Repository navigation
ci: use gradle/actions/setup-gradle for build caching - #51
Merged
Merged
Conversation
Switch all three workflows from setup-java's `cache: gradle` to gradle/actions/setup-gradle@v4, which caches the Gradle build cache (compiled task outputs) in addition to dependency downloads, and only writes the cache from main so PR branches don't thrash it. Enable the local build cache via org.gradle.caching=true.
Reviewer's guide (collapsed on small PRs)Reviewer's GuideSwitches CI Gradle caching from setup-java’s cache flag to the official gradle/actions/setup-gradle action and enables Gradle’s build cache globally via gradle.properties. File-Level Changes
Tips and commandsInteracting with Sourcery
Customizing Your ExperienceAccess your dashboard to:
Getting Help
|
![sourcery-ai[bot]](https://avatars.githubusercontent.com/in/48477?s=60&v=4){kind=small}
There was a problem hiding this comment.
Hey - I've found 1 issue, and left some high level feedback:
- Consider pinning
gradle/actions/setup-gradle@v4to a specific commit SHA rather than a moving tag to improve supply-chain security for your CI workflows. - It may be worth enabling
validate-wrappers: trueon thesetup-gradlesteps so that the Gradle wrapper is validated during CI runs, catching tampering or misconfiguration early.
Prompt for AI Agents
Please address the comments from this code review:
## Overall Comments
- Consider pinning `gradle/actions/setup-gradle@v4` to a specific commit SHA rather than a moving tag to improve supply-chain security for your CI workflows.
- It may be worth enabling `validate-wrappers: true` on the `setup-gradle` steps so that the Gradle wrapper is validated during CI runs, catching tampering or misconfiguration early.
## Individual Comments
### Comment 1
<location path=".github/workflows/check.yml" line_range="33-34" />
<code_context>
distribution: 'temurin'
- cache: gradle
+
+ - name: Set up Gradle
+ uses: gradle/actions/setup-gradle@v4
- name: Grant execute permission for gradlew
</code_context>
<issue_to_address>
**🚨 suggestion (security):** Consider pinning the setup-gradle action to a specific commit SHA for supply-chain safety.
Using `gradle/actions/setup-gradle@v4` means the workflow will automatically pick up any future v4 changes, which can alter behavior without notice. For CI, it’s safer to pin to a specific commit SHA (or at least a fixed minor/patch tag) and update it intentionally to reduce supply-chain risk and unexpected changes.
```suggestion
- name: Set up Gradle
# Pin to a specific version for supply-chain safety; update intentionally when needed
uses: gradle/actions/setup-gradle@v4.0.0
```
</issue_to_address>Help me be more useful! Please click 👍 or 👎 on each comment and I'll use the feedback to improve your reviews.
Comment on lines
+33
to
+34
| - name: Set up Gradle | ||
| uses: gradle/actions/setup-gradle@v4 |
There was a problem hiding this comment.
🚨 suggestion (security): Consider pinning the setup-gradle action to a specific commit SHA for supply-chain safety.
Using gradle/actions/setup-gradle@v4 means the workflow will automatically pick up any future v4 changes, which can alter behavior without notice. For CI, it’s safer to pin to a specific commit SHA (or at least a fixed minor/patch tag) and update it intentionally to reduce supply-chain risk and unexpected changes.
Suggested change
| - name: Set up Gradle | |
| uses: gradle/actions/setup-gradle@v4 | |
| - name: Set up Gradle | |
| # Pin to a specific version for supply-chain safety; update intentionally when needed | |
| uses: gradle/actions/setup-gradle@v4.0.0 |
The setup-java + setup-gradle + chmod trio was identical across all three workflows. Move it into .github/actions/gradle-setup so the JDK version and caching config live in one place and can't drift. Checkout stays per-workflow (local composite actions need the repo already checked out, and the release workflows require fetch-depth: 0).
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Switches all three workflows from
setup-java'scache: gradletogradle/actions/setup-gradle@v4, the Gradle-team-recommended approach.Why
main; PRs read it. Stops PR branches from thrashing the cache / blowing the 10 GB repo limit.Changes
gradle.properties:org.gradle.caching=true(configuration cache was already enabled).check.yml,dev-release.yml,release.yml: dropcache: gradlefromsetup-java, add asetup-gradlestep.Verification
./gradlew :app:testDebugUnitTestpasses locally with the build cache enabled. CI caching itself only demonstrates a hit once this is onmainand a second run follows.Summary by Sourcery
Enable Gradle build caching and adopt the recommended Gradle setup action in CI workflows.
Enhancements:
CI: