ci: onboard to OSS Community Develocity

Replaces the self-hosted HttpBuildCache with Develocity's remote cache at
community.develocity.cloud under project `meshtastic`, matching the
Meshtastic-Android onboarding (meshtastic/Meshtastic-Android#6531).

- `gradle/develocity.settings.gradle` replaces `gradle/build-cache.settings.gradle`,
  applied from BOTH settings files: the build-logic included build does not
  inherit the root's configuration, and without its own it silently drops to
  local-cache-only and publishes no scan.
- `.github/actions/gradle-setup` gains an optional `develocity_access_key`
  input, passed at all 12 call sites; the GRADLE_CACHE_* env blocks are gone.
- Scans publish only from authenticated builds, so fork PRs and developers
  without a provisioned key are unaffected; only authenticated CI runs write
  to the cache.

The GRADLE_CACHE_* secrets are no longer read but are deliberately left in
place as the rollback path.

Author: jamesarich

.github/actions/gradle-setup/action.yml

@@ -4,6 +4,9 @@ inputs:
   cache_read_only:
     description: 'Whether Gradle cache is read-only'
     default: 'true'
+  develocity_access_key:
+    description: 'Access key for the OSS Community Develocity Instance (Build Scan publishing and remote cache writes)'
+    required: false
 runs:
   using: composite
   steps:
@@ -30,3 +33,4 @@ runs:
         cache-read-only: ${{ inputs.cache_read_only }}
         cache-cleanup: on-success
         add-job-summary: always
+        develocity-access-key: ${{ inputs.develocity_access_key }}

.github/workflows/ci.yml

@@ -14,11 +14,6 @@ concurrency:
 permissions:
   contents: read
 
-env:
-  GRADLE_CACHE_URL: ${{ secrets.GRADLE_CACHE_URL }}
-  GRADLE_CACHE_USERNAME: ${{ secrets.GRADLE_CACHE_USERNAME }}
-  GRADLE_CACHE_PASSWORD: ${{ secrets.GRADLE_CACHE_PASSWORD }}
-
 jobs:
   lint:
     name: Lint
@@ -32,6 +27,7 @@ jobs:
       - uses: ./.github/actions/gradle-setup
         with:
           cache_read_only: ${{ github.event_name == 'pull_request' }}
+          develocity_access_key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - name: Run spotlessCheck and detektAll
         run: ./gradlew spotlessCheck detektAll --stacktrace
@@ -48,6 +44,7 @@ jobs:
       - uses: ./.github/actions/gradle-setup
         with:
           cache_read_only: ${{ github.event_name == 'pull_request' }}
+          develocity_access_key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - name: Run JVM tests and verify coverage
         run: ./gradlew jvmTest koverVerify --stacktrace
@@ -77,6 +74,7 @@ jobs:
       - uses: ./.github/actions/gradle-setup
         with:
           cache_read_only: ${{ github.event_name == 'pull_request' }}
+          develocity_access_key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - name: Run Linux native tests
         run: ./gradlew linuxX64Test --stacktrace
@@ -93,6 +91,7 @@ jobs:
       - uses: ./.github/actions/gradle-setup
         with:
           cache_read_only: ${{ github.event_name == 'pull_request' }}
+          develocity_access_key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - name: Run macOS and iOS simulator tests
         run: ./gradlew macosArm64Test iosSimulatorArm64Test --stacktrace
@@ -109,6 +108,7 @@ jobs:
       - uses: ./.github/actions/gradle-setup
         with:
           cache_read_only: ${{ github.event_name == 'pull_request' }}
+          develocity_access_key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - name: Run wasmJs browser tests
         run: ./gradlew wasmJsBrowserTest --stacktrace
@@ -125,6 +125,7 @@ jobs:
       - uses: ./.github/actions/gradle-setup
         with:
           cache_read_only: ${{ github.event_name == 'pull_request' }}
+          develocity_access_key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - name: Run Windows native tests
         shell: bash
@@ -142,6 +143,7 @@ jobs:
       - uses: ./.github/actions/gradle-setup
         with:
           cache_read_only: ${{ github.event_name == 'pull_request' }}
+          develocity_access_key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       # apiCheck now validates the klib/native ABI too, so it compiles native
       # klibs and needs the Kotlin/Native toolchain. Cache ~/.konan to avoid
@@ -170,6 +172,7 @@ jobs:
       - uses: ./.github/actions/gradle-setup
         with:
           cache_read_only: ${{ github.event_name == 'pull_request' }}
+          develocity_access_key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - name: Build
         run: ./gradlew build --stacktrace
@@ -188,6 +191,7 @@ jobs:
       - uses: ./.github/actions/gradle-setup
         with:
           cache_read_only: 'false'
+          develocity_access_key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - name: Compute snapshot version
         id: version

.github/workflows/docs.yml

@@ -14,11 +14,6 @@ concurrency:
   group: "pages"
   cancel-in-progress: false
 
-env:
-  GRADLE_CACHE_URL: ${{ secrets.GRADLE_CACHE_URL }}
-  GRADLE_CACHE_USERNAME: ${{ secrets.GRADLE_CACHE_USERNAME }}
-  GRADLE_CACHE_PASSWORD: ${{ secrets.GRADLE_CACHE_PASSWORD }}
-
 jobs:
   build-docs:
     name: Build Documentation
@@ -29,6 +24,7 @@ jobs:
       - uses: ./.github/actions/gradle-setup
         with:
           cache_read_only: 'false'
+          develocity_access_key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - name: Generate API documentation
         run: ./gradlew dokkaGeneratePublicationHtml --stacktrace

.github/workflows/release.yml

@@ -30,11 +30,6 @@ concurrency:
   group: ${{ github.workflow }}-${{ inputs.version && format('v{0}', inputs.version) || github.ref_name }}
   cancel-in-progress: false
 
-env:
-  GRADLE_CACHE_URL: ${{ secrets.GRADLE_CACHE_URL }}
-  GRADLE_CACHE_USERNAME: ${{ secrets.GRADLE_CACHE_USERNAME }}
-  GRADLE_CACHE_PASSWORD: ${{ secrets.GRADLE_CACHE_PASSWORD }}
-
 permissions:
   contents: write
   id-token: write
@@ -73,6 +68,7 @@ jobs:
       - uses: ./.github/actions/gradle-setup
         with:
           cache_read_only: 'false'
+          develocity_access_key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - name: Validate before publish
         run: ./gradlew spotlessCheck detektAll jvmTest apiCheck --stacktrace
@@ -188,6 +184,7 @@ jobs:
       - uses: ./.github/actions/gradle-setup
         with:
           cache_read_only: 'false'
+          develocity_access_key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - name: Build sample artifacts
         shell: bash

README.md

@@ -8,6 +8,7 @@
 [![CI](https://github.com/meshtastic/MQTTastic-Client-KMP/actions/workflows/ci.yml/badge.svg)](https://github.com/meshtastic/MQTTastic-Client-KMP/actions/workflows/ci.yml)
 [![codecov](https://codecov.io/gh/meshtastic/MQTTastic-Client-KMP/graph/badge.svg)](https://codecov.io/gh/meshtastic/MQTTastic-Client-KMP)
 [![API Docs](https://img.shields.io/badge/API%20Docs-latest-blue.svg)](https://meshtastic.github.io/MQTTastic-Client-KMP)
+[![Revved up by Develocity](https://img.shields.io/badge/Revved%20up%20by-Develocity-06A0CE?logo=Gradle&labelColor=02303A)](https://community.develocity.cloud/scans?search.rootProjectNames=MQTTastic-Client-KMP)
 
 A fully-featured **MQTT 5.0 and 3.1.1** client library for **Kotlin Multiplatform** — connecting JVM, Android, iOS, macOS, Linux, Windows, and browsers through a single, idiomatic Kotlin API.
 

build-logic/settings.gradle.kts

@@ -19,6 +19,15 @@
 // Standalone settings for the included build. Re-uses the same version catalog
 // as the main build so plugin versions stay in lockstep.
 
