Authenticate Develocity injection integ tests with workload identity (#1112)

## Changes

Follow-up to #1109. That PR left `suite-integ-test-other.yml` on
`DV_SOLUTIONS_ACCESS_KEY`.

`integ-test-inject-develocity.yml` now gets a GitHub OIDC token, in
`solutions.develocity.cloud=<token>` form, from the same pre-step as
#1109. The token goes where the access key went before:

- **`inject-develocity`**: the `DEVELOCITY_ACCESS_KEY` /
`GRADLE_ENTERPRISE_ACCESS_KEY` env var, set per matrix entry through
`$GITHUB_ENV`
- **`inject-develocity-with-access-key`**: the `develocity-access-key`
input
- **`inject-develocity-short-lived-token-failed`**: both env vars and
the input
- **`inject-develocity-with-access-key-from-input-actions`**: the
`DEVELOCITY_ACCESS_KEY` env var

setup-gradle exchanges the OIDC token at `/api/auth/token` the same way
it exchanges an access key. The `DEVELOCITY_ACCESS_KEY` secret is
removed from the reusable workflow. `id-token: write` is granted along
the chain: `ci-integ-test*.yml` → `suite-integ-test-other.yml` → the
jobs. Fork PRs are already skipped for these jobs.

Part of gradle/dv#74660. After this merges, nothing in gradle/actions
uses `DV_SOLUTIONS_ACCESS_KEY`.

## Verification

- [ ] CI-integ-test on this PR: `develocity-injection` jobs green, Build
Scans published to solutions.develocity.cloud

.github/workflows/ci-integ-test-full.yml

@@ -37,6 +37,7 @@ jobs:
     permissions:
       contents: write
       actions: read
+      id-token: write
     needs: caching-integ-tests
     uses: ./.github/workflows/suite-integ-test-other.yml
     concurrency:

.github/workflows/ci-integ-test.yml

@@ -48,6 +48,7 @@ jobs:
     permissions:
       contents: write
       actions: read
+      id-token: write
     needs: caching-integ-tests
     uses: ./.github/workflows/suite-integ-test-other.yml
     concurrency:

.github/workflows/integ-test-inject-develocity.yml

@@ -12,9 +12,6 @@ on:
       skip-dist:
         type: boolean
         default: false
-    secrets:
-      DEVELOCITY_ACCESS_KEY:
-        required: true
 
 env:
   SKIP_DIST: ${{ inputs.skip-dist }}
@@ -46,12 +43,14 @@ jobs:
           - plugin-version: '4.6.1'
             accessKeyEnv: DEVELOCITY_ACCESS_KEY
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+      id-token: write
     env:
       DEVELOCITY_INJECTION_ENABLED: true
       DEVELOCITY_INJECTION_URL: https://solutions.develocity.cloud
       DEVELOCITY_INJECTION_DEVELOCITY_PLUGIN_VERSION: ${{ matrix.plugin-version }}
       DEVELOCITY_INJECTION_CCUD_PLUGIN_VERSION: '2.2.1'
-      ${{matrix.accessKeyEnv}}: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
     steps:
     - name: Checkout sources
@@ -60,6 +59,19 @@ jobs:
       uses: ./.github/actions/init-integ-test
       with:
         java-version: ${{ matrix.java-version }}
+    - name: Get GitHub OIDC token for Develocity
+      id: develocity-oidc
+      shell: bash
+      run: |
+        if [ -z "$ACTIONS_ID_TOKEN_REQUEST_URL" ]; then
+          echo "::warning::No GitHub OIDC token available (e.g. PR from a fork), Develocity will not be authenticated"
+          exit 0
+        fi
+        token=$(curl -sSfG -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
+          --data-urlencode "audience=https://solutions.develocity.cloud" \
+          "$ACTIONS_ID_TOKEN_REQUEST_URL" | jq -r .value)
+        echo "::add-mask::$token"
+        echo "${{ matrix.accessKeyEnv }}=solutions.develocity.cloud=$token" >> "$GITHUB_ENV"
     - name: Setup Gradle
       id: setup-gradle
       uses: ./setup-gradle
@@ -104,6 +116,9 @@ jobs:
           - gradle: '5.6.4'
             java-version: 11
     runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - name: Checkout sources
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -111,13 +126,26 @@ jobs:
         uses: ./.github/actions/init-integ-test
         with:
           java-version: ${{ matrix.java-version }}
+      - name: Get GitHub OIDC token for Develocity
+        id: develocity-oidc
+        shell: bash
+        run: |
+          if [ -z "$ACTIONS_ID_TOKEN_REQUEST_URL" ]; then
+            echo "::warning::No GitHub OIDC token available (e.g. PR from a fork), Develocity will not be authenticated"
+            exit 0
+          fi
+          token=$(curl -sSfG -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
+            --data-urlencode "audience=https://solutions.develocity.cloud" \
+            "$ACTIONS_ID_TOKEN_REQUEST_URL" | jq -r .value)
+          echo "::add-mask::$token"
+          echo "access-key=solutions.develocity.cloud=$token" >> "$GITHUB_OUTPUT"
       - name: Setup Gradle
         id: setup-gradle
         uses: ./setup-gradle
         with:
           cache-read-only: false # For testing, allow writing cache entries on non-default branches
           gradle-version: ${{ matrix.gradle }}
-          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
+          develocity-access-key: ${{ steps.develocity-oidc.outputs.access-key }}
           develocity-token-expiry: 1
       - name: Run Gradle build
         id: gradle
@@ -140,9 +168,6 @@ jobs:
       DEVELOCITY_INJECTION_URL: 'https://localhost:3333/'
       DEVELOCITY_INJECTION_DEVELOCITY_PLUGIN_VERSION: ${{ matrix.plugin-version }}
       DEVELOCITY_INJECTION_CCUD_PLUGIN_VERSION: '2.1'
-      # Access key also set as an env var, we want to check it does not leak
-      GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
-      DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
     strategy:
       fail-fast: false
       matrix:
@@ -160,6 +185,9 @@ jobs:
           - gradle: '5.6.4'
             java-version: 11
     runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
     steps:
       - name: Checkout sources
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -167,13 +195,29 @@ jobs:
         uses: ./.github/actions/init-integ-test
         with:
           java-version: ${{ matrix.java-version }}
+      # Access key also set as an env var, we want to check it does not leak
+      - name: Get GitHub OIDC token for Develocity
+        id: develocity-oidc
+        shell: bash
+        run: |
+          if [ -z "$ACTIONS_ID_TOKEN_REQUEST_URL" ]; then
+            echo "::warning::No GitHub OIDC token available (e.g. PR from a fork), Develocity will not be authenticated"
+            exit 0
+          fi
+          token=$(curl -sSfG -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
+            --data-urlencode "audience=https://solutions.develocity.cloud" \
+            "$ACTIONS_ID_TOKEN_REQUEST_URL" | jq -r .value)
+          echo "::add-mask::$token"
+          echo "access-key=solutions.develocity.cloud=$token" >> "$GITHUB_OUTPUT"
+          echo "GRADLE_ENTERPRISE_ACCESS_KEY=solutions.develocity.cloud=$token" >> "$GITHUB_ENV"
+          echo "DEVELOCITY_ACCESS_KEY=solutions.develocity.cloud=$token" >> "$GITHUB_ENV"
       - name: Setup Gradle
         id: setup-gradle
         uses: ./setup-gradle
         with:
           gradle-version: ${{ matrix.gradle }}
           cache-read-only: false # For testing, allow writing cache entries on non-default branches
-          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
+          develocity-access-key: ${{ steps.develocity-oidc.outputs.access-key }}
       - name: Run Gradle build
         id: gradle
         working-directory: .github/workflow-samples/no-ge
@@ -184,8 +228,9 @@ jobs:
         run: "[ \"${GRADLE_ENTERPRISE_ACCESS_KEY}\" != \"\" ] || (echo 'GRADLE_ENTERPRISE_ACCESS_KEY is still supported in v3!'; exit 1)"
 
   inject-develocity-with-access-key-from-input-actions:
-    env:
+    permissions:
-      DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
+      contents: read
+      id-token: write
     strategy:
       fail-fast: false
       matrix:
@@ -210,6 +255,19 @@ jobs:
         uses: ./.github/actions/init-integ-test
         with:
           java-version: ${{ matrix.java-version }}
+      - name: Get GitHub OIDC token for Develocity
+        id: develocity-oidc
+        shell: bash
+        run: |
+          if [ -z "$ACTIONS_ID_TOKEN_REQUEST_URL" ]; then
+            echo "::warning::No GitHub OIDC token available (e.g. PR from a fork), Develocity will not be authenticated"
+            exit 0
+          fi
+          token=$(curl -sSfG -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
+            --data-urlencode "audience=https://solutions.develocity.cloud" \
+            "$ACTIONS_ID_TOKEN_REQUEST_URL" | jq -r .value)
+          echo "::add-mask::$token"
+          echo "DEVELOCITY_ACCESS_KEY=solutions.develocity.cloud=$token" >> "$GITHUB_ENV"
       - name: Setup Gradle
         id: setup-gradle
         uses: ./setup-gradle

.github/workflows/suite-integ-test-other.yml

@@ -22,11 +22,12 @@ jobs:
 
   develocity-injection:
     if: ${{ ! github.event.pull_request.head.repo.fork }}
+    permissions:
+      contents: read
+      id-token: write
     uses: ./.github/workflows/integ-test-inject-develocity.yml
     with:
       skip-dist: ${{ inputs.skip-dist }}
-    secrets:
-      DEVELOCITY_ACCESS_KEY: ${{ secrets.DV_SOLUTIONS_ACCESS_KEY }}
 
   gradle-support-status:
     permissions: