mirror of
https://github.com/gradle/actions.git
synced 2026-11-13 18:24:01 +00:00
main
2293
Commits
| Author | SHA1 | Message | Date | |
|---|---|---|---|---|
 Iñaki Villar
|
445a164ce8 |
Authenticate Develocity injection integ tests with workload identity (#1112)
## Changes Follow-up to #1109. That PR left `suite-integ-test-other.yml` on `DV_SOLUTIONS_ACCESS_KEY`. `integ-test-inject-develocity.yml` now gets a GitHub OIDC token, in `solutions.develocity.cloud=<token>` form, from the same pre-step as #1109. The token goes where the access key went before: - **`inject-develocity`**: the `DEVELOCITY_ACCESS_KEY` / `GRADLE_ENTERPRISE_ACCESS_KEY` env var, set per matrix entry through `$GITHUB_ENV` - **`inject-develocity-with-access-key`**: the `develocity-access-key` input - **`inject-develocity-short-lived-token-failed`**: both env vars and the input - **`inject-develocity-with-access-key-from-input-actions`**: the `DEVELOCITY_ACCESS_KEY` env var setup-gradle exchanges the OIDC token at `/api/auth/token` the same way it exchanges an access key. The `DEVELOCITY_ACCESS_KEY` secret is removed from the reusable workflow. `id-token: write` is granted along the chain: `ci-integ-test*.yml` → `suite-integ-test-other.yml` → the jobs. Fork PRs are already skipped for these jobs. Part of gradle/dv#74660. After this merges, nothing in gradle/actions uses `DV_SOLUTIONS_ACCESS_KEY`. ## Verification - [ ] CI-integ-test on this PR: `develocity-injection` jobs green, Build Scans published to solutions.develocity.cloud |
||
|
Iñaki Villar
|
fac0990588 |
Bump Gradle Wrapper from 9.9.0 to 9.9.1 in /.github/workflow-samples/java-toolchain (#1123)
Bump Gradle Wrapper from 9.9.0 to 9.9.1. Release notes of Gradle 9.9.1 can be found here: https://docs.gradle.org/9.9.1/release-notes.html |
||
|
Iñaki Villar
|
5ca09edddf |
Bump Gradle Wrapper from 9.8.2 to 9.9.1 in /.github/workflow-samples/kotlin-dsl (#1124)
Bump Gradle Wrapper from 9.8.2 to 9.9.1. Release notes of Gradle 9.9.1 can be found here: https://docs.gradle.org/9.9.1/release-notes.html |
||
|
Iñaki Villar
|
a4182520b3 |
Bump Gradle Wrapper from 9.9.0 to 9.9.1 in /.github/workflow-samples/gradle-plugin (#1121)
Bump Gradle Wrapper from 9.9.0 to 9.9.1. Release notes of Gradle 9.9.1 can be found here: https://docs.gradle.org/9.9.1/release-notes.html |
||
|
Iñaki Villar
|
bfcb30cf34 |
Bump Gradle Wrapper from 9.9.0 to 9.9.1 in /sources/test/init-scripts (#1120)
Bump Gradle Wrapper from 9.9.0 to 9.9.1. Release notes of Gradle 9.9.1 can be found here: https://docs.gradle.org/9.9.1/release-notes.html |
||
|
bot-githubaction
|
031d955e6d |
Bump Gradle Wrapper from 9.8.2 to 9.9.1.
Release notes of Gradle 9.9.1 can be found here: https://docs.gradle.org/9.9.1/release-notes.html Signed-off-by: bot-githubaction <[email protected]> |
||
|
bot-githubaction
|
ee2f5df6fa |
Bump Gradle Wrapper from 9.9.0 to 9.9.1.
Release notes of Gradle 9.9.1 can be found here: https://docs.gradle.org/9.9.1/release-notes.html Signed-off-by: bot-githubaction <[email protected]> |
||
|
bot-githubaction
|
15e4fe97d0 |
Bump Gradle Wrapper from 9.9.0 to 9.9.1.
Release notes of Gradle 9.9.1 can be found here: https://docs.gradle.org/9.9.1/release-notes.html Signed-off-by: bot-githubaction <[email protected]> |
||
|
bot-githubaction
|
c2db668634 |
Bump Gradle Wrapper from 9.9.0 to 9.9.1.
Release notes of Gradle 9.9.1 can be found here: https://docs.gradle.org/9.9.1/release-notes.html Signed-off-by: bot-githubaction <[email protected]> |
||
|
Iñaki Villar
|
5a9182793c |
Bump Gradle Wrapper from 9.8.2 to 9.9.0 in /.github/workflow-samples/gradle-plugin (#1116)
Bump Gradle Wrapper from 9.8.2 to 9.9.0. Release notes of Gradle 9.9.0 can be found here: https://docs.gradle.org/9.9.0/release-notes.html |
||
|
Iñaki Villar
|
b7deba1bb6 |
Bump Gradle Wrapper from 9.8.2 to 9.9.0 in /.github/workflow-samples/groovy-dsl (#1117)
Bump Gradle Wrapper from 9.8.2 to 9.9.0. Release notes of Gradle 9.9.0 can be found here: https://docs.gradle.org/9.9.0/release-notes.html |
||
|
Iñaki Villar
|
808476d4c7 |
Bump Gradle Wrapper from 9.8.2 to 9.9.0 in /.github/workflow-samples/java-toolchain (#1118)
Bump Gradle Wrapper from 9.8.2 to 9.9.0. Release notes of Gradle 9.9.0 can be found here: https://docs.gradle.org/9.9.0/release-notes.html |
||
|
Iñaki Villar
|
579b122e60 |
Bump Gradle Wrapper from 9.8.2 to 9.9.0 in /sources/test/init-scripts (#1115)
Bump Gradle Wrapper from 9.8.2 to 9.9.0. Release notes of Gradle 9.9.0 can be found here: https://docs.gradle.org/9.9.0/release-notes.html |
||
|
bot-githubaction
|
e85b2d6f6e |
Bump Gradle Wrapper from 9.8.2 to 9.9.0.
Release notes of Gradle 9.9.0 can be found here: https://docs.gradle.org/9.9.0/release-notes.html Signed-off-by: bot-githubaction <[email protected]> |
||
|
bot-githubaction
|
d94be6b0be |
Bump Gradle Wrapper from 9.8.2 to 9.9.0.
Release notes of Gradle 9.9.0 can be found here: https://docs.gradle.org/9.9.0/release-notes.html Signed-off-by: bot-githubaction <[email protected]> |
||
|
bot-githubaction
|
5fbd536b48 |
Bump Gradle Wrapper from 9.8.2 to 9.9.0.
Release notes of Gradle 9.9.0 can be found here: https://docs.gradle.org/9.9.0/release-notes.html Signed-off-by: bot-githubaction <[email protected]> |
||
|
bot-githubaction
|
f95d889790 |
Bump Gradle Wrapper from 9.8.2 to 9.9.0.
Release notes of Gradle 9.9.0 can be found here: https://docs.gradle.org/9.9.0/release-notes.html Signed-off-by: bot-githubaction <[email protected]> |
||
|
Iñaki Villar
|
96e7f85c08 |
Inline the OIDC token step and keep the existing assertions
Use the same pre-step as #1109 instead of a composite action, drop the extra exchange check and the fake access key. |
||
|
Iñaki Villar
|
f6e4f55eae |
Test Develocity injection with workload identity instead of an access key
The Develocity injection integration tests no longer use the long-lived DV_SOLUTIONS_ACCESS_KEY. The jobs that publish Build Scans pass a GitHub OIDC token as the access key, which setup-gradle exchanges for a short-lived token like any access key. The short-lived token failure job uses a fake access key. |
||
|
Iñaki Villar
|
c8a326d857 |
Authenticate CI to Develocity with workload identity (#1109)
## Changes Moves the workflows that publish to solutions.develocity.cloud from the long-lived `DV_SOLUTIONS_ACCESS_KEY` to GitHub OIDC tokens, using Develocity workload identity. - **`ci-check-and-unit-test.yml` and `ci-update-dist.yml`**: the Develocity npm agent reads `DEVELOCITY_ACCESS_KEY` directly, and an OIDC token can't be used there. A pre-step mints the OIDC token and exchanges it at `/api/auth/token?expiresInHours=2`, the call setup-gradle makes, for a short-lived Develocity access token. The npm steps read it from `steps.develocity-oidc.outputs.token-access-key`. - **`demo-job-summary.yml`** (`develocity-access-key-set` job): a pre-step mints the OIDC token and passes it to `setup-gradle` as `develocity-access-key` in `host=token` form. setup-gradle exchanges it, the same as it does with an access key. Each job gets `id-token: write`. Pull requests from forks get no OIDC token, just as they get no secrets today: the step warns and exits cleanly, and the builds run unauthenticated. ## Not in this PR `suite-integ-test-other.yml` still passes `DV_SOLUTIONS_ACCESS_KEY` to `integ-test-inject-develocity.yml`. Those jobs test setup-gradle's own access-key handling: swapping a classic access key for a short-lived token, the `GRADLE_ENTERPRISE_ACCESS_KEY` variant, and not leaking the key when the exchange fails. Feeding them an OIDC token would still run the exchange, but would stop covering the classic access-key path. Should they keep a long-lived key on purpose? ## Verification - [x] CI-check-and-unit-test on this PR ([run 41095618008](https://github.com/gradle/actions/actions/runs/41095618008)): green, the OIDC token is exchanged, and the npm agent published Build Scans to solutions.develocity.cloud, for example [ejvi6m5cprrhg](https://solutions.develocity.cloud/s/ejvi6m5cprrhg) and [goncdygtosovo](https://solutions.develocity.cloud/s/goncdygtosovo) - [x] Demo Job Summary dispatched on this branch ([run 41095628373](https://github.com/gradle/actions/actions/runs/41095628373)), `develocity-access-key-set` job: green, setup-gradle logs `Requesting short-lived Develocity access token for solutions.develocity.cloud` with no warning. The sample project publishes to scans.gradle.com, as before. - [ ] CI-update-dist runs only on `main`/release branches and commits `dist`, so it is verified after merge |
||
|
Inaki Villar
|
8e84bbf095 |
Authenticate CI to Develocity with workload identity
The npm builds and the demo job summary used the long-lived DV_SOLUTIONS_ACCESS_KEY. They now mint a GitHub OIDC token for solutions.develocity.cloud. The npm agent reads DEVELOCITY_ACCESS_KEY directly, so for it the token is exchanged for a short-lived Develocity access token first. Signed-off-by: Inaki Villar <[email protected]> |
||
|
bot-githubaction
|
8da46b539c | [bot] Update dist directory v6 v6.4.1 | ||
|
Jérôme Prinet
|
dcf6f72a92 |
Merge commit from fork
A dependency graph file downloaded from another workflow run may come from an untrusted fork. Passing the parsed file whole to octokit.request() let keys such as 'url' override the request destination and leak the token. |
||
|
Daz DeBoer
|
bf74269609 | Update to latest Dependency Graph plugin (#1106) | ||
|
bot-githubaction
|
65a6ba9f1d | [bot] Update dist directory | ||
|
|
35eba4f16a |
Combined dependency updates (#1105)
Combines several open bot PRs into one: - Bump Gradle Wrapper from 9.7.1 to 9.8.2 (squashed): closes #1098, closes #1099, closes #1100, closes #1101, closes #1102 - Bump the github-actions group (`init-integ-test` action): closes #1096 - Bump references to Develocity Gradle plugin from 4.6.0 to 4.6.1: closes #1103 - Bump the npm-dependencies group with 10 updates: closes #1097 Notes: - `nock` moves from 14 to 15, a major version bump. Tests that intercept HTTP requests are the most likely to break. - Local `npm run build` (prettier + eslint + esbuild) passes under node 24.22.1. Locally, jest passed 490/491. The one failure is `fetches wrapper jar checksums for snapshots`, which hits the live services.gradle.org API and timed out at 60s on a slow connection. I didn't check whether it also fails on `main`, so CI will settle it. Also included: - Switch the solutions Develocity server URL from `ge.solutions-team.gradle.com` to `solutions.develocity.cloud`. The old host now 308-redirects to the new one. `@actions/http-client` strips the `Authorization` header on a cross-host redirect, so the short-lived token request failed with a 401, which broke all the Develocity injection integ tests. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: Claude Opus 5.5 <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: bot-githubaction <[email protected]> |
||
|
Louis Jacomet
|
1cff18a4cf |
Update known wrapper checksums (#1075)
Automatically generated pull request to update the known wrapper checksums. |
||
|
bot-githubaction
|
399f0d30ea | Update known wrapper checksums | ||
|
Gašper Kojek
|
ecf8cf2dce |
Bump references to Develocity Gradle plugin from 4.5.1 to 4.6.0 (#1080)
This PR bumps references to Develocity Gradle plugin from 4.5.1 to 4.6.0. |
||
|
bot-githubaction
|
d740e82d59 | Bump references to Develocity Gradle plugin from 4.5.1 to 4.6.0 | ||
|
Clay Johnson
|
f9f39a915c |
Bump references to Develocity Gradle plugin from 4.5.0 to 4.5.1 (#1072)
This PR bumps references to Develocity Gradle plugin from 4.5.0 to 4.5.1. |
||
|
bot-githubaction
|
a3a36e1bf4 | Bump references to Develocity Gradle plugin from 4.5.0 to 4.5.1 | ||
|
Daz DeBoerandClaude Opus 5
|
3f5f9adaf7 |
Document the new Gradle signing key for dependency verification (#1071)
Follow-up to #1069, which bumped the `github-dependency-graph-gradle-plugin` default to `1.5.0`. `1.5.0` is signed with a **new** Gradle signing subkey, and the key currently documented in `docs/setup-gradle.md` has been revoked upstream. Without this docs change, the snippet we publish will fail dependency verification for Dependency Graph generation. I verified the published signatures rather than relying on the changelog: | Artifact | Issuer key | | |---|---|---| | `github-dependency-graph-gradle-plugin:1.5.0` | `D9B2DFBD9F3298BA` | new | | `github-dependency-graph-gradle-plugin:1.4.2` | `893A028475557671` | old | | `develocity-gradle-plugin:4.5.0` | `893A028475557671` | old | So the docs now list **both** keys instead of swapping one for the other. The Develocity Gradle plugin (`com.gradle`) is still signed with the old key, so replacing it outright would have broken Develocity injection for builds with dependency verification enabled. Docs-only change; no source or `dist` impact. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 (1M context) <[email protected]>v6.4.0 v6.4.0-rc.1 |
||
|
bot-githubaction
|
b031f6d1a9 | [bot] Update dist directory | ||
|
Daz DeBoerandClaude Opus 5
|
5bc4175609 |
Bump dependency-graph-gradle-plugin to 1.5.0 (#1069)
