ci: publish KMP Build Scans and cache to the OSS Community Develocity instance by jamesarich · Pull Request #1027 · meshtastic/protobufs

jamesarich · 2026-08-02T23:36:17Z

Publishes Build Scans® and moves the remote build cache for the KMP leg of
this repo to the OSS Community Develocity instance at
https://community.develocity.cloud under project ID meshtastic, matching the
Meshtastic-Android onboarding (meshtastic/Meshtastic-Android#6531) and the rest
of the org rollout (meshtastic/kzstd#36, meshtastic/gradle-flatpak-sources#28,
meshtastic/MQTTastic-Client-KMP#118, meshtastic/meshtastic-sdk#91).

The buf, deno and cargo builds are untouched — only packages/kmp is a Gradle
build, so it is the only part Develocity can see.

What changed

packages/kmp/gradle/develocity.settings.gradle replaces
packages/kmp/gradle/build-cache.settings.gradle. The cache now comes from
Develocity, so scan and cache configuration are one concern in one file.
The self-hosted HttpBuildCache is replaced by remote(develocity.buildCache).
All four setup-gradle call sites — kmp-pull-request.yml,
publish-kmp.yml (×2) and snapshot-kmp.yml — gain an optional
develocity-access-key. The GRADLE_CACHE_URL / GRADLE_CACHE_USERNAME /
GRADLE_CACHE_PASSWORD env blocks are removed from all three.
A "Revved up by Develocity" badge in the README.

Behaviour

Scans publish only from authenticated builds (publishing.onlyIf { it.authenticated }).
Fork PRs and developers without a provisioned key publish nothing rather than
failing.
Only authenticated CI runs write to the cache, so unmerged and fork code
cannot poison it. CI disables the local cache — runners are ephemeral and
every hit comes from the remote anyway.
Scans carry no machine identity: usernames, hostnames, IP addresses and
external process names are obfuscated to constants.

Verification

cd packages/kmp && ./gradlew build — BUILD SUCCESSFUL, 79 tasks, scan
published under root project name protobufs.

On the kzstd pilot this configuration measured a 59% build-time avoidance ratio
on the second CI run, entirely from remote cache hits.

Two pre-existing issues found while verifying (neither caused by this PR)

Both reproduce on a clean master checkout:

packages/kmp is not configuration-cache compatible. build.gradle.kts
runs git describe --tags --abbrev=0 at configuration time, which Gradle
rejects under --configuration-cache. The build does not enable the
configuration cache today, so nothing is broken — but it cannot be enabled
until that call moves to a ValueSource/providers.exec.
./gradlew build needs ANDROID_HOME, which the repo does not document
and which no local.properties provides. packages/kmp has an Android
target, so a fresh checkout fails with "SDK location not found".

Note for reviewers

The GRADLE_CACHE_* repository secrets are now unused but deliberately not
deleted — they are the rollback path.

Summary by CodeRabbit

Documentation
- Added a Develocity badge and link to the README.
Build Improvements
- Improved build scan and caching configuration for CI and local development.
- Enabled authenticated remote caching for eligible builds.
- Simplified workflow credential handling for pull request, snapshot, and publishing workflows.

… instance Replaces the self-hosted HttpBuildCache with Develocity's remote cache at community.develocity.cloud under project `meshtastic`, matching the Meshtastic-Android onboarding (meshtastic/Meshtastic-Android#6531). Covers the KMP leg of this repo only — the buf, deno and cargo builds are unaffected. - `packages/kmp/gradle/develocity.settings.gradle` replaces `packages/kmp/gradle/build-cache.settings.gradle`. - All four `setup-gradle` call sites across kmp-pull-request.yml, publish-kmp.yml (2) and snapshot-kmp.yml gain an optional develocity-access-key; the GRADLE_CACHE_* env blocks are removed. - Scans publish only from authenticated builds, so fork PRs and developers without a provisioned key are unaffected; only authenticated CI runs write to the cache. The GRADLE_CACHE_* secrets are no longer read but are deliberately left in place as the rollback path.

coderabbitai · 2026-08-02T23:36:33Z

Warning

Review limit reached

@jamesarich, you've reached your PR review limit, so we couldn't start this review.

Next review available in: 18 minutes

Enable usage-based reviews in Billing to review now. Otherwise, wait until the next included review is available.
You're only billed for reviews past your plan's rate limits ($0.25/file).

How can I continue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based reviews.

How do review limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please refer docs for additional details.

