`: remove now-unused `isCacheLicenseAccepted()`.
### Vendored library
The structured contract requires **gradle-actions-caching v0.7.0**
(gradle/actions-caching#74). This PR updates the vendored library to
that release — the official `Update gradle-actions-caching library to
v0.7.0` vendor commit is included here, so merging this PR ships the
redesign together with the library it depends on.
## Testing
- Both repos build; prettier + eslint clean.
- `gradle/actions`: 363/363 Jest tests pass, including new
`caching-report.test.ts` covering every variant.
- `gradle-actions-caching`: 74/74 pass under JDK 17.
- Rendered markdown verified for all five variants (enhanced/basic
enabled & read-only, disabled, skipped).
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Bot Githubaction <bot-githubaction@gradle.com>
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Prepares CI so a small, stable set of **required status checks** can be
enabled (which in turn unlocks auto-merge), instead of having to list
every fanned-out matrix job. GitHub required checks match by exact name
— no wildcards — so this reduces the surface to a handful of high-level
checks.
## Changes
- **`ci-integ-test.yml`**: add an aggregate gate job
`integ-test-success` that `needs:` all four top-level jobs (the three
suite jobs each wrap a reusable workflow that fans out into many nested
checks) and fails if any did not succeed. `if: always()` ensures it
reports even when a dependency fails. This collapses dozens of nested
integ-test checks into a single requireable check.
- **`ci-init-script-check.yml`**: remove the workflow-level
`pull_request.paths` filter so the workflow runs on every PR and always
reports a status check (previously it was absent on most PRs, which
would deadlock a required check). Relevant-change detection moves into
the job via `tj-actions/changed-files` (same pinned action already used
by `ci-check-no-dist-update.yml`). On a PR the Java/Gradle/test steps
run only when init-script files changed; otherwise the job is a fast
no-op that still succeeds. Push and `workflow_dispatch` runs execute
fully as before.
## Suggested required-check set (all run on every PR, none can deadlock)
- `CI-check-and-unit-test / check-format-and-unit-test`
- `ci-validate-typings.yml / validate-typings`
- `CI-validate-wrappers / validation`
- `CI-codeql / Analyze (javascript-typescript)`
- `CI-integ-test / integ-test-success`
- `CI-init-script-check / test-init-scripts`
`ci-check-no-dist-update` is intentionally **omitted** — it only runs on
`dist/**` edits and is designed to fail, so it shouldn't be a required
gate.
> Confirm the exact check names from the list GitHub shows after this
branch runs once.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
The concurrency groups used fixed names spanning all branches, so a push
to main could cancel a pending PR run (and vice versa), leaving PRs not
fully tested.
Append ${{ github.ref }} to each group so runs only supersede pending
runs on the same branch, while different branches run in parallel. Also
drop the `queue: max` key, which is not a valid GitHub Actions
concurrency option and was ignored.
Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
Removes all `overrides` from `sources/package.json`. Two commits, each
independently verified:
## 1. Remove redundant security overrides
The `shell-quote`, `fast-xml-parser`, `fast-xml-builder` and `eslint >
brace-expansion` overrides added in #980 are **no-ops**: npm's natural
resolution already lands on the exact same patched versions, so they
upgrade nothing. The vulnerabilities were actually resolved by
regenerating the lockfile, not by the overrides.
## 2. Remove obsolete Octokit/Azure overrides
`@azure/logger`, `@octokit/request`, `@octokit/request-error` and
`@octokit/plugin-paginate-rest` were point-in-time pins added to
force-upgrade then-vulnerable transitive deps (5d947f45, #601). The
parent packages (`@actions/github`, `@actions/artifact`) have since
advanced and now resolve **newer, non-vulnerable** versions naturally —
so the overrides only pinned stale versions:
| Package | Pinned (override) | Natural |
|---|---|---|
| `@octokit/request` | 8.4.1 | 10.0.10 |
| `@octokit/request-error` | 5.1.1 | 7.1.0 |
| `@octokit/plugin-paginate-rest` | 9.2.2 | 14.0.0 |
| `@azure/logger` | 1.1.4 | 1.3.0 |
## Verification
- `npm audit` → **0 vulnerabilities**
- `./build` → passes
- `npm test` → **352/352 passing**
### Note on a flaky test
While testing I saw the `wrapper-validation` test *"fetches wrapper jar
checksums for snapshots"* intermittently fail (1–2 failures, then pass
on retry). It is a **pre-existing flaky network test** — it makes ~175
live calls to Gradle services and sits right at its 60s timeout. Its
code path imports neither Octokit nor Azure (`src/wrapper-validation/`
uses only `@actions/http-client`/`nock`/`cheerio`), so it is unrelated
to these overrides; the `nock`/`@mswjs/interceptors`/`undici` versions
are identical before and after.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
## What
Adds `overrides` to `sources/package.json` to force patched versions of
transitively-pulled packages flagged by Dependabot, plus one moderate
issue surfaced by `npm audit`:
| Package | Severity | Patched to | Pulled in via |
|---|---|---|---|
| `shell-quote` | Critical | 1.8.4 | `npm-run-all` |
| `fast-xml-builder` | High | 1.2.0 | `@actions/artifact` →
`@azure/storage-blob` → `@azure/core-xml` → `fast-xml-parser` |
| `fast-xml-parser` | Medium | 5.8.0 | `@actions/artifact` →
`@azure/storage-blob` → `@azure/core-xml` |
| `brace-expansion` | Moderate | 5.0.6 | `eslint` |
## Notes
- All four are **transitive** dependencies, so they're pinned via the
existing `overrides` block rather than direct version bumps.
- The patched versions satisfy the parents' declared ranges (e.g.
`@azure/core-xml` requires `fast-xml-parser ^5.0.7`; `fast-xml-parser`
5.8.0 requires `fast-xml-builder ^1.2.0`), so nothing is
force-downgraded or broken.
- `brace-expansion` is **scoped under `eslint`** rather than a blanket
override — most copies in the tree were already on the patched 5.0.6,
and only `eslint`'s was stuck at the vulnerable 5.0.5. A global override
would have forced unrelated 1.x/2.x copies up a major version.
## Verification
- `npm audit` → **0 vulnerabilities**
- `npm ci` → clean install, 0 vulnerabilities
- `npm test` → **352 passed, 14 suites**
The root `dist/` directory is intentionally left for the CI workflow to
update.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
## What
- Bumps `@actions/cache` 6.0.0 → 6.0.1
- Bumps `@actions/artifact` 6.1.0 → 6.2.1
- Removes the Dependabot `ignore` rules for both so they're maintained
automatically going forward
## Why
Both deps were excluded from Dependabot's automatic updates:
`*actions/cache*` was fully ignored, and `*actions/artifact*` had
major/minor bumps ignored. Neither restriction is necessary.
The `cache` ignore existed out of concern for keeping versions aligned
with the vendored `gradle-actions-caching` library. That alignment isn't
required:
- The vendored bundle (`sources/vendor/gradle-actions-caching/index.js`)
**inlines** its own (patched) `@actions/cache` and exposes a type-clean
API (`restore`/`save`) that never leaks `@actions/cache` types across
the boundary.
- This repo's own direct `@actions/cache` usage is a **separate,
unpatched copy** consumed via the stock string-returning API
(`cache-service-basic.ts`, `provision.ts`), with no
`patch-package`/`postinstall` in this repo.
So there's no cross-repo sync requirement — these can be updated like
any other dependency.
## Verification
- `npm install --package-lock-only` regenerated the lockfile (resolves
cache 6.0.1, artifact 6.2.1)
- `./build` passes clean
The root `dist/` directory is intentionally left for the CI workflow to
update.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com>
## Summary
- Reorganized setup-gradle caching docs into three clear sections:
general (shared options), Enhanced Caching, and Basic Caching
- Added new documentation for `cache-encryption-key`,
`gradle-home-cache-strict-match`, and the full Basic Caching section
(key strategy, stored content, limitations)
- Moved enhanced-only options (`cache-write-only`,
`cache-overwrite-existing`, `cache-cleanup`, includes/excludes, strict
matching) into the Enhanced Caching section
- Preserved all existing anchor links used by source code and other docs
🤖 Generated with [Claude Code](https://claude.com/claude-code)
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
## Summary
- **New `basic` cache provider**: Adds an open-source (MIT-licensed)
caching implementation built on `@actions/cache` as an alternative to
the proprietary Enhanced Caching. Users can opt in with `cache-provider:
basic` on both `setup-gradle` and `dependency-submission` actions.
- **Revamped licensing & distribution docs**: Replaces the verbose
licensing notice block (previously shown in README, docs, and logs) with
a friendlier callout and a new dedicated
[DISTRIBUTION.md](./DISTRIBUTION.md) covering component licensing, usage
tiers, data privacy ("Safe Harbor"), and opt-out instructions.
- **Improved messaging**: Enhanced Caching and Basic Caching each
display concise, informative log messages and job summary notes instead
of the previous wall-of-text license warning.
- **New integration tests**: Adds `integ-test-basic-cache-provider.yml`
workflow that seeds and verifies the basic cache provider across
platforms, plus unit tests for `BasicCacheService` and `getCacheService`
selection logic.
- **CI workflow reorganization**: Dependency-submission integration
tests extracted into their own reusable suite
(`suite-integ-test-dependency-submission.yml`); sample project tests
moved into the caching suite.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
This pull request includes dependency updates, a minor bug fix, and a
workflow update. The most significant changes are grouped below:
Dependency Updates:
* Updated several development dependencies in `sources/package.json`,
including `@typescript-eslint/eslint-plugin` to 8.58.0, `esbuild` to
0.28.0, and `ts-jest` to 29.4.9, to keep the project up to date with the
latest features and bug fixes.
Bug Fix:
* Fixed a typo in the import statement for `deprecation-collector` in
`sources/src/configuration.ts`, correcting the import from `de cator` to
`deprecator`.
CI/CD Workflow Update:
* Updated the commit hashes for the `github/codeql-action/init` and
`github/codeql-action/analyze` steps in
`.github/workflows/ci-codeql.yml` to use a newer commit, ensuring the
workflow uses the latest patches for these actions.
---------
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
This pull request primarily updates dependencies to ensure compatibility
and benefit from the latest features and fixes. The most significant
changes include upgrading the Develocity Gradle plugin and related
workflow/test matrix versions, as well as updating several
JavaScript/TypeScript development dependencies.
**Gradle and Develocity plugin updates:**
* Updated the `com.gradle.develocity` plugin version from `4.3.2` to
`4.4.0` across all workflow sample Gradle files and documentation. This
ensures the latest features and fixes are used in all example and test
projects.
[[1]](diffhunk://#diff-76298366dd6b8dd6f26592596c333884930a893c9553247c720b151c4e2ca314L2-R2)
[[2]](diffhunk://#diff-d4c2e31d274e47ae44389c511a1ba7fb24275335d155de5d013bcfa1631da3f4L2-R2)
[[3]](diffhunk://#diff-8ccb433ca9eee93c137fed07a97f755e10aae3a5989fbcd9eae427383a8c2243L2-R2)
[[4]](diffhunk://#diff-f71438b1f838b2006cbff9be742ce918a0a53dfa51ab838f480517f63da54e55L2-R2)
[[5]](diffhunk://#diff-f7ae8d202a355a0d67ecbaf0d3b18c5bc0ef3d94a546724ff776b20517d4318cL867-R867)
* Changed the Develocity plugin version in the integration test matrix
and related access key logic from `4.3.2` to `4.4.0` in the GitHub
Actions workflow configuration.
[[1]](diffhunk://#diff-670fc94ebca0a47e5491678ac19b6eeb5c06bbe5fb1786748f38b3a983564543L33-R33)
[[2]](diffhunk://#diff-670fc94ebca0a47e5491678ac19b6eeb5c06bbe5fb1786748f38b3a983564543L46-R46)
[[3]](diffhunk://#diff-670fc94ebca0a47e5491678ac19b6eeb5c06bbe5fb1786748f38b3a983564543L95-R95)
[[4]](diffhunk://#diff-670fc94ebca0a47e5491678ac19b6eeb5c06bbe5fb1786748f38b3a983564543L151-R151)
[[5]](diffhunk://#diff-670fc94ebca0a47e5491678ac19b6eeb5c06bbe5fb1786748f38b3a983564543L194-R194)
**GitHub Actions workflow updates:**
* Upgraded the `gradle/actions/setup-gradle` and
`gradle/actions/wrapper-validation` actions from v5.0.2 to v6.0.1 in all
relevant workflows, ensuring compatibility with the latest Gradle and
GitHub Actions features.
[[1]](diffhunk://#diff-67e3ccddaa5be01f56241af95a472ecc7b4eea0f6c71adb38e109207ea643af2L29-R29)
[[2]](diffhunk://#diff-20def8dd090267382644676ff63075fd8c64a9c8a9eeae936fc2451b10c063ccL33-R33)
[[3]](diffhunk://#diff-97df74640aaaa8bf2c853ceb34bc83eda56f6a670a91ef5a27e5c9ffcf1c9378L15-R15)
* Updated the `github/codeql-action/init` and
`github/codeql-action/analyze` actions to a new commit SHA, maintaining
up-to-date security scanning.
**JavaScript/TypeScript dependency updates:**
* Upgraded `@typescript-eslint/eslint-plugin` from `8.57.1` to `8.57.2`,
`eslint` from `10.0.3` to `10.1.0`, and `typescript` from `5.9.3` to
`6.0.2` in `sources/package-lock.json`, along with related dependency
tree updates for improved linting and TypeScript support.
[[1]](diffhunk://#diff-7e4a393257b8b2f1b2d998903badbc3175139afc4f7959f1a80f3a2fac68ecebL34-R44)
[[2]](diffhunk://#diff-7e4a393257b8b2f1b2d998903badbc3175139afc4f7959f1a80f3a2fac68ecebL1679-R1685)
[[3]](diffhunk://#diff-7e4a393257b8b2f1b2d998903badbc3175139afc4f7959f1a80f3a2fac68ecebL2857-R2867)
[[4]](diffhunk://#diff-7e4a393257b8b2f1b2d998903badbc3175139afc4f7959f1a80f3a2fac68ecebL2880-R2925)
[[5]](diffhunk://#diff-7e4a393257b8b2f1b2d998903badbc3175139afc4f7959f1a80f3a2fac68ecebL2917-R2946)
[[6]](diffhunk://#diff-7e4a393257b8b2f1b2d998903badbc3175139afc4f7959f1a80f3a2fac68ecebL2943-R2988)
[[7]](diffhunk://#diff-7e4a393257b8b2f1b2d998903badbc3175139afc4f7959f1a80f3a2fac68ecebR2997-R3015)
This is necessary to avoid loading a cache entry from a different test,
where the allowed wrapper checksums might have been cached, causing the
wrapper validation to unexpectedly succeed.
With licensing changes in v6, a license warning was added to the logs
and job summary. Now, accepting the Build Scan Terms of Use or providing
a Develocity Access Key will mute this warning.
Introduces type descriptor YAML files for GitHub
Actions in the repository, improving type safety and documentation for
action inputs and outputs. It also adds a new GitHub Actions workflow to
validate these typings automatically on pushes and pull requests. The
changes are grouped into the addition of type descriptor files for
various actions and the automation of their validation.
https://github.com/typesafegithub/github-actions-typing
**Type descriptor files for GitHub Actions:**
* Added `action-types.yml` files to `setup-gradle`,
`dependency-submission`, and `wrapper-validation` actions, specifying
input and output types for each action to improve type safety and
documentation.
[[1]](diffhunk://#diff-542de74831b6dc1954ff20a4c329b170053c82087ea7df742bd536156133f25bR1-R171)
[[2]](diffhunk://#diff-44708a3af3d0f3cfed1873f9b77d7e815c6c14e941fa3dd5ed08835a69d67855R1-R146)
[[3]](diffhunk://#diff-3fe1028d7aa5ee815c90fa580d4f62e646f0b9a4b7372f227fc131a56948ace0R1-R17)
**Automation and validation:**
* Introduced a new GitHub Actions workflow
`.github/workflows/ci-validate-typings.yml` to automatically validate
action typings on pushes to `main` and `release/**` branches, as well as
on pull requests. This uses the `github-actions-typing` action for
validation.
With this change, the caching functionality of `setup-gradle` and
`dependency-submission` is now provided by `gradle-actions-caching`, a
closed-source library distributed under our [Terms of
Use](https://gradle.com/legal/terms-of-use/). The rest of the action
implementation remains open source.
Using `setup-gradle` or `dependency-submission` with caching enabled
involves loading and using the `gradle-actions-caching` component,
requiring acceptance of the [Terms of
Use](https://gradle.com/legal/terms-of-use/). There are no functional
changes to caching provided by these actions: all workflows will
continue to function as before.
The non-caching aspects of action implementation remain open source. By
running these actions with caching disabled they can be used without
ever loading `gradle-actions-caching` or accepting the license terms.
Supporting the caching infrastructure in this project requires a
substantial engineering investment by Gradle Technologies, which we can
sustain thanks to Develocity, our commercial offering. Caching
technologies are a core part of the Develocity offering, and the caching
in `setup-gradle` fits squarely in that space.
This licensing change lets us continue to build advanced capabilities
that go beyond what we would offer as open source. Proper
production-ready Configuration Cache support will be the first
capability. Improving build performance for self-hosted runners will
follow.
We may introduce functionality restrictions in future updates. However,
caching functionality will remain free for public repositories.
We have a long-standing commitment to open source, as maintainers of
Gradle Build Tool, and by [sponsoring the open source
community](https://gradle.com/oss-sponsored-by-develocity/) with free
Develocity licenses. Public repositories are primarily used by open
source projects, and we remain committed to supporting them.
- Implementation of caching logic to save and restore Gradle User Home
content has been removed, replaced by the `gradle-actions-caching`
component.
- The `@actions/caching` library is still used to cache Gradle
distributions that are downloaded and provisioned by `setup-gradle`.
This PR updates to the latest version of `@actions/caching`, and removes
the patch that is no longer required.
- License notices are now displayed in documentation, logs and the
generated Job Summary.
Removes support for configuration-cache extraction and restore from the
caching workflow and related source code. Configuration-cache support
only worked for a limited set of projects (gradle/actions#21), and we
plan to reimplement this properly as part of the
`gradle-actions-caching` project.
The main impact is simplification of the caching logic, focusing only on
common Gradle artifacts. The `ConfigurationCacheEntryExtractor` class
and related logic were deleted from
`sources/src/caching/gradle-home-extry-extractor.ts`.
