ci: publish KMP Build Scans and cache to the OSS Community Develocity instance

.github/workflows/kmp-pull-request.yml

@@ -10,11 +10,6 @@ on:
 permissions:
   contents: read
 
-env:
-  GRADLE_CACHE_URL: ${{ secrets.GRADLE_CACHE_URL }}
-  GRADLE_CACHE_USERNAME: ${{ secrets.GRADLE_CACHE_USERNAME }}
-  GRADLE_CACHE_PASSWORD: ${{ secrets.GRADLE_CACHE_PASSWORD }}
-
 jobs:
   build-kmp:
     runs-on: macos-latest
@@ -33,6 +28,8 @@ jobs:
 
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v6
+        with:
+          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - name: Cache Konan (Kotlin/Native toolchain)
         uses: actions/cache@v6

.github/workflows/publish-kmp.yml

@@ -33,11 +33,6 @@ on:
 permissions:
   contents: read
 
-env:
-  GRADLE_CACHE_URL: ${{ secrets.GRADLE_CACHE_URL }}
-  GRADLE_CACHE_USERNAME: ${{ secrets.GRADLE_CACHE_USERNAME }}
-  GRADLE_CACHE_PASSWORD: ${{ secrets.GRADLE_CACHE_PASSWORD }}
-
 jobs:
   build-kmp:
     runs-on: macos-latest
@@ -77,6 +72,8 @@ jobs:
 
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v6
+        with:
+          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - name: Cache Konan (Kotlin/Native toolchain)
         uses: actions/cache@v6
@@ -113,6 +110,8 @@ jobs:
 
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v6
+        with:
+          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - name: Cache Konan (Kotlin/Native toolchain)
         uses: actions/cache@v6

.github/workflows/snapshot-kmp.yml

@@ -15,11 +15,6 @@ on:
 permissions:
   contents: read
 
-env:
-  GRADLE_CACHE_URL: ${{ secrets.GRADLE_CACHE_URL }}
-  GRADLE_CACHE_USERNAME: ${{ secrets.GRADLE_CACHE_USERNAME }}
-  GRADLE_CACHE_PASSWORD: ${{ secrets.GRADLE_CACHE_PASSWORD }}
-
 jobs:
   publish-snapshot:
     runs-on: macos-latest
@@ -40,6 +35,8 @@ jobs:
 
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v6
+        with:
+          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - name: Cache Konan (Kotlin/Native toolchain)
         uses: actions/cache@v6

README.md

@@ -4,6 +4,7 @@
 [![CLA assistant](https://cla-assistant.io/readme/badge/meshtastic/protobufs)](https://cla-assistant.io/meshtastic/protobufs)
 [![Fiscal Contributors](https://opencollective.com/meshtastic/tiers/badge.svg?label=Fiscal%20Contributors&color=deeppink)](https://opencollective.com/meshtastic/)
 [![Vercel](https://img.shields.io/static/v1?label=Powered%20by&message=Vercel&style=flat&logo=vercel&color=000000)](https://vercel.com?utm_source=meshtastic&utm_campaign=oss)
+[![Revved up by Develocity](https://img.shields.io/badge/Revved%20up%20by-Develocity-06A0CE?logo=Gradle&labelColor=02303A)](https://community.develocity.cloud/scans?search.rootProjectNames=protobufs)
 
 ## Overview
 

packages/kmp/gradle/develocity.settings.gradle

@@ -0,0 +1,62 @@
+/*
+ * Develocity — Build Scans and remote Build Cache on the OSS Community instance
+ * (https://community.develocity.cloud), project `meshtastic`.
+ *
+ * Covers the KMP leg of this repo only; the buf, deno and cargo builds are
+ * unaffected.
+ *
+ * Replaces the former self-hosted HttpBuildCache: GRADLE_CACHE_URL / _USERNAME /
+ * _PASSWORD are no longer read anywhere in this repo.
+ */
+
+def isCI = System.getenv("CI") != null
+
+develocity {
+    server = "https://community.develocity.cloud"
+    projectId = "meshtastic"
+    buildScan {
+        uploadInBackground = !isCI
+        // Unauthenticated builds (fork PRs, developers who never provisioned a key)
+        // publish nothing rather than failing.
+        publishing.onlyIf { it.authenticated }
+        // Fingerprints power cache-miss comparison (CI debugging); skip the payload locally.
+        capture { fileFingerprints = isCI }
+        // Public instance: no machine identity. Constants on purpose — scans already
+        // record OS/CPU and CCUD adds CI metadata. Keep the `if` OUTSIDE the closures:
+        // capture-free closures are what the configuration cache can serialize.
+        obfuscation {
+            ipAddresses { addresses -> addresses.collect { "0.0.0.0" } }
+            externalProcessName { "external-process" }
+            if (isCI) {
+                username { "ci" }
+                hostname { "ci-runner" }
+            } else {
+                username { "local-dev" }
+                hostname { "local-machine" }
+            }
+        }
+    }
+}
+
+// Resolved outside the buildCache block: inside it the closure delegate is
+// BuildCacheConfiguration, which has no `develocity` property.
+def develocityBuildCache = develocity.buildCache
+def accessKey = System.getenv("DEVELOCITY_ACCESS_KEY")?.trim()
+
+buildCache {
+    // Off on CI: runners are ephemeral and every hit comes from the remote anyway.
+    local {
+        enabled = !isCI
+    }
+    remote(develocityBuildCache) {
+        enabled = true
+        // Write only from trusted events. Local dev is excluded by isCI, and
+        // pull_request runs are excluded here: a same-repository PR DOES receive
+        // repository secrets, so gating on the access key alone would let
+        // unmerged code write entries into the shared cache. Fork PRs have no
+        // key and are excluded twice over.
+        def eventName = System.getenv("GITHUB_EVENT_NAME")
+        def trustedForPush = eventName == "push" || eventName == "merge_group"
+        push = isCI && trustedForPush && accessKey != null && !accessKey.isEmpty()
+    }
+}

packages/kmp/settings.gradle.kts

@@ -6,13 +6,18 @@ pluginManagement {
     }
 }
 
+plugins {
+    id("com.gradle.develocity") version "4.5.0"
+    id("com.gradle.common-custom-user-data-gradle-plugin") version "2.8.0"
+}
+
 dependencyResolutionManagement {
     repositories {
         google()
         mavenCentral()
     }
 }
 
-apply(from = "gradle/build-cache.settings.gradle")
+apply(from = "gradle/develocity.settings.gradle")
 
 rootProject.name = "protobufs"