actions/gradle
1
0
Fork 0
mirror of https://github.com/gradle/actions.git synced 2026-07-26 14:14:32 +02:00
Code Issues Packages Projects Releases Wiki Activity
2,159 Commits 17 Branches 119 Tags
82051144474b723e63a98f67b5e04e4e714f0ab1
Commit Graph
100 Commits
This Branch
This Branch
All Branches
Author SHA1 Message Date
Daz DeBoerandGitHub 8205114447 Update Gradle version compatibility information 2026-03-23 17:38:52 -06:00
Daz DeBoerandGitHub 6710000013 Add typing information for use by typesafegithub (#910) 
Introduces type descriptor YAML files for GitHub
Actions in the repository, improving type safety and documentation for
action inputs and outputs. It also adds a new GitHub Actions workflow to
validate these typings automatically on pushes and pull requests. The
changes are grouped into the addition of type descriptor files for
various actions and the automation of their validation.

https://github.com/typesafegithub/github-actions-typing

**Type descriptor files for GitHub Actions:**

* Added `action-types.yml` files to `setup-gradle`,
`dependency-submission`, and `wrapper-validation` actions, specifying
input and output types for each action to improve type safety and
documentation.

[[1]](diffhunk://#diff-542de74831b6dc1954ff20a4c329b170053c82087ea7df742bd536156133f25bR1-R171)
[[2]](diffhunk://#diff-44708a3af3d0f3cfed1873f9b77d7e815c6c14e941fa3dd5ed08835a69d67855R1-R146)
[[3]](diffhunk://#diff-3fe1028d7aa5ee815c90fa580d4f62e646f0b9a4b7372f227fc131a56948ace0R1-R17)

**Automation and validation:**

* Introduced a new GitHub Actions workflow
`.github/workflows/ci-validate-typings.yml` to automatically validate
action typings on pushes to `main` and `release/**` branches, as well as
on pull requests. This uses the `github-actions-typing` action for
validation.
 2026-03-23 12:14:14 -06:00
Daz DeBoer 3d0e2a88da Pin version for github actions 2026-03-23 12:11:47 -06:00
Daz DeBoer f663ed9f3d Ignore internal action files for type validation 2026-03-23 12:10:10 -06:00
Daz DeBoerandGitHub 6c6dec06f4 Fix rendering of job-disabled message (#909) 2026-03-23 11:34:26 -06:00
Daz DeBoer dd0829a494 Add cache-disabled example to demo workflow 2026-03-23 11:11:46 -06:00
Daz DeBoerandGitHub 9c9963b8af Dependency updates (#905) 2026-03-23 11:02:00 -06:00
Daz DeBoer 8bfa39f571 Add instructions for claude 2026-03-23 10:20:32 -06:00
Daz DeBoerandClaude Opus 4.6 db39ac7061 Fix critical and high npm vulnerabilities 
Update transitive dependencies to resolve 4 security vulnerabilities:
- fast-xml-parser 5.2.0 → 5.5.8 (critical: DoS, entity expansion, stack overflow)
- flatted 3.3.3 → 3.4.2 (high: recursion DoS, prototype pollution)
- minimatch 3.1.2/5.1.6/9.0.5 → 3.1.5/5.1.9/9.0.9 (high: ReDoS)
- undici 6.23.0/7.21.0 → 6.24.1/7.24.5 (high: WebSocket overflow, HTTP smuggling)

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>
 2026-03-23 10:19:28 -06:00
Daz DeBoerandGitHub 25454f526a Avoid windows shutdown bug (#900) 
* Avoid windows shutdown bug with shutdown delay
* Use a separate concurrency group for integ-test-full
 2026-03-23 09:43:17 -06:00
Daz DeBoer 2cab5e3c71 Fix path for running full-integ-test 2026-03-20 10:20:00 -06:00
Daz DeBoer 56227c19fe Run only one integ-test suite at a time 2026-03-20 10:16:30 -06:00
Daz DeBoer b99ed96fc6 Fix branch name for update PR 2026-03-20 09:14:33 -06:00
Daz DeBoer 9becd650e8 Run integ-test-full for gradle-actions-caching updates 2026-03-20 08:26:42 -06:00
Daz DeBoerandGitHub a0ee12f71e Extract caching logic into a separate gradle-actions-caching component (#885) 
With this change, the caching functionality of `setup-gradle` and
`dependency-submission` is now provided by `gradle-actions-caching`, a
closed-source library distributed under our [Terms of
Use](https://gradle.com/legal/terms-of-use/). The rest of the action
implementation remains open source.

Using `setup-gradle` or `dependency-submission` with caching enabled
involves loading and using the `gradle-actions-caching` component,
requiring acceptance of the [Terms of
Use](https://gradle.com/legal/terms-of-use/). There are no functional
changes to caching provided by these actions: all workflows will
continue to function as before.

The non-caching aspects of action implementation remain open source. By
running these actions with caching disabled they can be used without
ever loading `gradle-actions-caching` or accepting the license terms.

Supporting the caching infrastructure in this project requires a
substantial engineering investment by Gradle Technologies, which we can
sustain thanks to Develocity, our commercial offering. Caching
technologies are a core part of the Develocity offering, and the caching
in `setup-gradle` fits squarely in that space.

This licensing change lets us continue to build advanced capabilities
that go beyond what we would offer as open source. Proper
production-ready Configuration Cache support will be the first
capability. Improving build performance for self-hosted runners will
follow.

We may introduce functionality restrictions in future updates. However,
caching functionality will remain free for public repositories.
We have a long-standing commitment to open source, as maintainers of
Gradle Build Tool, and by [sponsoring the open source
community](https://gradle.com/oss-sponsored-by-develocity/) with free
Develocity licenses. Public repositories are primarily used by open
source projects, and we remain committed to supporting them.

- Implementation of caching logic to save and restore Gradle User Home
content has been removed, replaced by the `gradle-actions-caching`
component.
- The `@actions/caching` library is still used to cache Gradle
distributions that are downloaded and provisioned by `setup-gradle`.
This PR updates to the latest version of `@actions/caching`, and removes
the patch that is no longer required.
- License notices are now displayed in documentation, logs and the
generated Job Summary.
 2026-03-18 14:57:27 -06:00
Daz DeBoerandGitHub c999154b1f Remove configuration-cache support (#884) 
Removes support for configuration-cache extraction and restore from the
caching workflow and related source code. Configuration-cache support
only worked for a limited set of projects (gradle/actions#21), and we
plan to reimplement this properly as part of the
`gradle-actions-caching` project.

The main impact is simplification of the caching logic, focusing only on
common Gradle artifacts. The `ConfigurationCacheEntryExtractor` class
and related logic were deleted from
`sources/src/caching/gradle-home-extry-extractor.ts`.
 2026-03-18 14:27:09 -06:00
Daz DeBoerGitHubbot-githubactiondependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 		a3dd0763dc Dependency updates (#876) 
* Bump Gradle Wrapper from 9.3.1 to 9.4.0.

Release notes of Gradle 9.4.0 can be found here:
https://docs.gradle.org/9.4.0/release-notes.html

Signed-off-by: bot-githubaction <bot-githubaction@gradle.com>

* Bump the github-actions group across 3 directories with 3 updates

Bumps the github-actions group with 3 updates in the / directory: [gradle/actions](https://github.com/gradle/actions), [actions/upload-artifact](https://github.com/actions/upload-artifact) and [actions/download-artifact](https://github.com/actions/download-artifact).
Bumps the github-actions group with 1 update in the /.github/actions/build-dist directory: [actions/upload-artifact](https://github.com/actions/upload-artifact).
Bumps the github-actions group with 1 update in the /.github/actions/init-integ-test directory: [actions/download-artifact](https://github.com/actions/download-artifact).


Updates `gradle/actions` from 5.0.1 to 5.0.2
- [Release notes](https://github.com/gradle/actions/releases)
- [Commits](https://github.com/gradle/actions/compare/f29f5a9d7b09a7c6b29859002d29d24e1674c884...0723195856401067f7a2779048b490ace7a47d7c)

Updates `actions/upload-artifact` from 6.0.0 to 7.0.0
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/b7c566a772e6b6bfb58ed0dc250532a479d7789f...bbbca2ddaa5d8feaa63e36b76fdaad77386f024f)

Updates `actions/download-artifact` from 7.0.0 to 8.0.0
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/37930b1c2abaa49bbe596cd826c3c89aef350131...70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3)

Updates `actions/upload-artifact` from 6.0.0 to 7.0.0
- [Release notes](https://github.com/actions/upload-artifact/releases)
- [Commits](https://github.com/actions/upload-artifact/compare/b7c566a772e6b6bfb58ed0dc250532a479d7789f...bbbca2ddaa5d8feaa63e36b76fdaad77386f024f)

Updates `actions/download-artifact` from 7.0.0 to 8.0.0
- [Release notes](https://github.com/actions/download-artifact/releases)
- [Commits](https://github.com/actions/download-artifact/compare/37930b1c2abaa49bbe596cd826c3c89aef350131...70fc10c6e5e1ce46ad2ea6f2b72d43f7d47b13c3)

---
updated-dependencies:
- dependency-name: gradle/actions
  dependency-version: 5.0.2
  dependency-type: direct:production
  update-type: version-update:semver-patch
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/download-artifact
  dependency-version: 8.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/upload-artifact
  dependency-version: 7.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
- dependency-name: actions/download-artifact
  dependency-version: 8.0.0
  dependency-type: direct:production
  update-type: version-update:semver-major
  dependency-group: github-actions
...

Signed-off-by: dependabot[bot] <support@github.com>

* Bump the npm-dependencies group in /sources with 3 updates

Bumps the npm-dependencies group in /sources with 3 updates: [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node), [dedent](https://github.com/dmnd/dedent) and [globals](https://github.com/sindresorhus/globals).


Updates `@types/node` from 25.3.2 to 25.3.3
- [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases)
- [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node)

Updates `dedent` from 1.7.1 to 1.7.2
- [Release notes](https://github.com/dmnd/dedent/releases)
- [Changelog](https://github.com/dmnd/dedent/blob/main/CHANGELOG.md)
- [Commits](https://github.com/dmnd/dedent/compare/v1.7.1...v1.7.2)

Updates `globals` from 17.3.0 to 17.4.0
- [Release notes](https://github.com/sindresorhus/globals/releases)
- [Commits](https://github.com/sindresorhus/globals/compare/v17.3.0...v17.4.0)

---
updated-dependencies:
- dependency-name: "@types/node"
  dependency-version: 25.3.3
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: dedent
  dependency-version: 1.7.2
  dependency-type: direct:development
  update-type: version-update:semver-patch
  dependency-group: npm-dependencies
- dependency-name: globals
  dependency-version: 17.4.0
  dependency-type: direct:development
  update-type: version-update:semver-minor
  dependency-group: npm-dependencies
...