+plugins {
+    id("com.gradle.develocity") version "4.5.0"
+    id("com.gradle.common-custom-user-data-gradle-plugin") version "2.8.0"
+}
+
+// Included builds do not inherit the root's settings configuration; without its
+// own, this build silently drops to local-cache-only and publishes no scan.
+apply(from = "../gradle/develocity.settings.gradle")
+
 dependencyResolutionManagement {
     repositories {
         gradlePluginPortal()

gradle/build-cache.settings.gradle

@@ -0,0 +1,74 @@
+/*
+ * Copyright (c) 2026 Meshtastic LLC
+ *
+ * This program is free software: you can redistribute it and/or modify
+ * it under the terms of the GNU General Public License as published by
+ * the Free Software Foundation, either version 3 of the License, or
+ * (at your option) any later version.
+ *
+ * This program is distributed in the hope that it will be useful,
+ * but WITHOUT ANY WARRANTY; without even the implied warranty of
+ * MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
+ * GNU General Public License for more details.
+ *
+ * You should have received a copy of the GNU General Public License
+ * along with this program.  If not, see <https://www.gnu.org/licenses/>.
+ */
+
+/*
+ * Develocity — Build Scans and remote Build Cache on the OSS Community instance
+ * (https://community.develocity.cloud), project `meshtastic`.
+ *
+ * Applied from BOTH settings files: the build-logic included build does not
+ * inherit the root's configuration, and without its own it silently drops to
+ * local-cache-only.
+ *
+ * Replaces the former self-hosted HttpBuildCache: GRADLE_CACHE_URL / _USERNAME /
+ * _PASSWORD are no longer read anywhere in this repo.
+ */
+
+def isCI = System.getenv("CI") != null
+
+develocity {
+    server = "https://community.develocity.cloud"
+    projectId = "meshtastic"
+    buildScan {
+        uploadInBackground = !isCI
+        // Unauthenticated builds (fork PRs, developers who never provisioned a key)
+        // publish nothing rather than failing.
+        publishing.onlyIf { it.authenticated }
+        // Fingerprints power cache-miss comparison (CI debugging); skip the payload locally.
+        capture { fileFingerprints = isCI }
+        // Public instance: no machine identity. Constants on purpose — scans already
+        // record OS/CPU and CCUD adds CI metadata. Keep the `if` OUTSIDE the closures:
+        // capture-free closures are what the configuration cache can serialize.
+        obfuscation {
+            ipAddresses { addresses -> addresses.collect { "0.0.0.0" } }
+            externalProcessName { "external-process" }
+            if (isCI) {
+                username { "ci" }
+                hostname { "ci-runner" }
+            } else {
+                username { "local-dev" }
+                hostname { "local-machine" }
+            }
+        }
+    }
+}
+
+// Resolved outside the buildCache block: inside it the closure delegate is
+// BuildCacheConfiguration, which has no `develocity` property.
+def develocityBuildCache = develocity.buildCache
+def accessKey = System.getenv("DEVELOCITY_ACCESS_KEY")?.trim()
+
+buildCache {
+    // Off on CI: runners are ephemeral and every hit comes from the remote anyway.
+    local {
+        enabled = !isCI
+    }
+    remote(develocityBuildCache) {
+        enabled = true
+        // Only authenticated CI writes, so unmerged and fork code cannot poison the cache.
+        push = isCI && accessKey != null && !accessKey.isEmpty()
+    }
+}

gradle/develocity.settings.gradle

@@ -9,10 +9,12 @@ pluginManagement {
 
 plugins {
     id("org.gradle.toolchains.foojay-resolver-convention") version "1.0.0"
+    id("com.gradle.develocity") version "4.5.0"
+    id("com.gradle.common-custom-user-data-gradle-plugin") version "2.8.0"
 }
 
-// Build Cache configuration (HTTP remote cache + local)
-apply(from = "gradle/build-cache.settings.gradle")
+// Build Scans + remote Build Cache (Develocity OSS Community instance)
+apply(from = "gradle/develocity.settings.gradle")
 
 dependencyResolutionManagement {
     repositories {