ci: restrict Develocity cache writes to trusted events

[jamesarich]

Follow-up to #36. This repo's main is currently letting pull-request builds
write to the shared Develocity build cache.

The gap

#36 gated cache writes on CI plus a non-empty access key:

push = isCI && accessKey != null && !accessKey.isEmpty()

A same-repository pull request does receive repository secrets, so
pull_request runs satisfy both conditions and push entries that main and the
merge queue then read. Unmerged code can serve build outputs to trusted builds.

The self-hosted HttpBuildCache that #36 replaced had this right:

def trustedForPush = eventName == null || eventName == "push" || eventName == "merge_group"
push = (cacheUsername && cachePassword && trustedForPush)

The gate was lost in the port to remote(develocity.buildCache). My fault — it
was caught in review on the sibling PRs, but #36 had already merged.

The fix

Also require GITHUB_EVENT_NAME to be push or merge_group.

Cache population is unaffected. Push-to-main and merge-queue runs remain
trusted writers, and they are the runs whose outputs correspond to code that
actually landed — which is what the cache should hold. pull_request runs
become pull-only and keep the full read benefit.

Verification

CI=true GITHUB_EVENT_NAME=pull_request  -> pull-only
CI=true GITHUB_EVENT_NAME=push          -> writes enabled
CI=true GITHUB_EVENT_NAME=merge_group   -> writes enabled

Org-wide

The same gap was found and fixed in every sibling repo before merge —
meshtastic/gradle-flatpak-sources#28, meshtastic/MQTTastic-Client-KMP#118,
meshtastic/meshtastic-sdk#91, meshtastic/protobufs#1027,
meshtastic/TAKPacket-SDK#124 — and in Meshtastic-Android, which had the original
(meshtastic/Meshtastic-Android#6550). kzstd is the only one where the onboarding
merged first, so it needs this follow-up.

Existing pull_request-written entries are keyed by their own input hashes and
will age out; no purge is needed unless you'd prefer to clear the cache node.

Summary by CodeRabbit

• Bug Fixes
  • Remote build-cache writes are now limited to eligible CI builds.
  • Pull-request and local builds no longer push data to the remote cache.
  • Cache publishing requires a valid access key.

[coderabbitai]

No actionable comments were generated in the recent review. 🎉

ℹ️ Recent review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: f1ebbe9e-4001-491e-ab74-3945be83472b

📥 Commits

Reviewing files that changed from the base of the PR and between d887d01 and cf54579.

📒 Files selected for processing (1)

• gradle/develocity.settings.gradle

---

📝 Walkthrough

Walkthrough

The Develocity configuration now enables remote build-cache writes only for CI push and merge_group events with a non-empty access key. Pull-request and local builds do not enable cache pushing.

Changes

Remote cache push policy

Layer / File(s)	Summary
Event-gated cache push eligibility gradle/develocity.settings.gradle	Remote cache writes now require CI execution, a non-empty access key, and GITHUB_EVENT_NAME set to push or merge_group.

Estimated code review effort: 2 (Simple) | ~10 minutes

Possibly related PRs

• meshtastic/kzstd#36: Introduced the Develocity cache-push restrictions refined by this change.

Poem

A rabbit checks the cache gate twice,
For push events only, neat and precise.
Merge groups may write; pull requests wait,
Empty keys find a closed-up gate.
CI hops on with settings right.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes the main change: restricting Develocity cache writes to trusted CI events.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}