Signed-off-by: dependabot[bot] <support@github.com>

---------

Signed-off-by: bot-githubaction <bot-githubaction@gradle.com>
Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: bot-githubaction <bot-githubaction@gradle.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
 2026-03-06 09:32:11 -07:00
Daz DeBoerandGitHub fa3616072f Remove superfluous text from log message (#861) 2026-02-23 13:13:12 -07:00
Daz DeBoerandGitHub 78f7dee633 Workflow fixes (#856) 
* Fix cache key for cleanup check in workflow
* Rename job for custom report submission in workflow
 2026-02-12 10:37:44 -07:00
Daz DeBoer 1f0a4bb10f Install DV agent for ci-update-dist workflow 2026-02-11 07:52:58 -07:00
Daz DeBoer 9bbab15bc5 Convert Develocity config to cjs 2026-02-11 07:46:23 -07:00
Daz DeBoerandGitHub 2b9247147a Convert project to ESM and update dependencies (#854) 
- Switch to esbuild for bundling
- Update npm dependency version
- Add require header for compat with older JS libs
 2026-02-10 15:30:49 -07:00
Daz DeBoerandGitHub d9d9739be8 Use recommended DV config for npm 2026-02-10 12:53:02 -07:00
Daz DeBoerandGitHub bc2dd73ee2 Update dependencies (#851) 2026-02-10 11:49:07 -07:00
Daz DeBoer 49ec880f92 Avoid open interceptors in unit test 2026-01-28 16:39:57 -07:00
Daz DeBoerandGitHub f29f5a9d7b Attempt to fix flaky caching tests (#836) 2026-01-28 11:03:09 -07:00
Daz DeBoerandGitHub 8c7f3ffba4 Bump to v1.4.1 of the dependency-submission plugin 2026-01-27 14:01:25 -07:00
Daz DeBoerandGitHub de83f33963 Update Gradle version and Gradle dependencies (#834) 2026-01-27 07:32:01 -07:00
Daz DeBoerandGitHub fd888822a4 Fix setting env vars for plugin repository (#669) 
- Removed double underscore from DEVELOCITY_INJECTION_PLUGIN_REPOSITORY_* env vars
- Set GRADLE_PLUGIN_REPOSITORY_* env vars
 2025-06-11 15:28:50 -06:00
Daz DeBoerandGitHub bf78bf9f10 Dependency updates (#667) 2025-06-11 15:22:41 -06:00
daz ca92106195 Use Java 17 for toolchain build 2025-06-11 15:22:16 -06:00
daz eb0816ba44 Fix update-wrapper-checksums workflow 2025-06-11 15:22:16 -06:00
Daz DeBoerandGitHub 8379f6a132 Use v1.4.0 of dependency graph plugin (#638) 2025-05-16 11:01:06 -06:00
Daz DeBoerandGitHub 2ad385cb2a Replace use of typed-rest-client with @actions/http-client (#634) 
Fixes #630
 2025-05-05 13:44:42 -06:00
Daz DeBoerandGitHub 39dddb8ae7 Remove direct use of octokit/request-error (#632) 2025-05-05 08:57:57 -06:00
Daz DeBoerandGitHub 34c9a96361 Dependency updates (#629) 2025-05-02 08:54:17 -06:00
daz d0b9e7db8b Use Gradle 8.14 everywhere 2025-05-02 16:49:18 +02:00
Daz DeBoerandGitHub f8c7f760b1 Mention that build-scan-publish does not force publishing 2025-05-02 08:22:31 -06:00
Daz DeBoerandGitHub 99f534b94b Dependency updates (#622) 2025-04-27 13:10:26 -06:00
Daz DeBoerandGitHub 4193cbbd7b Dependency updates (#605) 
- Regenerate `package-lock.json` to update transitives
- Bump version of NodeJs used for local development
 2025-04-09 17:39:55 -06:00
Daz DeBoerandGitHub 1d43080849 Update to ESLint 9.x (#604) 2025-04-09 17:15:55 -06:00
daz 078dac7a70 Lint: Prefix unused variables/parameters 2025-04-09 16:55:51 -06:00
daz 016b3d4592 Upgrade to latest eslint 2025-04-09 16:55:48 -06:00
Daz DeBoerandGitHub e1fcfa43cf Remove unused and add missing dependencies (#603) 2025-04-09 16:53:59 -06:00
daz 5d947f45a5 Upgrade vulnerable dependencies 2025-04-09 15:43:31 -06:00
daz 6f6de16adf Remove unused dependency 2025-04-09 15:29:54 -06:00
Daz DeBoerandGitHub 176e6fd709 Bump to @azure/logger 1.1.4 (#601) 2025-04-09 14:48:37 -06:00
Daz DeBoerandGitHub 46c9941b16 Update to latest npm build scans (#600) 2025-04-09 14:47:12 -06:00
daz 8d71e4ef38 Bump @babel/helpers to a non-vulnerable version 2025-04-09 11:06:15 -06:00
Daz DeBoerandGitHub dc4f141bca Bump the gradle group across 3 directories with 2 updates (#588) 
Bumps the gradle group with 1 update in the
/.github/workflow-samples/groovy-dsl directory:
com.gradle.common-custom-user-data-gradle-plugin.
Bumps the gradle group with 1 update in the
/.github/workflow-samples/kotlin-dsl directory:
com.gradle.common-custom-user-data-gradle-plugin.
Bumps the gradle group with 2 updates in the /sources/test/init-scripts
directory: com.gradle.common-custom-user-data-gradle-plugin and
[com.fasterxml.jackson.dataformat:jackson-dataformat-smile](https://github.com/FasterXML/jackson-dataformats-binary).

