ci: add HTTP build cache + merge_group trigger - #12
Conversation
Add a shared HTTP build cache (gradle/build-cache.settings.gradle), applied from settings.gradle.kts and configured from the GRADLE_CACHE_URL / GRADLE_CACHE_USERNAME / GRADLE_CACHE_PASSWORD env vars (CI secrets). Push is enabled only when credentials are present, so fork PRs (no secrets) are pull-only and cannot poison the cache. ci.yml now passes those secrets. Part of the Meshtastic KMP library standard alignment (shared build cache, matching meshtastic-sdk). Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
|
Warning Review limit reached
Next review available in: 25 minutes Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available. How can I continue?After more reviews become available, a review can be triggered using the To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews. How do review limits work?CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability. For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window. Please refer docs for additional details. Review details⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Plus Run ID: 📒 Files selected for processing (1)
📝 WalkthroughWalkthroughThe project adds configurable local and remote Gradle build caching, applies the configuration from the root settings script, and supplies cache credentials through CI workflow environment variables. The workflow also supports ChangesGradle build cache
Estimated code review effort: 2 (Simple) | ~10 minutes Poem
🚥 Pre-merge checks | ✅ 5✅ Passed checks (5 passed)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
jamesarich
changed the title
![coderabbitai[bot]](https://avatars.githubusercontent.com/in/347564?s=60&v=4){kind=small}
There was a problem hiding this comment.
Actionable comments posted: 4
🤖 Prompt for all review comments with AI agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
Inline comments:
In @.github/workflows/ci.yml:
- Around line 10-13: Move GRADLE_CACHE_URL, GRADLE_CACHE_USERNAME, and
GRADLE_CACHE_PASSWORD from the workflow-level env into the env block of the
“Build & Test” step, ensuring these credentials are unavailable to checkout,
setup, artifact upload, and other steps.
- Line 11: The CI workflow currently sources GRADLE_CACHE_URL from secrets,
preventing fork pull requests from using the remote cache. Update
GRADLE_CACHE_URL in .github/workflows/ci.yml at lines 11-11 to use the
repository variable while keeping cache credentials in secrets;
gradle/build-cache.settings.gradle at lines 39-54 requires no direct change
because it will receive the URL through the corrected workflow configuration.
In `@gradle/build-cache.settings.gradle`:
- Around line 47-48: Remove the unconditional allowInsecureProtocol and
allowUntrustedServer settings from the shared build-cache configuration,
preserving HTTPS/TLS-only behavior by default. If insecure access is required
for local development, gate both settings behind an explicit local-only opt-in
rather than enabling them for shared or CI builds.
- Around line 41-50: Update the cache push condition near the existing
credentials block so credentials alone do not enable writes. Require both
available credentials and a trusted workflow event, allowing pushes only for
push or merge_group executions while keeping pull-only behavior for pull request
runs.
🪄 Autofix (Beta)
Fix all unresolved CodeRabbit comments on this PR:
- Push a commit to this branch (recommended)
- Create a new PR with the fixes
ℹ️ Review info
⚙️ Run configuration
Configuration used: Organization UI
Review profile: CHILL
Plan: Pro Plus
Run ID: 7f5daf7f-076c-4262-b8f3-62a0df044884
📒 Files selected for processing (3)
.github/workflows/ci.ymlgradle/build-cache.settings.gradlesettings.gradle.kts
| env: | ||
| GRADLE_CACHE_URL: ${{ secrets.GRADLE_CACHE_URL }} | ||
| GRADLE_CACHE_USERNAME: ${{ secrets.GRADLE_CACHE_USERNAME }} | ||
| GRADLE_CACHE_PASSWORD: ${{ secrets.GRADLE_CACHE_PASSWORD }} |
There was a problem hiding this comment.
🔒 Security & Privacy | 🟠 Major | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
#!/bin/bash
set -euo pipefail
# Show the workflow with line numbers
cat -n .github/workflows/ci.yml | sed -n '1,220p'Repository: meshtastic/gradle-flatpak-sources
Length of output: 1457
Scope the cache credentials to the Build & Test step only. Workflow-level env makes them available to checkout, setup, artifact upload, and every later step in the job.
