ci: add remote HTTP build cache and Konan toolchain caching

- Add gradle/build-cache.settings.gradle (shared remote HTTP build cache),
  applied from settings.gradle.kts and configured from the GRADLE_CACHE_URL
  / GRADLE_CACHE_USERNAME / GRADLE_CACHE_PASSWORD secrets. Push is enabled
  only when credentials are present, so fork PRs are pull-only.
- Cache ~/.konan (the Kotlin/Native toolchain) in CI, keyed on
  libs.versions.toml + the Gradle wrapper. The macOS build compiles nine
  native targets from a cold Konan on every run today; caching it avoids
  re-downloading the toolchain each time.

Part of the Meshtastic KMP library standard alignment (CI caching).

Signed-off-by: James Rich <2199651+jamesarich@users.noreply.github.com>

Author: jamesarich

.github/workflows/ci.yml

@@ -14,6 +14,11 @@ concurrency:
 permissions:
   contents: read
 
+env:
+  GRADLE_CACHE_URL: ${{ secrets.GRADLE_CACHE_URL }}
+  GRADLE_CACHE_USERNAME: ${{ secrets.GRADLE_CACHE_USERNAME }}
+  GRADLE_CACHE_PASSWORD: ${{ secrets.GRADLE_CACHE_PASSWORD }}
+
 jobs:
   build:
     name: Build, test & API check (all KMP targets)
@@ -34,6 +39,14 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v6
 
+      - name: Cache Konan (Kotlin/Native toolchain)
+        uses: actions/cache@v6
+        with:
+          path: ~/.konan
+          key: konan-${{ runner.os }}-${{ hashFiles('gradle/libs.versions.toml', 'gradle/wrapper/gradle-wrapper.properties') }}
+          restore-keys: |
+            konan-${{ runner.os }}-
+
       # `build` compiles all 13 targets, runs the common/jvm/js/wasm/macOS/iOS-sim
       # tests, and runs `apiCheck` (binary-compatibility-validator). Linux/Windows
       # native test binaries are cross-compiled but not executed on a macOS host.

gradle/build-cache.settings.gradle

@@ -0,0 +1,56 @@
+/*
+ * Shared remote HTTP Gradle build cache for Meshtastic KMP libraries.
+ *
+ * Credentials come from the GRADLE_CACHE_URL / GRADLE_CACHE_USERNAME /
+ * GRADLE_CACHE_PASSWORD environment variables (CI secrets), or a
+ * local.properties / config.properties entry for local use. Push is enabled
+ * only when credentials are present, so fork PRs (which have no secrets) are
+ * pull-only and cannot poison the cache.
+ */
+
+def getMeshProperty(String key) {
+    def env = System.getenv(key)
+    if (env) return env
+    def currentDir = settingsDir
+    while (currentDir != null) {
+        for (name in ["local.properties", "config.properties"]) {
+            def f = new File(currentDir, name)
+            if (f.exists()) {
+                def props = new Properties()
+                f.withInputStream { props.load(it) }
+                if (props.containsKey(key)) return props.getProperty(key)
+            }
+        }
+        currentDir = currentDir.parentFile
+    }
+    return null
+}
+
+buildCache {
+    local {
+        enabled = true
+    }
+    remote(HttpBuildCache) {
+        // Some cache servers return 403 on "Expect: 100-continue".
+        useExpectContinue = false
+        def cacheUrl = getMeshProperty("GRADLE_CACHE_URL")?.trim()
+        def cacheUsername = getMeshProperty("GRADLE_CACHE_USERNAME")?.trim()
+        def cachePassword = getMeshProperty("GRADLE_CACHE_PASSWORD")?.trim()
+        if (cacheUrl) {
+            url = cacheUrl.endsWith("/") ? cacheUrl : "${cacheUrl}/"
+            if (cacheUsername && cachePassword) {
+                credentials {
+                    username = cacheUsername
+                    password = cachePassword
+                }
+            }
+            allowInsecureProtocol = true
+            allowUntrustedServer = true
+            // Push only when credentials exist -> fork PRs are pull-only.
+            push = (cacheUsername && cachePassword)
+            enabled = true
+        } else {
+            enabled = false
+        }
+    }
+}

settings.gradle.kts

@@ -6,4 +6,6 @@ pluginManagement {
     }
 }
 
+apply(from = "gradle/build-cache.settings.gradle")
+
 rootProject.name = "kzstd"