Updates `com.gradle.common-custom-user-data-gradle-plugin` from 2.1 to
2.2.1

Updates `com.gradle.common-custom-user-data-gradle-plugin` from 2.1 to
2.2.1

Updates `com.gradle.common-custom-user-data-gradle-plugin` from 2.1 to
2.2.1

Updates `com.fasterxml.jackson.dataformat:jackson-dataformat-smile` from
2.18.2 to 2.18.3
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/FasterXML/jackson-dataformats-binary/commit/acc383b2387984ee22f892c95bb0a6377bc6fef9"><code>acc383b</code></a>
[maven-release-plugin] prepare release
jackson-dataformats-binary-2.18.3</li>
<li><a
href="https://github.com/FasterXML/jackson-dataformats-binary/commit/5184301b79ad9a60bce9e988bf1faf58fe9c6303"><code>5184301</code></a>
Prep for 2.18.3</li>
<li><a
href="https://github.com/FasterXML/jackson-dataformats-binary/commit/a390dde5fffc5fefaf83f9c56dc9f67b827f7e46"><code>a390dde</code></a>
Fix release notes</li>
<li><a
href="https://github.com/FasterXML/jackson-dataformats-binary/commit/2576b3901c52be72de2b3b4a261b010ef2575919"><code>2576b39</code></a>
Merge branch '2.17' into 2.18</li>
<li><a
href="https://github.com/FasterXML/jackson-dataformats-binary/commit/509c39c497ef7f296a5c58c51cf4ddb127c9eb29"><code>509c39c</code></a>
Add release notes for <a
href="https://redirect.github.com/FasterXML/jackson-dataformats-binary/issues/541">#541</a></li>
<li><a
href="https://github.com/FasterXML/jackson-dataformats-binary/commit/aae1b3714a81717e315cca295dcab19e856411c7"><code>aae1b37</code></a>
SmileParser getValueAsString() issue with JsonToken.FIELD_NAME (<a
href="https://redirect.github.com/FasterXML/jackson-dataformats-binary/issues/540">#540</a>)</li>
<li><a
href="https://github.com/FasterXML/jackson-dataformats-binary/commit/b7a257507d40a0ab8c18b7ebcb3eb5dbabf800f2"><code>b7a2575</code></a>
Move test for <a
href="https://redirect.github.com/FasterXML/jackson-dataformats-binary/issues/75">#75</a>
from failing to non-failing</li>
<li><a
href="https://github.com/FasterXML/jackson-dataformats-binary/commit/de5efeef12124ae338d4c97b4daecfe7751cb2fe"><code>de5efee</code></a>
Back to snapshot deps</li>
<li><a
href="https://github.com/FasterXML/jackson-dataformats-binary/commit/1f278423425385f7d3eba7dfcbb35c30d3e8aaad"><code>1f27842</code></a>
[maven-release-plugin] prepare for next development iteration</li>
<li>See full diff in <a
href="https://github.com/FasterXML/jackson-dataformats-binary/compare/jackson-dataformats-binary-2.18.2...jackson-dataformats-binary-2.18.3">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>
 2025-04-03 07:48:08 -06:00
Daz DeBoerandGitHub fdc7db9f7f Bump the github-actions group across 2 directories with 2 updates (#587) 
Bumps the github-actions group with 1 update in the / directory:
[gradle/actions](https://github.com/gradle/actions).
Bumps the github-actions group with 1 update in the
/.github/actions/init-integ-test directory:
[actions/download-artifact](https://github.com/actions/download-artifact).

