Use DEVELOCITY_ACCESS_KEY instead of the legacy GRADLE_ENTERPRISE_ACCESS_KEY

[blindpirate]

Origin

Incident 5531 / CVE-2026-65400 credential cleanup — tracker row 134, env.GRADLE_ENTERPRISE_ACCESS_KEY.

GRADLE_ENTERPRISE_ACCESS_KEY is the legacy name for DEVELOCITY_ACCESS_KEY. Across builds.gradle.org it is defined at 214 sites; 33,513 of the 33,728 build configurations that resolve it also resolve DEVELOCITY_ACCESS_KEY, so the legacy name can simply be deleted almost everywhere. Buildship is the exception: it is the only non-archived project where GRADLE_ENTERPRISE_ACCESS_KEY is the sole build-scan credential, covering 146 configurations (136 under Promotions, 10 under Checkpoints). Deleting it here without a replacement would silently stop scan authentication, so this repo needs a rename rather than a removal.

Changes

1. Rename the three legacy definitions (Project.kt 209, 335, 430 — PromotionBuildType, SinglePromotionBuildType, and the root Project object):

- param("env.GRADLE_ENTERPRISE_ACCESS_KEY", "%ge.gradle.org.access.key%")
+ param("env.DEVELOCITY_ACCESS_KEY", "%ge.gradle.org.access.key%")

The value needs no change. ge.gradle.org.access.key is defined on _Root and its TeamCity label is ge.gradle.org=ae4p*, i.e. the value already carries the server-host= prefix that DEVELOCITY_ACCESS_KEY requires. (Contrast the sibling ge.gradle.org.access.key.without.domain, whose label is ae4p*.) This matters because a malformed value fails the build outright with Failed to parse DEVELOCITY_ACCESS_KEY environment variable: value is malformed, which is what Enterprise_Main_Component_BuildScansMisc hit earlier in this same rotation.

2. Drop two dangling definitions (Project.kt 140, 273 — IndividualScenarioBuildType and TagBuildType):

- param("env.DEVELOCITY_ACCESS_KEY", "%develocity-staging.eclipse.org.access.key%")

develocity-staging.eclipse.org.access.key was deleted from TeamCity on 2026-08-19 (tracker row 107, after @donat confirmed "develocity-staging is no longer operational… Buildship does not use it"). The references were never cleaned up, so those configurations currently carry an unresolvable DEVELOCITY_ACCESS_KEY, e.g.

Tooling_Buildship_Individual_Buildship_basic_coverage_Test_Coverage_linux_Eclipse4_34_OnJava17
  env.DEVELOCITY_ACCESS_KEY        = %develocity-staging.eclipse.org.access.key%   <- dangling
  env.GRADLE_ENTERPRISE_ACCESS_KEY = %ge.gradle.org.access.key%                    <- working

They are only still publishing scans because the working legacy variable is masking the broken one. Removing these two lines lets them inherit the project-level DEVELOCITY_ACCESS_KEY from change 1 — and without it, change 1 alone would be a regression, because the build-configuration-level dangling value would override the good project-level one.

Risk

Settings-only; no product code. This project sets teamcity.ui.settings.readOnly = true, so this branch is the only way to make the change. After merge, Tooling_Buildship and all 146 affected configurations should resolve env.DEVELOCITY_ACCESS_KEY to %ge.gradle.org.access.key% and env.GRADLE_ENTERPRISE_ACCESS_KEY should be gone from the subtree.