Updates the default version of the [GitHub Dependency Graph Gradle Plugin](https://plugins.gradle.org/plugin/org.gradle.github-dependency-graph-gradle-plugin) applied by the `dependency-submission` init-script from `1.4.2` to `1.5.0`. `1.5.0` is the latest version published to the Gradle Plugin Portal. Users can still override this via the `dependency-graph-plugin.version` input parameter (`DEPENDENCY_GRAPH_PLUGIN_VERSION`), so this only changes the default. ## Notes The init-script is read at runtime from `sources/src/resources` rather than being inlined into the bundle, so this single source change is the whole fix — no `dist` update is needed for the new version to take effect (CI refreshes `dist` as usual). ## Verification - `npm run check` (prettier + eslint) passes - `npm run test`: 489 passed. The 2 failing wrapper-validation suites are pre-existing network-dependent failures on this machine — confirmed identical on a clean tree with this change stashed - Confirmed `1.5.0` is published to the plugin portal (and that a bogus version 404s, so the check is meaningful) 🤖 Generated with [Claude Code](https://claude.com/claude-code) Co-authored-by: Claude Opus 5 (1M context) <[email protected]> |
||
|
|
f3ff59b4e4 |
Combined automated updates: wrapper checksums, npm dependencies, setup-java (#1070)
Combines three pending automated update PRs into a single pull request so they can be reviewed and merged together. Supersedes: - #1045 — Update known wrapper checksums - #1066 — Bump the npm-dependencies group in /sources (eslint 10.9.1 → 10.10.0, globals 17.11.0 → 17.12.0) - #1067 — Bump actions/setup-java from 5.7.0 to 6.0.0 in the github-actions group Each original commit is cherry-picked unchanged; there were no overlapping files or conflicts. ## Verification - `./build install` (clean install + format + lint + compile) passes. - `./build test`: 490/491 pass. The single failure is `wrapper-validation/checksums.test.ts › fetches wrapper jar checksums for snapshots`, a pre-existing network-dependent failure on this machine — it fails identically with `main`'s checksums file, so it is unrelated to these changes. - `dist/` is intentionally untouched; CI regenerates it. --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: bot-githubaction <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
Daz DeBoerandClaude Opus 5
|
7927085475 |
Update .tool-versions: node 24.18.0, gradle 9.7.1, java 17 (#1068)
The pins in `.tool-versions` had drifted well behind what CI and the Gradle wrappers use. One of them was not just stale but broken. ## node 24.3.0 → 24.18.0 CI runs `node-version: 24`, which resolves to a much newer 24.x. That gap is not harmless: it recently masked a real CI failure outright, because jest 30.5.0's breakage of nock interception reproduces on 24.18.0 but not on 24.3.0. A local run that passes is worth something again. Verified with a clean `./build install` and repeated `./build test` runs on both versions. Both show the same stable core of two failures — the network-dependent wrapper-validation checksum tests — plus an occasional third flake in the same area that varies between runs and between node versions. Nothing attributable to the bump. ## java liberica-11 → liberica-17 This pin was broken. The init-scripts wrapper is on Gradle 9.7.1, which refuses to run a build on JVM 11: ``` Gradle requires JVM 17 or later to run. Your build is currently configured to use JVM 11. ``` So `./build init-scripts` could not have worked with the pinned toolchain. `./gradlew --version` *does* start under JVM 11 and reports successfully, which is likely how the pin survived unnoticed — only an actual build fails. 17 matches what `ci-init-script-check.yml` provisions, so local runs mirror CI. Verified with a clean `./gradlew check` in `sources/test/init-scripts`: BUILD SUCCESSFUL in 3m57s. Java 21 was also tried and passes (3m53s), so moving further later is unblocked. 17 is chosen only to track CI. ## gradle 8.14.2 → 9.7.1 Follows the wrappers, which the workflow samples and init-scripts tests are now on. This matches how the file has been maintained before (e.g. "Use Gradle 8.14 everywhere"). Nothing in `./build` invokes the asdf gradle — every path goes through `./gradlew` — so this only keeps ad-hoc CLI use consistent. ## Notes `ci-check-and-unit-test.yml` still provisions `gradle-version: '8.14.2'` for its unit-test job. That may be equally stale, but it is a CI behaviour change rather than local tooling, so it is left alone here. One flaky run was seen while verifying: two `TestDevelocityInjection` cases against Gradle 6.0.1 failed once, then passed on re-run and on repeat clean builds. Unrelated to these version changes. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Co-authored-by: Claude Opus 5 (1M context) <[email protected]> |