Updates `gradle/actions` from 4.3.0 to 4.3.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/gradle/actions/releases">gradle/actions's
releases</a>.</em></p>
<blockquote>
<h2>v4.3.1</h2>
<p>This release fixes a couple of minor issues, as well as keeping
dependencies up to date.</p>
<h2>Fixed issues</h2>
<ul>
<li>The develocity-allow-untrusted-server parameter should be honoured
when fetching short-lived access tokens <a
href="https://redirect.github.com/gradle/actions/issues/583">#583</a></li>
<li>Build summary may incorrectly report build success <a
href="https://redirect.github.com/gradle/actions/issues/415">#415</a></li>
</ul>
<h2>What's Changed</h2>
<ul>
<li>Update develocity-injection init script to v1.1.1 by <a
href="https://github.com/bot-githubaction"><code>@​bot-githubaction</code></a>
in <a
href="https://redirect.github.com/gradle/actions/pull/545">gradle/actions#545</a></li>
<li>Bump the github-actions group across 2 directories with 3 updates by
<a href="https://github.com/dependabot"><code>@​dependabot</code></a> in
<a
href="https://redirect.github.com/gradle/actions/pull/547">gradle/actions#547</a></li>
<li>Bump the npm-dependencies group in /sources with 2 updates by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/gradle/actions/pull/548">gradle/actions#548</a></li>
<li>Update develocity-injection init script to v1.2 by <a
href="https://github.com/bot-githubaction"><code>@​bot-githubaction</code></a>
in <a
href="https://redirect.github.com/gradle/actions/pull/550">gradle/actions#550</a></li>
<li>Bump the github-actions group across 1 directory with 2 updates by
<a href="https://github.com/dependabot"><code>@​dependabot</code></a> in
<a
href="https://redirect.github.com/gradle/actions/pull/552">gradle/actions#552</a></li>
<li>Bump the npm-dependencies group across 1 directory with 5 updates by
<a href="https://github.com/dependabot"><code>@​dependabot</code></a> in
<a
href="https://redirect.github.com/gradle/actions/pull/558">gradle/actions#558</a></li>
<li>Update known wrapper checksums by <a
href="https://github.com/github-actions"><code>@​github-actions</code></a>
in <a
href="https://redirect.github.com/gradle/actions/pull/560">gradle/actions#560</a></li>
<li>Bump references to Develocity Gradle plugin from 3.19.1 to 3.19.2 by
<a
href="https://github.com/bot-githubaction"><code>@​bot-githubaction</code></a>
in <a
href="https://redirect.github.com/gradle/actions/pull/561">gradle/actions#561</a></li>
<li>Catch more build failures in job summary by <a
href="https://github.com/bigdaz"><code>@​bigdaz</code></a> in <a
href="https://redirect.github.com/gradle/actions/pull/571">gradle/actions#571</a></li>
<li>Scope captured build failures by <a
href="https://github.com/erichaagdev"><code>@​erichaagdev</code></a> in
<a
href="https://redirect.github.com/gradle/actions/pull/574">gradle/actions#574</a></li>
<li>Ignore SSL certificate validation when fetching Develocity
short-lived access token if
<code>develocity-allow-untrusted-server</code> is enabled by <a
href="https://github.com/remcomokveld"><code>@​remcomokveld</code></a>
in <a
href="https://redirect.github.com/gradle/actions/pull/575">gradle/actions#575</a></li>
<li>Dependency updates by <a
href="https://github.com/bigdaz"><code>@​bigdaz</code></a> in <a
href="https://redirect.github.com/gradle/actions/pull/579">gradle/actions#579</a></li>
<li>Bump com.google.guava:guava from 33.4.5-jre to 33.4.6-jre in
/.github/workflow-samples/kotlin-dsl in the gradle group across 1
directory by <a
href="https://github.com/dependabot"><code>@​dependabot</code></a> in <a
href="https://redirect.github.com/gradle/actions/pull/580">gradle/actions#580</a></li>
<li>Bump the github-actions group across 2 directories with 2 updates by
<a href="https://github.com/dependabot"><code>@​dependabot</code></a> in
<a
href="https://redirect.github.com/gradle/actions/pull/582">gradle/actions#582</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a
href="https://github.com/erichaagdev"><code>@​erichaagdev</code></a>
made their first contribution in <a
href="https://redirect.github.com/gradle/actions/pull/574">gradle/actions#574</a></li>
<li><a
href="https://github.com/remcomokveld"><code>@​remcomokveld</code></a>
made their first contribution in <a
href="https://redirect.github.com/gradle/actions/pull/575">gradle/actions#575</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/gradle/actions/compare/v4.3.0...v4.3.1">https://github.com/gradle/actions/compare/v4.3.0...v4.3.1</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/gradle/actions/commit/06832c7b30a0129d7fb559bcc6e43d26f6374244"><code>06832c7</code></a>
Bump the github-actions group across 2 directories with 2 updates</li>
<li><a
href="https://github.com/gradle/actions/commit/b7b029e5c461bcd4187e3922253a207372ea1d04"><code>b7b029e</code></a>
Bump com.google.guava:guava from 33.4.5-jre to 33.4.6-jre in
/.github/workflo...</li>
<li><a
href="https://github.com/gradle/actions/commit/a0bd2ca5cbf6404f68a1a02c2e2741218f894b90"><code>a0bd2ca</code></a>
[bot] Update dist directory</li>
<li><a
href="https://github.com/gradle/actions/commit/7974541d55b5d4265df89850a40d5063d2d3036e"><code>7974541</code></a>
Dependency updates (<a
href="https://redirect.github.com/gradle/actions/issues/579">#579</a>)</li>
<li><a
href="https://github.com/gradle/actions/commit/a58163930329ccce0ace4389791c82734e52204b"><code>a581639</code></a>
Update DSL samples to use test suites</li>
<li><a
href="https://github.com/gradle/actions/commit/acd2925667ac1dae317b3b2de03ce2d3b5da2205"><code>acd2925</code></a>
Update java-toolchain sample to use Kotlin DSL</li>
<li><a
href="https://github.com/gradle/actions/commit/aa88309fbde788037cd53df497543c8c40e5e2ae"><code>aa88309</code></a>
Update gradle-plugin sample to use Kotlin DSL</li>
<li><a
href="https://github.com/gradle/actions/commit/086c9e4b25c544ef148c374d34a7a844517c740b"><code>086c9e4</code></a>
Revert update to eslint-plugin-github</li>
<li><a
href="https://github.com/gradle/actions/commit/d31b81842d0028028432bad95773235ec859b85c"><code>d31b818</code></a>
Update patch file for actions/cache@v4.0.3</li>
<li><a
href="https://github.com/gradle/actions/commit/2778b4a120e9ad2ed71a81933fa2e09c33c15a72"><code>2778b4a</code></a>
Bump the npm-dependencies group across 1 directory with 8 updates</li>
<li>Additional commits viewable in <a
href="https://github.com/gradle/actions/compare/94baf225fe0a508e581a564467443d0e2379123b...06832c7b30a0129d7fb559bcc6e43d26f6374244">compare
view</a></li>
</ul>
</details>
<br />

Updates `actions/download-artifact` from 4.1.8 to 4.2.1
<details>
<summary>Release notes</summary>
<p><em>Sourced from <a
href="https://github.com/actions/download-artifact/releases">actions/download-artifact's
releases</a>.</em></p>
<blockquote>
<h2>v4.2.1</h2>
<h2>What's Changed</h2>
<ul>
<li>Add unit tests by <a
href="https://github.com/GhadimiR"><code>@​GhadimiR</code></a> in <a
href="https://redirect.github.com/actions/download-artifact/pull/392">actions/download-artifact#392</a></li>
<li>Fix bug introduced in 4.2.0 by <a
href="https://github.com/GhadimiR"><code>@​GhadimiR</code></a> in <a
href="https://redirect.github.com/actions/download-artifact/pull/391">actions/download-artifact#391</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/download-artifact/compare/v4.2.0...v4.2.1">https://github.com/actions/download-artifact/compare/v4.2.0...v4.2.1</a></p>
<h2>v4.2.0</h2>
<h2>What's Changed</h2>
<ul>
<li>Update README.md by <a
href="https://github.com/lkfortuna"><code>@​lkfortuna</code></a> in <a
href="https://redirect.github.com/actions/download-artifact/pull/384">actions/download-artifact#384</a></li>
<li>Bump artifact version, do digest check by <a
href="https://github.com/GhadimiR"><code>@​GhadimiR</code></a> in <a
href="https://redirect.github.com/actions/download-artifact/pull/383">actions/download-artifact#383</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/lkfortuna"><code>@​lkfortuna</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/download-artifact/pull/384">actions/download-artifact#384</a></li>
<li><a href="https://github.com/GhadimiR"><code>@​GhadimiR</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/download-artifact/pull/383">actions/download-artifact#383</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/download-artifact/compare/v4.1.9...v4.2.0">https://github.com/actions/download-artifact/compare/v4.1.9...v4.2.0</a></p>
<h2>v4.1.9</h2>
<h2>What's Changed</h2>
<ul>
<li>Add workflow file for publishing releases to immutable action
package by <a
href="https://github.com/Jcambass"><code>@​Jcambass</code></a> in <a
href="https://redirect.github.com/actions/download-artifact/pull/354">actions/download-artifact#354</a></li>
<li>docs: small migration fix by <a
href="https://github.com/froblesmartin"><code>@​froblesmartin</code></a>
in <a
href="https://redirect.github.com/actions/download-artifact/pull/370">actions/download-artifact#370</a></li>
<li>Update MIGRATION.md by <a
href="https://github.com/andyfeller"><code>@​andyfeller</code></a> in <a
href="https://redirect.github.com/actions/download-artifact/pull/372">actions/download-artifact#372</a></li>
<li>Update artifact package to 2.2.2 by <a
href="https://github.com/yacaovsnc"><code>@​yacaovsnc</code></a> in <a
href="https://redirect.github.com/actions/download-artifact/pull/380">actions/download-artifact#380</a></li>
</ul>
<h2>New Contributors</h2>
<ul>
<li><a href="https://github.com/Jcambass"><code>@​Jcambass</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/download-artifact/pull/354">actions/download-artifact#354</a></li>
<li><a
href="https://github.com/froblesmartin"><code>@​froblesmartin</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/download-artifact/pull/370">actions/download-artifact#370</a></li>
<li><a
href="https://github.com/andyfeller"><code>@​andyfeller</code></a> made
their first contribution in <a
href="https://redirect.github.com/actions/download-artifact/pull/372">actions/download-artifact#372</a></li>
<li><a href="https://github.com/yacaovsnc"><code>@​yacaovsnc</code></a>
made their first contribution in <a
href="https://redirect.github.com/actions/download-artifact/pull/380">actions/download-artifact#380</a></li>
</ul>
<p><strong>Full Changelog</strong>: <a
href="https://github.com/actions/download-artifact/compare/v4.1.8...v4.1.9">https://github.com/actions/download-artifact/compare/v4.1.8...v4.1.9</a></p>
</blockquote>
</details>
<details>
<summary>Commits</summary>
<ul>
<li><a
href="https://github.com/actions/download-artifact/commit/95815c38cf2ff2164869cbab79da8d1f422bc89e"><code>95815c3</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/download-artifact/issues/391">#391</a>
from GhadimiR/main</li>
<li><a
href="https://github.com/actions/download-artifact/commit/278fca438a0f334c0505181835b4796f2785949b"><code>278fca4</code></a>
Move log statements</li>
<li><a
href="https://github.com/actions/download-artifact/commit/68909842a1073010f1cf920ed7f153e2948f9c16"><code>6890984</code></a>
Merge branch 'main' into main</li>
<li><a
href="https://github.com/actions/download-artifact/commit/f9415c0ec30f02c18e075f091cafcfe4159168d0"><code>f9415c0</code></a>
Run unit tests in CI</li>
<li><a
href="https://github.com/actions/download-artifact/commit/76a6eb5cbca98dccb5e14c0116e53f5df13b220d"><code>76a6eb5</code></a>
Merge pull request <a
href="https://redirect.github.com/actions/download-artifact/issues/392">#392</a>
from GhadimiR/add_unit_tests</li>
<li><a
href="https://github.com/actions/download-artifact/commit/a2426d7c4522072f4d5824c9508d7ea97107cb8e"><code>a2426d7</code></a>
Merge branch 'main' into add_unit_tests</li>
<li><a
href="https://github.com/actions/download-artifact/commit/3ffa694f6f7e3d53f63807f78267796f57911dd4"><code>3ffa694</code></a>
lint</li>
<li><a
href="https://github.com/actions/download-artifact/commit/53f6aa5f93b626e252398abac720a28f6eb048ed"><code>53f6aa5</code></a>
Add extra assertion to download single artifact test</li>
<li><a
href="https://github.com/actions/download-artifact/commit/b456700053c87aa7d6b31d212292755e1e6eb923"><code>b456700</code></a>
lint</li>
<li><a
href="https://github.com/actions/download-artifact/commit/9eab798a9885c1be58a1c4381da1109644016e98"><code>9eab798</code></a>
Configure tsconfig</li>
<li>Additional commits viewable in <a
href="https://github.com/actions/download-artifact/compare/fa0a91b85d4f404e444e00e005971372dc801d16...95815c38cf2ff2164869cbab79da8d1f422bc89e">compare
view</a></li>
</ul>
</details>
<br />


Dependabot will resolve any conflicts with this PR as long as you don't
alter it yourself. You can also trigger a rebase manually by commenting
`@dependabot rebase`.

[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)

---

<details>
<summary>Dependabot commands and options</summary>
<br />

You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits
that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after
your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge
and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating
it. You can achieve the same result by closing it manually
- `@dependabot show <dependency name> ignore conditions` will show all
of the ignore conditions of the specified dependency
- `@dependabot ignore <dependency name> major version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's major version (unless you unignore this specific
dependency's major version or upgrade to it yourself)
- `@dependabot ignore <dependency name> minor version` will close this
group update PR and stop Dependabot creating any more for the specific
dependency's minor version (unless you unignore this specific
dependency's minor version or upgrade to it yourself)
- `@dependabot ignore <dependency name>` will close this group update PR
and stop Dependabot creating any more for the specific dependency
(unless you unignore this specific dependency or upgrade to it yourself)
- `@dependabot unignore <dependency name>` will remove all of the ignore
conditions of the specified dependency
- `@dependabot unignore <dependency name> <ignore condition>` will
remove the ignore condition of the specified dependency and ignore
conditions


</details>
 2025-04-03 07:47:15 -06:00
daz af84fa9a5b Sign commits in generated PR 2025-04-03 07:35:06 -06:00
daz bc00207b7b Tweak warning message 2025-04-02 12:38:50 -06:00
Daz DeBoerandGitHub 777b8de880 Sign bot-generated commits 2025-04-02 12:32:16 -06:00
Daz DeBoerandGitHub 57d85d9e4d Update release process to include tag signing 2025-04-02 12:11:44 -06:00
Daz DeBoerandGitHub 7974541d55 Dependency updates (#579) 2025-03-25 16:23:51 -06:00
daz a581639303 Update DSL samples to use test suites 2025-03-25 16:14:52 -06:00
daz acd2925667 Update java-toolchain sample to use Kotlin DSL 2025-03-25 16:14:51 -06:00
daz aa88309fbd Update gradle-plugin sample to use Kotlin DSL 2025-03-25 15:25:50 -06:00
daz 086c9e4b25 Revert update to eslint-plugin-github 2025-03-25 14:24:27 -06:00
daz d31b81842d Update patch file for actions/cache@v4.0.3 2025-03-25 14:23:37 -06:00
daz 203ed600ea Bump tj-actions/changed-files to 46.0.3 2025-03-25 14:10:36 -06:00
Daz DeBoerandGitHub 0eda626a36 Catch more build failures in job summary (#571) 
By inspecting a greater range of build operations for failure, the Job
summary will correctly reflect the build outcome in more circumstances.

Note that we now use the old 'buildFinished' mechanism for all Gradle
versions < `7.0`, instead of using the BuildService mechanism for all
Gradle versions from `6.6`. This avoids needing to deal with
inconsistent build operations present in Gradle versions `[6.6, 7.0)`.

Fixes #415
 2025-02-27 22:46:42 -07:00
Daz DeBoerandGitHub 7fcd895602 Bump references to Develocity Gradle plugin from 3.19.1 to 3.19.2 (#561) 
This PR bumps references to Develocity Gradle plugin from 3.19.1 to
3.19.2.
 2025-02-19 07:35:11 -07:00
Daz DeBoerandGitHub 4dc278e675 Update known wrapper checksums (#560) 
Automatically generated pull request to update the known wrapper
checksums.

In case of conflicts, manually run the workflow from the [Actions
tab](https://github.com/gradle/actions/actions/workflows/update-checksums-file.yml),
the changes will then be force-pushed onto this pull request branch.
Do not manually update the pull request branch; those changes might get
overwritten.

> [!IMPORTANT]  
> GitHub workflows have not been executed for this pull request yet.
Before merging, close and then directly reopen this pull request to
trigger the workflows.
 2025-02-18 14:14:58 -07:00
daz 7b5af35d9a Set author to bot for generated commits 2025-02-18 14:10:09 -07:00
Daz DeBoerandGitHub 94baf225fe Fix space assignment deprecations in init-scripts (#542) 
Fixes the Groovy syntax in 2 init-scripts to avoid deprecation warnings.
The fix to the DV injection script is temporary, and will be replaced by
a fix in the upstream reference script.

Fixes #541
 2025-01-30 10:07:29 -07:00
daz 6f10c21ec5 Make it easier to produce 'prerelease' versions 2025-01-30 09:02:58 -07:00
daz 0b492c475f Fix deprecation warnings in develocity init-script 
This change has been made directly to the init-script, and will be superceded
by the equivalent fix in the reference script.
 2025-01-30 08:51:44 -07:00
daz 79bad900c0 Fix deprecation warnings in dependency-graph init-script 2025-01-30 08:46:34 -07:00
Daz DeBoerandGitHub 986922f6a6 Update docs for dependency review (#540) 
Due to an issue with dependency-review-action (https://github.com/gradle/actions/issues/482),
the setup described in the documentation can result in duplicate 
dependencies being added to the dependency graph.

To avoid this, we now recommend using a common `dependency-submission`
workflow for both pushes to `main` and pull requests. 
The `dependency-review` workflow runs on any `pull_request` but will wait
for the `dependency-submission` to complete.

This setup works for both the standard setup, and for the advanced setup for 
pull requests from repository forks.
 2025-01-30 08:35:10 -07:00
daz 9053a599ae Update undici to resolve vulnerability 2025-01-28 08:27:11 -07:00
daz dcf3ce7005 Bump to Gradle 8.12.1 2025-01-25 09:21:22 -07:00
Daz DeBoerandGitHub 9a0c3c9368 Document GRADLE_ACTIONS_SKIP_BUILD_RESULT_CAPTURE (#529) 
Fixes #28
 2025-01-24 11:00:39 -07:00
Daz DeBoerandGitHub 91619fae90 Attempt to use gradle wrapper for cache cleanup (#525) 
The cache-cleanup operation works by executing Gradle on a dummy project
and a custom init-script. The version of Gradle used should be at least
as high as the newest version used to run a build.

Previously, if the Gradle version on PATH didn't meet this requirement,
the action would download and install the required Gradle version.

With this PR, the action will now use an existing Gradle wrapper
distribution if it meets the requirement. This avoids unnecessary
downloads of Gradle versions that are already present on the runner.

The logic is:
- Determine the newest version of Gradle that was executed during the
Job. This is the 'minimum version' for cache cleanup.
- Inspect the Gradle version on PATH and any detected wrapper scripts to
see if they meet the 'minimum version'.
- The first executable that is found to meet the requirements will be
used for cache-cleanup.
- If no executable is found that meets the requirements, attempt to
provision Gradle with the 'minimum version'.

Fixes #515
 2025-01-24 10:06:51 -07:00
Daz DeBoerandGitHub d068148857 Choose best Gradle version to use for cache cleanup (#526) 
The cache-cleanup operation works by executing Gradle on a dummy project
and a custom init-script. The init-script requires at least Gradle 8.11
to work.

Ideally, the version of Gradle used for cleanup should be no older than
the newest one that wrote entries to Gradle User Home. If an older
Gradle version is used for cache-cleanup, it will not remove entries
written specifically for newer versions.

With this change, we now attempt to ensure that cache-cleanup is run
with the best Gradle version available. We inspect the Gradle version on
PATH to see if it is new enough, otherwise we will provision a Gradle
version equal to the newest one that ran in the Job.

The logic is:
- Determine the newest version of Gradle that was executed during the
Job. This is the 'minimum version' for cache cleanup.
- Inspect the Gradle version on PATH (if any) to see if it is equal to
or newer than the 'minimum version'.
- If the version Gradle on PATH is new enough, use that version for
cache-cleanup.
- If not, attempt to provision Gradle with the 'minimum version'.

Fixes #436
 2025-01-24 06:16:52 -07:00
daz c6e631b4a7 Attempt to provision best gradle version for cache-cleanup 2025-01-23 17:37:15 -07:00
daz edf9e3c8c7 Improve comparison of Gradle versions 2025-01-23 17:36:14 -07:00
daz ec4681f7f5 Test provision of rc and milestone versions 2025-01-23 12:09:21 -07:00
daz 24aa9155d9 Fix minor typo in log message 2025-01-23 12:08:44 -07:00
daz 74f9fa840c Make it easier to run NPM tests locally 2025-01-23 12:07:37 -07:00
Daz DeBoerandGitHub 3bfa1140fc Update to CCUDGP 2.1 (#524) 
This change primarily impacts test projects and documentation. The only
material impact is that CCUD 2.1 will now be auto-applied when
publishing Build Scans automatically with `build-scan-publish: true`.
(Develocity injection does not hard-code any CCUD version)
 2025-01-21 21:34:02 -07:00
daz 245c8a24de Save dependency-graph file as workflow artifact 
Diagnosing unexpected dependencies in the GitHub Dependency Graph can
be difficult. In order to aid with diagnosis, the `dependency-submission`
action will  now save each dependency-graph file as a workflow artifact.

If this is undesirable, the prior behaviour can be restored by explicitly setting
`dependency-graph: generate-and-submit`.

Fixes #519
 2025-01-21 14:34:49 -07:00
daz 74628b9f13 Fix npm for update-dist 2025-01-21 09:55:18 -07:00
daz e4f356955f Avoid capturing build-results for cache cleanup 
The Gradle build used to perform cache-cleanup will run in the context of init-scripts
provided by the action, including those that collect build-results.
In some circumstances this can lead to unexpected results, such as saving configuration-cache
entries for cache cleanup executions.

With this change, build results will not be captured for cache-cleanup builds.
 2025-01-21 09:45:13 -07:00
Daz DeBoerandGitHub ec1d1bfd5f Avoid env-var interpolation in toolchains.xml (#518) 
Fixes #511
 2025-01-21 09:44:44 -07:00
Daz DeBoerandGitHub 52d4223bcd Add npm build scans (#517) 2025-01-21 07:37:50 -07:00
daz faf1d7ca7a Copy the raw JDK path into toolchains.xml 
Previously we were relying on Gradle to substitute JDK environment variables
in toolchains.xml. With this change, the actual path to the JDK is encoded instead.
This should avoid issues where Gradle is not able to successfully resolve the
envioronment variable.
 2025-01-20 10:20:43 -07:00
daz 392620bad1 Tidy up generation of toolchains.xml 2025-01-20 10:20:43 -07:00
daz e6f332ecb1 Publish build scans for CI builds 2025-01-20 09:56:42 -07:00
daz c9dc8a7709 Publish build scans for local builds 2025-01-19 15:09:35 -07:00
daz b1155b846e Include Develocity Agent as dev dependency 2025-01-19 14:59:23 -07:00
Daz DeBoerandGitHub 0bdd871935 Pin version in ci-combine-bot-prs.yml 2024-12-17 18:26:12 -07:00
daz 34d6b69184 Use latest DV plugin version in docs 2024-12-17 18:13:21 -07:00
Daz DeBoerandGitHub 21ecf4fc5b Use latest dependency-graph plugin (#489) 2024-12-17 18:10:51 -07:00
Daz DeBoerandGitHub 5c7e362ae3 Remove deprecation warning from init-script (#491) 2024-12-17 17:59:42 -07:00
Daz DeBoerandGitHub 59d7e81070 Attempt to limit failures in wrapper-validation tests (#490) 
- Reduce requests involved in checksums.retryTest
- Reduce requests involved in validate test
- Fetch checksum values in batches
 2024-12-17 17:58:41 -07:00
daz e0281833fa Fix unit test to deal with new Gradle releases 2024-12-13 08:56:11 -07:00
Daz DeBoerandGitHub b8d9a58677 Document wrapper-validation with Git LFS 2024-12-12 12:04:12 -07:00
Daz DeBoerandGitHub f25f0d469f Dependency updates (#480) 2024-12-11 12:32:44 -07:00