mirror of
https://github.com/gradle/actions.git
synced 2026-08-21 13:22:52 +00:00
73e4c4222be7ce7f3685c9277a9e698ea3a28534
5
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 |
dcbab4e919 |
Bump npm-dependencies group with TypeScript 6.0.3, @types/node 24.x, and security fixes (#1033)
Supersedes #1023.
## 1. Adjust dependabot's TypeScript choices
Dependabot's group bump included two changes that we don't want to take
as-is:
- **typescript**: `5.9.3` → `7.0.2`. Pinned to **6.0.3** instead.
- **@types/node**: `25.9.2` → `26.1.1`. Downgraded to the latest 24.x
(**24.13.3**), matching the Node 24 runtime the actions target.
All other updates from #1023 are kept unchanged (`@actions/cache` 6.2.0,
`semver` 7.8.5, `@typescript-eslint/eslint-plugin` 8.65.0, `esbuild`
0.28.1, `eslint` 10.7.0, `globals` 17.7.0, `prettier` 3.9.6, `ts-jest`
29.4.12), and the branch is rebased onto current `main`.
The prettier 3.9.6 bump reformats two union types in
`sources/src/cache-service.ts`; that reformatting is included so `npm
run check` passes.
## 2. Clear 5 open security advisories
`npm audit` reported 4 high and 1 low severity advisory. All are fixable
with **semver-compatible transitive updates** — `npm audit fix` clears
them without `--force`, and `package.json` is untouched.
**Production** (bundled into `dist/`, so they ship in the actions):
| Package | Before | After | Via |
| --- | --- | --- | --- |
| `undici` | 6.24.1 | 6.28.0 | `@actions/github`, `@actions/http-client`
|
| `undici` | 7.24.5 | 7.29.0 | `cheerio` |
| `brace-expansion` | 5.0.6 | 5.0.9 | `@actions/glob` → `minimatch` |
| `brace-expansion` | 2.0.3 | 2.1.4 | `@actions/artifact` → `archiver` |
**Dev only:** `shell-quote` 1.8.4 → 1.10.0 (`npm-run-all`), `js-yaml`
3.14.2 → 3.15.1 (`ts-jest`), `@babel/core` 7.28.0 → 7.29.x (`ts-jest`,
low severity).
These were outstanding because the lockfile pins transitive resolutions
while `.github/dependabot.yml` only bumps direct dependencies. Because
`undici` and `brace-expansion` are production dependencies, the bundled
`dist/` output will change when the update-dist bot runs.
## 3. Downgrade nock to 14.0.17
**nock 15.0.0 was published by mistake.** The registry marks it
deprecated:
> v15.0.0 was released accidentally and is unstable. Please use v14.x
until v15 is officially ready.
nock's `latest` dist-tag still points at 14.0.17 for exactly this
reason, and 15.x remains a beta line (`beta` = `15.0.0-beta.14`).
Dependabot picked up 15.0.0 in an earlier group bump simply because it
is the highest published version. This moves us to 14.0.17, pulling
`@mswjs/interceptors` 0.39.8 → 0.41.9 and adding `propagate` 2.0.1.
Dependabot will likely re-propose nock 15.0.0 on its next weekly run,
since no ignore rule was added.
## 4. Delete unused `sources/.nvmrc`
The file pinned Node `v16`, contradicting `package.json` engines
(`>=24.0.0`), the esbuild `node24` target, and `.tool-versions` (`nodejs
24.3.0`). Nothing reads it — no workflow uses `node-version-file` and
there are no other references in the repo. Stale since
|
||
|
|
9c445f57df |
Support experimental project-entry caching (configuration-cache + build-logic) (#994)
Pass develocityAccessToken and develocityServerUrl the `gradle-actions-caching`: required to support project-entry caching (build-logic + configuration-cache), which has experimental support in 'gradle-actions-cache@v0.8.0. This support is not yet released and will be available as a restricted trial. --------- Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
|
e993c93d71 |
Render configuration-cache status in the caching Job Summary (#989)
Render the configuration-cache restore-state in the caching Job Summary, driven by the new `CacheReport.configurationCache` field produced by the `gradle-actions-caching` provider. ## What's here - `cache-service.ts`: add a `ConfigurationCacheStatus` type (`not-active` / `restored` / `not-restored` / `restore-incomplete`) and an optional `configurationCache` field on `CacheReport`. - `caching-report.ts`: a `CONFIG_CACHE_COPY` map and a prominent status line in `renderCachingReport`, beside the cleanup line. The `not-active` case links to the `#cache-encryption-key` docs. ## Cross-repo dependency The field is populated by gradle/actions-caching PR #75 ("Restore configuration-cache support for simple builds"). This rendering compiles independently (it uses this repo's own `CacheReport` type) and renders nothing until the vendored `gradle-actions-caching` bundle is refreshed from that branch — so this should land with/after the vendor refresh. ## Verification `npm run check` clean; full Jest suite (366 tests) passes, including 3 new rendering tests. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
|
97715a29bc |
Redesign the caching Job Summary (#985)
Redesigns the caching section of the Job Summary into a single, consistent layout across every cache provider and state, and integrates the provider message into the report rather than appending it disconnected at the bottom. ## Motivation The caching report was produced by three divergent code paths (NoOp / basic / enhanced), each rendering its own markdown: - **Explicitly disabled** → a one-line message, no expand, no provider note. - **Enhanced** (incl. skipped-due-to-existing-home) → a full `<details>` block. - **Basic** → a one-line message with **no** expandable details at all. The Enhanced/Basic provider note floated at the very bottom, disconnected from the report. ## What changed `save()` now returns structured `CacheReport` data instead of pre-rendered HTML, and a single renderer (`caching-report.ts`) produces one unified layout for all variants: - **Section heading**: `#### <icon> Gradle Caching — <Provider> (<status>)` - **Status line** explaining what the cache did - **Integrated provider note** woven in under the heading — now shown **unconditionally** (no longer gated on license acceptance) - **Expandable cache-entry details** when there are entries — basic caching now gets this too The two disabled variants (explicitly disabled, and skipped due to a pre-existing Gradle User Home) render as **compact callouts with no expandable section**. ### Main repo - `caching-report.ts` (new): central renderer + all framing copy + entry table/`<pre>` helpers. - `cache-service.ts`: `CacheReport` / `CacheEntryReport` / status types; `save()` returns `CacheReport`. - `cache-service-loader.ts`: `NoOp` returns a report; `LicenseWarningCacheService` removed; new `getProviderNote()`. - `cache-service-basic.ts`: builds a `CacheReport`. - `job-summary.ts` / `setup-gradle.ts`: thread `CacheReport` + `ProviderNote`. - `configuration.ts`: remove now-unused `isCacheLicenseAccepted()`. ### Vendored library The structured contract requires **gradle-actions-caching v0.7.0** (gradle/actions-caching#74). This PR updates the vendored library to that release — the official `Update gradle-actions-caching library to v0.7.0` vendor commit is included here, so merging this PR ships the redesign together with the library it depends on. ## Testing - Both repos build; prettier + eslint clean. - `gradle/actions`: 363/363 Jest tests pass, including new `caching-report.test.ts` covering every variant. - `gradle-actions-caching`: 74/74 pass under JDK 17. - Rendered markdown verified for all five variants (enhanced/basic enabled & read-only, disabled, skipped). 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Bot Githubaction <bot-githubaction@gradle.com> Co-authored-by: Claude Opus 4.8 (1M context) <noreply@anthropic.com> |
||
|
Daz DeBoerandGitHub
|
a0ee12f71e |
Extract caching logic into a separate gradle-actions-caching component (#885)
With this change, the caching functionality of `setup-gradle` and `dependency-submission` is now provided by `gradle-actions-caching`, a closed-source library distributed under our [Terms of Use](https://gradle.com/legal/terms-of-use/). The rest of the action implementation remains open source. Using `setup-gradle` or `dependency-submission` with caching enabled involves loading and using the `gradle-actions-caching` component, requiring acceptance of the [Terms of Use](https://gradle.com/legal/terms-of-use/). There are no functional changes to caching provided by these actions: all workflows will continue to function as before. The non-caching aspects of action implementation remain open source. By running these actions with caching disabled they can be used without ever loading `gradle-actions-caching` or accepting the license terms. Supporting the caching infrastructure in this project requires a substantial engineering investment by Gradle Technologies, which we can sustain thanks to Develocity, our commercial offering. Caching technologies are a core part of the Develocity offering, and the caching in `setup-gradle` fits squarely in that space. This licensing change lets us continue to build advanced capabilities that go beyond what we would offer as open source. Proper production-ready Configuration Cache support will be the first capability. Improving build performance for self-hosted runners will follow. We may introduce functionality restrictions in future updates. However, caching functionality will remain free for public repositories. We have a long-standing commitment to open source, as maintainers of Gradle Build Tool, and by [sponsoring the open source community](https://gradle.com/oss-sponsored-by-develocity/) with free Develocity licenses. Public repositories are primarily used by open source projects, and we remain committed to supporting them. - Implementation of caching logic to save and restore Gradle User Home content has been removed, replaced by the `gradle-actions-caching` component. - The `@actions/caching` library is still used to cache Gradle distributions that are downloaded and provisioned by `setup-gradle`. This PR updates to the latest version of `@actions/caching`, and removes the patch that is no longer required. - License notices are now displayed in documentation, logs and the generated Job Summary. |