ci: move Build Scans and cache to the OSS Community Develocity instance

[jamesarich]

This project already applied com.gradle.develocity, but pointed at the default
scans.gradle.com and kept a separate self-hosted HttpBuildCache. Both now
move to the OSS Community Develocity instance at
https://community.develocity.cloud under project ID meshtastic, matching
the Meshtastic-Android onboarding (meshtastic/Meshtastic-Android#6531) and the
rest of the org rollout (meshtastic/kzstd#36,
meshtastic/gradle-flatpak-sources#28, meshtastic/MQTTastic-Client-KMP#118).

What changed

• gradle/develocity.settings.gradle gains server and projectId, and
  absorbs the build cache from gradle/build-cache.settings.gradle, which is
  deleted. Both settings files now apply one script instead of two.
• termsOfUseUrl / termsOfUseAgree are dropped — they apply only to the
  public scans.gradle.com service. (Tested: the plugin does not reject them
  alongside a configured server, so this is cleanliness, not a requirement.)
• Scan publishing is gated on authentication rather than on CI, so local
  builds publish too once a developer runs
  ./gradlew provisionDevelocityAccessKey. Fork PRs and unprovisioned
  developers publish nothing rather than failing.
• Scans are obfuscated — no username, hostname, IP address or external
  process name is recorded.
• CCUD 2.7.0 → 2.8.0.
• .github/actions/gradle-setup gains an optional develocity_access_key
  input forwarded to setup-gradle; all 9 composite call sites pass
  secrets.DEVELOCITY_ACCESS_KEY, as does the direct setup-gradle in
  docs.yml. The GRADLE_CACHE_* env blocks are removed.
• A "Revved up by Develocity" badge in the README.

Per GOVERNANCE.md this is a day-to-day change (no public API, wire protocol
or module-boundary impact), so it needs one maintainer approval and a green
./gradlew check rather than an ADR.

Verification

• Scans publish to community.develocity.cloud — not scans.gradle.com —
  for both the root build (meshtastic-sdk) and the included build
  (build-logic, verified with ./gradlew -p build-logic help).
• ./gradlew check green: 294 tasks. See the caveat below.

Caveat: spotlessMisc cannot run in a Nix/direnv checkout

./gradlew check fails locally at spotlessMisc with

java.nio.file.AccessDeniedException:
  build/spotless-clean/spotlessMisc/.direnv/flake-inputs/…-source/doc/packages/python-tree-sitter.section.md

because the misc format target walks .direnv/flake-inputs/, which contains
read-only Nix store paths (and, in a checkout with git worktrees, descends into
.claude/worktrees/ too). This reproduces on a clean main, so it is not
caused by this PR, and CI runners have neither directory. The 294-task figure
above excludes spotlessMisc/spotlessMiscCheck; everything else passes.
A one-line exclusion in the spotless misc target would fix local runs — worth
a separate PR.

Note for reviewers

The GRADLE_CACHE_* repository secrets are now unused but deliberately not
deleted — they are the rollback path.

Summary by CodeRabbit

• New Features
  • Added Develocity Build Scan integration and a project badge linking to published scans.
  • Enabled authenticated remote build-cache access for supported build workflows.
• Build Improvements
  • Consolidated build scan and cache configuration under Develocity.
  • Updated build metadata tooling for improved compatibility.
• Documentation
  • Added a Develocity badge to the project README.

[coderabbitai]

Warning

Review limit reached

@jamesarich, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 2 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 29a9b16b-ff0a-48e8-844e-ecd5d2ee71fd

📥 Commits

Reviewing files that changed from the base of the PR and between e062f5d and ec545c0.

📒 Files selected for processing (1)

• gradle/develocity.settings.gradle

📝 Walkthrough

Walkthrough

Gradle cache and Build Scan configuration is consolidated under Develocity. The Gradle setup action accepts an optional access key. CI, documentation, and release workflows pass the repository secret to Gradle.

Changes

Develocity integration

Layer / File(s)	Summary
Gradle Develocity configuration gradle/develocity.settings.gradle, build-logic/settings.gradle.kts, settings.gradle.kts, README.md	Gradle configures the community Develocity server, authenticated Build Scan publication, CI-specific fingerprinting, cache behavior, and the updated custom user data plugin. The README includes a Build Scan badge.
Access-key action and workflow wiring .github/actions/gradle-setup/action.yml, .github/workflows/ci.yml, .github/workflows/docs.yml, .github/workflows/release.yml	The local Gradle setup action accepts develocity_access_key and passes it to Gradle. Workflows provide DEVELOCITY_ACCESS_KEY and remove global Gradle cache credentials.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Poem

A rabbit hops through Gradle’s gate,
With scans and caches set up straight.
A secret key helps builds proceed,
While CI plants each cached seed.
Develocity shines bright and clear!

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.
Title check	✅ Passed	The title clearly and concisely describes moving Build Scans and build caching to the OSS Community Develocity instance.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

_{Comment @coderabbitai help to get the list of available commands.}

[coderabbitai]

Actionable comments posted: 2

🤖 Prompt for all review comments with AI agents

Verify each finding against current code. Fix only still-valid issues, skip the
rest with a brief reason, keep changes minimal, and validate.

Inline comments:
In `@gradle/develocity.settings.gradle`:
- Around line 62-65: Update the remote cache configuration in
develocityBuildCache so push requires an explicit trusted-writer flag supplied
only by protected-branch jobs, in addition to CI and a non-empty access key. Do
not use the GitHub Actions cache_read_only setting or access-key presence alone
to authorize writes; preserve remote cache reads for other builds.

In `@README.md`:
- Line 11: Remove the Develocity badge from the README’s badge section, leaving
the remaining README content unchanged. Do not add a replacement badge or modify
the README for unrelated documentation; move project-status badges elsewhere
only if needed.

🪄 Autofix (Beta)

Fix all unresolved CodeRabbit comments on this PR:

• Push a commit to this branch (recommended)
• Create a new PR with the fixes

---

ℹ️ Review info

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro Plus

Run ID: 475c9091-02e7-450c-b1af-7cf12855b463

📥 Commits

Reviewing files that changed from the base of the PR and between cbe4116 and e062f5d.

📒 Files selected for processing (9)

• .github/actions/gradle-setup/action.yml
• .github/workflows/ci.yml
• .github/workflows/docs.yml
• .github/workflows/release.yml
• README.md
• build-logic/settings.gradle.kts
• gradle/build-cache.settings.gradle
• gradle/develocity.settings.gradle
• settings.gradle.kts

💤 Files with no reviewable changes (1)

• gradle/build-cache.settings.gradle