ci: onboard to the OSS Community Develocity instance

[jamesarich]

Publishes Build Scans® and moves the remote build cache to the OSS Community
Develocity instance at https://community.develocity.cloud under project ID
meshtastic, matching the Meshtastic-Android onboarding
(meshtastic/Meshtastic-Android#6531) and the kzstd / gradle-flatpak-sources
rollout (meshtastic/kzstd#36, meshtastic/gradle-flatpak-sources#28).

What changed

• gradle/develocity.settings.gradle replaces gradle/build-cache.settings.gradle.
  The cache now comes from Develocity, so scan and cache configuration are one
  concern in one file.
• It is applied from both settings.gradle.kts and
  build-logic/settings.gradle.kts. An included build does not inherit the
  root's settings configuration — without its own it silently drops to
  local-cache-only and publishes no scan. (build-logic previously had no
  cache configuration at all.)
• The self-hosted HttpBuildCache is replaced by remote(develocity.buildCache).
• .github/actions/gradle-setup gains an optional develocity_access_key
  input forwarded to setup-gradle; all 12 call sites across ci.yml (9),
  release.yml (2) and docs.yml (1) pass secrets.DEVELOCITY_ACCESS_KEY.
  The GRADLE_CACHE_URL / GRADLE_CACHE_USERNAME / GRADLE_CACHE_PASSWORD
  env blocks are removed from all three workflows.
• A "Revved up by Develocity" badge in the README.

Behaviour

• Scans publish only from authenticated builds (publishing.onlyIf { it.authenticated }).
  Fork PRs and developers without a provisioned key publish nothing rather than
  failing.
• Only authenticated CI runs write to the cache, so unmerged and fork code
  cannot poison it. CI disables the local cache — runners are ephemeral and
  every hit comes from the remote anyway.
• Scans carry no machine identity: usernames, hostnames, IP addresses and
  external process names are obfuscated to constants.

Verification

• Configuration cache is reused across runs.
• Scans publish under project meshtastic for both the root build
  (MQTTastic-Client-KMP) and the included build (build-logic, verified with
  ./gradlew -p build-logic help).
• spotlessCheck detektAll apiCheck green; jvmTest, wasmJsTest and
  linuxX64Test each green.

On the kzstd pilot this configuration measured a 59% build-time avoidance
ratio on the second CI run, entirely from remote cache hits.

Unrelated pre-existing issue found while verifying

./gradlew allTests crashes the Gradle daemon with a JVM SIGSEGV inside G1's
write barrier (G1BarrierSet::AccessBarrier::oop_access_barrier) on JDK
21.0.12, with plenty of free memory. This reproduces on a clean main
checkout, so it is not caused by this PR. Individual test targets all pass;
only the aggregate task dies, which suggests the repo's -Xmx2048M against
many concurrent test JVMs. Worth a separate issue.

Note for reviewers

The GRADLE_CACHE_* repository secrets are now unused but deliberately not
deleted — they are the rollback path.

Summary by CodeRabbit

• Build Improvements
  • Improved build acceleration and authenticated build-scan support across local development and automated build, test, documentation, and release workflows.
  • Standardized build-scan and caching behavior for more consistent performance and reporting.
• Documentation
  • Added a project badge linking to build scan results in the README.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: da092119-8d07-4cde-9eb4-a679de858962

📥 Commits

Reviewing files that changed from the base of the PR and between 842896f and 6423e01.

📒 Files selected for processing (1)

• gradle/develocity.settings.gradle

🚧 Files skipped from review as they are similar to previous changes (1)

• gradle/develocity.settings.gradle

---

📝 Walkthrough

Walkthrough

The project replaces its previous Gradle cache setup with Develocity configuration. The reusable Gradle action and CI workflows now pass DEVELOCITY_ACCESS_KEY. The README includes a Develocity status badge.

Changes

Develocity build integration

Layer / File(s)	Summary
Gradle Develocity configuration settings.gradle.kts, gradle/develocity.settings.gradle, build-logic/settings.gradle.kts, README.md	Gradle settings apply shared Develocity configuration for scans, fingerprints, metadata obfuscation, and remote caching. The README adds a Develocity status badge.
CI access-key wiring .github/actions/gradle-setup/action.yml, .github/workflows/ci.yml, .github/workflows/docs.yml, .github/workflows/release.yml	The reusable action accepts develocity_access_key. CI, documentation, and release jobs pass DEVELOCITY_ACCESS_KEY to Gradle setup and remove workflow-wide cache credentials.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Poem

A rabbit checks the Gradle gate,

With Develocity keys in place.
Scans appear and caches flow,
Build logic keeps the settings close.
Hop, hop—the builds now know their place.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly describes the main change: onboarding the project to the OSS Community Develocity instance.
Description check	✅ Passed	The description clearly covers the purpose, changes, behavior, verification results, related issues, and the known pre-existing test failure.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@gradle/develocity.settings.gradle`:
- Around line 62-72: Update the remote build-cache push condition in buildCache
to require an explicit trusted-writer signal in addition to CI and a non-empty
accessKey, rather than treating all CI jobs as writers. Define and pass that
signal only from protected-branch and release workflow jobs, while pull-request
jobs remain read-only.

In `@settings.gradle.kts`:
- Around line 12-13: Move the Develocity and common custom user data plugin
versions into the root gradle/libs.versions.toml [versions] and [plugins]
sections, then update settings.gradle.kts and build-logic/settings.gradle.kts to
reference those catalog plugin aliases via version.ref instead of hardcoded
versions. Ensure build-logic continues reusing the root version catalog; apply
the same catalog-based change at settings.gradle.kts lines 12-13 and
build-logic/settings.gradle.kts lines 23-24.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 4d5f02dd-bebb-4d38-87ae-f714b6e9942a

📥 Commits

Reviewing files that changed from the base of the PR and between 951d81a and 842896f.

📒 Files selected for processing (9)

• .github/actions/gradle-setup/action.yml
• .github/workflows/ci.yml
• .github/workflows/docs.yml
• .github/workflows/release.yml
• README.md
• build-logic/settings.gradle.kts
• gradle/build-cache.settings.gradle
• gradle/develocity.settings.gradle
• settings.gradle.kts

💤 Files with no reviewable changes (1)

• gradle/build-cache.settings.gradle