Review details

⚙️ Run configuration

Configuration used: Path: .coderabbit.yaml

Review profile: CHILL

Plan: Pro Plus

Run ID: 9ca1691b-5170-430b-996a-3342353ecada

📥 Commits

Reviewing files that changed from the base of the PR and between 0044a5a and c3b4e71.

📒 Files selected for processing (1)

packages/kmp/gradle/develocity.settings.gradle

📝 Walkthrough

Walkthrough

The KMP build replaces the shared Gradle build-cache script with Develocity configuration. Workflows pass DEVELOCITY_ACCESS_KEY to Gradle setup steps. The README adds a Develocity badge.

Changes

Develocity integration

Layer / File(s)	Summary
Gradle Develocity configuration `packages/kmp/settings.gradle.kts`, `packages/kmp/gradle/develocity.settings.gradle`, `README.md`	The KMP settings apply Develocity plugins and configure build scans, fingerprints, obfuscation, and remote caching. The README adds a Develocity badge.
CI access-key wiring `.github/workflows/kmp-pull-request.yml`, `.github/workflows/publish-kmp.yml`, `.github/workflows/snapshot-kmp.yml`	The workflows pass `DEVELOCITY_ACCESS_KEY` to Gradle setup steps and remove the previous Gradle cache credentials.

Estimated code review effort: 3 (Moderate) | ~20 minutes

Sequence Diagram(s)

sequenceDiagram
  participant GitHubActions
  participant GradleSetup
  participant Gradle
  participant Develocity
  GitHubActions->>GradleSetup: Provide DEVELOCITY_ACCESS_KEY
  GradleSetup->>Gradle: Configure the KMP build
  Gradle->>Develocity: Publish scans and access remote cache

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Title check	✅ Passed	The title clearly summarizes the primary CI change: publishing KMP Build Scans and using the OSS Community Develocity cache.
Description check	✅ Passed	The description clearly explains the changes, behavior, verification, scope, and known issues, despite omitting the repository template headings and checklist.
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.

✨ Finishing Touches

📝 Generate docstrings

Create stacked PR
Commit on current branch

🧪 Generate unit tests (beta)

Create PR with unit tests
Commit unit tests in branch feat/develocity-oss

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

_{Comment @coderabbitai help to get the list of available commands.}

github-actions · 2026-08-02T23:36:33Z

The latest Buf updates on your PR. Results from workflow pull-request / build (pull_request).

Build	Format	Lint	Breaking	Updated (UTC)
`✅ passed`	`✅ passed`	`✅ passed`	`✅ passed`	Aug 3, 2026, 12:18 AM

Same-repository pull requests DO receive repository secrets, so gating cache writes on the presence of DEVELOCITY_ACCESS_KEY alone let a PR build write entries into the shared cache. The self-hosted HttpBuildCache this replaced gated on GITHUB_EVENT_NAME and excluded pull_request; that protection was lost in the port and is restored here. Verified against a real CI-shaped environment: CI=true GITHUB_EVENT_NAME=pull_request -> pull-only CI=true GITHUB_EVENT_NAME=push -> writes enabled CI=true GITHUB_EVENT_NAME=merge_group -> writes enabled Local builds are still excluded by isCI, and fork PRs have no key at all.

This was referenced Aug 3, 2026

ci: restrict Develocity cache writes to trusted events meshtastic/Meshtastic-Android#6550

Merged

ci: restrict Develocity cache writes to trusted events meshtastic/kzstd#37

Merged

Navigation Menu

Uh oh!

ci: publish KMP Build Scans and cache to the OSS Community Develocity instance - #1027

ci: publish KMP Build Scans and cache to the OSS Community Develocity instance#1027
jamesarich wants to merge 2 commits into
masterfrom
feat/develocity-oss

jamesarich commented Aug 2, 2026 •

edited by coderabbitai Bot

Loading

Uh oh!

coderabbitai Bot commented Aug 2, 2026 •

edited

Loading

Review limit reached

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

github-actions Bot commented Aug 2, 2026 •

edited

Loading

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

Uh oh!

Conversation

jamesarich commented Aug 2, 2026 • edited by coderabbitai Bot Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

What changed

Behaviour

Verification

Two pre-existing issues found while verifying (neither caused by this PR)

Note for reviewers

Summary by CodeRabbit

Uh oh!

coderabbitai Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Review limit reached

Walkthrough

Changes

Sequence Diagram(s)

Uh oh!

github-actions Bot commented Aug 2, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

jamesarich commented Aug 2, 2026 •

edited by coderabbitai Bot

Loading

coderabbitai Bot commented Aug 2, 2026 •

edited

Loading

github-actions Bot commented Aug 2, 2026 •

edited

Loading