|
| 1 | +/* |
| 2 | + * Develocity — Build Scans and remote Build Cache on the OSS Community instance |
| 3 | + * (https://community.develocity.cloud), project `meshtastic`. |
| 4 | + * |
| 5 | + * Replaces the former self-hosted HttpBuildCache: GRADLE_CACHE_URL / _USERNAME / |
| 6 | + * _PASSWORD are no longer read anywhere in this repo. |
| 7 | + */ |
| 8 | + |
| 9 | +def isCI = System.getenv("CI") != null |
| 10 | + |
| 11 | +develocity { |
| 12 | + server = "https://community.develocity.cloud" |
| 13 | + projectId = "meshtastic" |
| 14 | + buildScan { |
| 15 | + uploadInBackground = !isCI |
| 16 | + // Unauthenticated builds (fork PRs, developers who never provisioned a key) |
| 17 | + // publish nothing rather than failing. |
| 18 | + publishing.onlyIf { it.authenticated } |
| 19 | + // Fingerprints power cache-miss comparison (CI debugging); skip the payload locally. |
| 20 | + capture { fileFingerprints = isCI } |
| 21 | + // Public instance: no machine identity. Constants on purpose — scans already |
| 22 | + // record OS/CPU and CCUD adds CI metadata. Keep the `if` OUTSIDE the closures: |
| 23 | + // capture-free closures are what the configuration cache can serialize. |
| 24 | + obfuscation { |
| 25 | + ipAddresses { addresses -> addresses.collect { "0.0.0.0" } } |
| 26 | + externalProcessName { "external-process" } |
| 27 | + if (isCI) { |
| 28 | + username { "ci" } |
| 29 | + hostname { "ci-runner" } |
| 30 | + } else { |
| 31 | + username { "local-dev" } |
| 32 | + hostname { "local-machine" } |
| 33 | + } |
| 34 | + } |
| 35 | + } |
| 36 | +} |
| 37 | + |
| 38 | +// Resolved outside the buildCache block: inside it the closure delegate is |
| 39 | +// BuildCacheConfiguration, which has no `develocity` property. |
| 40 | +def develocityBuildCache = develocity.buildCache |
| 41 | +def accessKey = System.getenv("DEVELOCITY_ACCESS_KEY")?.trim() |
| 42 | + |
| 43 | +buildCache { |
| 44 | + // Off on CI: runners are ephemeral and every hit comes from the remote anyway. |
| 45 | + local { |
| 46 | + enabled = !isCI |
| 47 | + } |
| 48 | + remote(develocityBuildCache) { |
| 49 | + enabled = true |
| 50 | + // Write only from trusted events. Local dev is excluded by isCI, and |
| 51 | + // pull_request runs are excluded here: a same-repository PR DOES receive |
| 52 | + // repository secrets, so gating on the access key alone would let |
| 53 | + // unmerged code write entries into the shared cache. Fork PRs have no |
| 54 | + // key and are excluded twice over. |
| 55 | + def eventName = System.getenv("GITHUB_EVENT_NAME") |
| 56 | + def trustedForPush = eventName == "push" || eventName == "merge_group" |
| 57 | + push = isCI && trustedForPush && accessKey != null && !accessKey.isEmpty() |
| 58 | + } |
| 59 | +} |
0 commit comments