ci: add HTTP build cache + merge_group trigger (#12)

* ci: add remote HTTP Gradle build cache

Add a shared HTTP build cache (gradle/build-cache.settings.gradle),
applied from settings.gradle.kts and configured from the GRADLE_CACHE_URL
/ GRADLE_CACHE_USERNAME / GRADLE_CACHE_PASSWORD env vars (CI secrets). Push
is enabled only when credentials are present, so fork PRs (no secrets) are
pull-only and cannot poison the cache. ci.yml now passes those secrets.

Part of the Meshtastic KMP library standard alignment (shared build cache,
matching meshtastic-sdk).

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* ci: add merge_group trigger to enable the merge queue

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

* ci: harden shared build cache (TLS-only, trusted-event pushes)

Addresses CodeRabbit review of the shared build-cache script:
- Drop allowInsecureProtocol/allowUntrustedServer — the cache server presents
  a valid public TLS cert, so enforce HTTPS + certificate validation.
- Write to the cache only on trusted events (push/merge_group/local) with
  credentials present, so pull_request runs stay pull-only and cannot poison
  the cache.

Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.8 <noreply@anthropic.com>

Author: jamesarich

.github/workflows/ci.yml

@@ -5,6 +5,12 @@ on:
     branches: [main]
   pull_request:
     branches: [main]
+  merge_group:
+
+env:
+  GRADLE_CACHE_URL: ${{ secrets.GRADLE_CACHE_URL }}
+  GRADLE_CACHE_USERNAME: ${{ secrets.GRADLE_CACHE_USERNAME }}
+  GRADLE_CACHE_PASSWORD: ${{ secrets.GRADLE_CACHE_PASSWORD }}
 
 jobs:
   test:

gradle/build-cache.settings.gradle

@@ -0,0 +1,62 @@
+/*
+ * Shared remote HTTP Gradle build cache for Meshtastic KMP libraries.
+ *
+ * Credentials come from the GRADLE_CACHE_URL / GRADLE_CACHE_USERNAME /
+ * GRADLE_CACHE_PASSWORD environment variables (CI secrets), or a
+ * local.properties / config.properties entry for local use. Writes to the
+ * cache happen only from trusted events (local dev, push, merge_group) with
+ * credentials present, so pull-request runs (and credential-less fork PRs)
+ * stay pull-only and cannot poison the cache.
+ */
+
+def getMeshProperty(String key) {
+    def env = System.getenv(key)
+    if (env) return env
+    def currentDir = settingsDir
+    while (currentDir != null) {
+        for (name in ["local.properties", "config.properties"]) {
+            def f = new File(currentDir, name)
+            if (f.exists()) {
+                def props = new Properties()
+                f.withInputStream { props.load(it) }
+                if (props.containsKey(key)) return props.getProperty(key)
+            }
+        }
+        currentDir = currentDir.parentFile
+    }
+    return null
+}
+
+buildCache {
+    local {
+        enabled = true
+    }
+    remote(HttpBuildCache) {
+        // Some cache servers return 403 on "Expect: 100-continue".
+        useExpectContinue = false
+        def cacheUrl = getMeshProperty("GRADLE_CACHE_URL")?.trim()
+        def cacheUsername = getMeshProperty("GRADLE_CACHE_USERNAME")?.trim()
+        def cachePassword = getMeshProperty("GRADLE_CACHE_PASSWORD")?.trim()
+        if (cacheUrl) {
+            // HTTPS + valid TLS enforced (no allowInsecureProtocol / no
+            // allowUntrustedServer): the cache server must present a trusted
+            // certificate over TLS.
+            url = cacheUrl.endsWith("/") ? cacheUrl : "${cacheUrl}/"
+            if (cacheUsername && cachePassword) {
+                credentials {
+                    username = cacheUsername
+                    password = cachePassword
+                }
+            }
+            // Write only from trusted events (local dev, push to a protected
+            // branch, or the merge queue) with credentials — never from
+            // pull_request runs, so unmerged code can't poison the cache.
+            def eventName = System.getenv("GITHUB_EVENT_NAME")
+            def trustedForPush = eventName == null || eventName == "push" || eventName == "merge_group"
+            push = (cacheUsername && cachePassword && trustedForPush)
+            enabled = true
+        } else {
+            enabled = false
+        }
+    }
+}

settings.gradle.kts

@@ -15,5 +15,7 @@ plugins {
     id("org.gradle.toolchains.foojay-resolver-convention") version "1.0.0"
 }
 
+apply(from = "gradle/build-cache.settings.gradle")
+
 rootProject.name = "gradle-flatpak-sources"
 include(":plugin")