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml around lines 10 - 13, Move GRADLE_CACHE_URL,
GRADLE_CACHE_USERNAME, and GRADLE_CACHE_PASSWORD from the workflow-level env
into the env block of the “Build & Test” step, ensuring these credentials are
unavailable to checkout, setup, artifact upload, and other steps.
| merge_group: | ||
|
|
||
| env: | ||
| GRADLE_CACHE_URL: ${{ secrets.GRADLE_CACHE_URL }} |
There was a problem hiding this comment.
🗄️ Data Integrity & Integration | 🟡 Minor | ⚡ Quick win
🧩 Analysis chain
🏁 Script executed:
set -euo pipefail
printf '\n== ci.yml ==\n'
cat -n .github/workflows/ci.yml | sed -n '1,220p'
printf '\n== build-cache.settings.gradle ==\n'
cat -n gradle/build-cache.settings.gradle | sed -n '1,220p'Repository: meshtastic/gradle-flatpak-sources
Length of output: 3878
🏁 Script executed:
set -euo pipefail
cat -n .github/workflows/ci.yml | sed -n '1,220p'
printf '\n---\n'
cat -n gradle/build-cache.settings.gradle | sed -n '1,220p'Repository: meshtastic/gradle-flatpak-sources
Length of output: 3834
Source GRADLE_CACHE_URL from a repository variable .github/workflows/ci.yml currently reads it from secrets, so fork PRs get no URL and gradle/build-cache.settings.gradle disables the remote cache entirely. Keep the credentials in secrets and the URL in a non-secret variable so forks remain pull-only.
📍 Affects 2 files
.github/workflows/ci.yml#L11-L11(this comment)gradle/build-cache.settings.gradle#L39-L54
🤖 Prompt for AI Agents
Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.
In @.github/workflows/ci.yml at line 11, The CI workflow currently sources
GRADLE_CACHE_URL from secrets, preventing fork pull requests from using the
remote cache. Update GRADLE_CACHE_URL in .github/workflows/ci.yml at lines 11-11
to use the repository variable while keeping cache credentials in secrets;
gradle/build-cache.settings.gradle at lines 39-54 requires no direct change
because it will receive the URL through the corrected workflow configuration.
Addresses CodeRabbit review of the shared build-cache script: - Drop allowInsecureProtocol/allowUntrustedServer — the cache server presents a valid public TLS cert, so enforce HTTPS + certificate validation. - Write to the cache only on trusted events (push/merge_group/local) with credentials present, so pull_request runs stay pull-only and cannot poison the cache. Co-Authored-By: Claude Opus 4.8 <noreply@anthropic.com>
1 participant
Summary
Adds the shared remote HTTP Gradle build cache (the same mechanism
meshtastic-sdkuses), so CI reuses task outputs across runs.What changed
gradle/build-cache.settings.gradle(new): configures aremote(HttpBuildCache)fromGRADLE_CACHE_URL/GRADLE_CACHE_USERNAME/GRADLE_CACHE_PASSWORD(env/CI secrets, orlocal.propertiesfor local use). Push is enabled only when credentials are present, so fork PRs (which have no secrets) are pull-only and can't poison the cache.settings.gradle.kts:apply(from = "gradle/build-cache.settings.gradle")..github/workflows/ci.yml: passes the threeGRADLE_CACHE_*secrets as workflow env.Required repo secrets (please add)
GRADLE_CACHE_URL,GRADLE_CACHE_USERNAME(meshtastic),GRADLE_CACHE_PASSWORD. Absent them, the remote cache simply disables itself (local cache still works) — CI is never broken.Notes
actionlintclean. Nothing hardcoded — all three values come from secrets. Config-cache stays off here (the plugin under test is config-cache-incompatible); the build cache is independent of that.🤖 Generated with Claude Code
Summary by CodeRabbit