||
|
bot-githubaction
|
c3897a4e73 | [bot] Update dist directory | ||
|
|
6b92be1905 |
Update dependencies (#1065)
Rolls the outstanding dependency updates into a single change, along with fixes for two breaking changes they brought with them. ## Gradle Wrapper 9.6.1 → 9.7.1 Updated in all five wrapped projects: `sources/test/init-scripts` and the `gradle-plugin`, `groovy-dsl`, `java-toolchain` and `kotlin-dsl` workflow samples. ## GitHub Actions - `actions/setup-java` v5.7.0 → v6.0.0 - `github/codeql-action/init` and `github/codeql-action/analyze` re-pinned to a newer v3.29.5 commit ## npm dependencies - `@typescript-eslint/eslint-plugin` 8.66.0 → 8.69.0 - `esbuild` 0.28.1 → 0.28.2 - `eslint` 10.8.0 → 10.9.1 - `globals` 17.9.0 → 17.11.0 `jest` stays at 30.4.2 and `@jest/globals` at 30.4.1 — see below. ## setup-java v6 needs signature verification disabled for EOL JDKs v6 enables `verify-signature` by default. Temurin 16 and 20 are EOL and publish no signatures, so the toolchain-detection job could no longer install them: ``` Java setup process failed due to: Input 'verify-signature' is enabled, but no signature URL was found for Temurin version 16.0.2+7. ``` Verification is disabled for those two steps only. The Java 17 and matrix steps still verify. ## jest is held at 30.4.x because 30.5.0 breaks nock jest 30.5.0 reworked the ESM module registry (ES modules keyed by full URL, modules shared across overlapping CommonJS/ESM graphs). nock ends up patching a different module instance than the one `@actions/http-client` reaches undici through, so it no longer intercepts anything: all five mocked tests in `short-lived-token.test.ts` silently hit the real network and resolve `null`. Two further tests in that file keep passing only vacuously — they assert `null`, which is also what an unintercepted request returns. Bisected on node 24.18.0, changing only the jest version: | jest | result | | --- | --- | | 30.5.0 | 5 failed, 38 passed | | 30.4.2 | 43 passed | nock 15.0.0 does not fix it, so this cannot be resolved by moving nock forward. The node version matters too: 24.3.0 masks the failure completely, which is why it reproduced only in CI. Because `jest` is an exactly-pinned direct devDependency, the pin by itself holds the entire test runtime at 30.4.x — `jest-cli`, `jest-runtime`, `jest-environment-node`, `@jest/core`, `@jest/transform`, `@jest/types`, `expect` and `jest-util` all resolve to 30.4.x with no `overrides` block. Nothing in the tree forces jest forward; only dependabot proposes it. So the constraint is expressed in `.github/dependabot.yml`, alongside the existing `typescript` and `@types/node` entries, ignoring `jest` and `@jest/globals` `>=30.5.0` with a comment recording when it can be lifted. `pretty-format` is left to float to 30.5.1 via the types-only `@types/jest`; it renders test output and has no bearing on nock or module resolution. 🤖 Generated with [Claude Code](https://claude.com/claude-code) --------- Signed-off-by: bot-githubaction <[email protected]> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: bot-githubaction <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Claude Opus 5 (1M context) <[email protected]> |
||
|
bot-githubaction
|
0d208da058 | [bot] Update dist directory | ||
|
|
e49d0a36a8 |
Report EOL and maintenance status for Gradle versions (#1057)
This PR reports the support status of every Gradle version used in a workflow: - **End-of-life** — two or more major versions behind the latest release. - **Out of date** — one major version behind the latest release, or more than two minor versions behind on the current major. The information is surfaced as job annotations and in the Job Summary: an icon beside the Gradle version in the build results table, and a message below it. | version kind | job annotation | version table | below the table | | ------ | ----- | ---- | --------- | | EOL | warning | ⚠️ | expandable section, pointing to the Gradle Security Subscription | | Out of date | notice | ℹ️ | one-line legend, pointing to the Gradle release lifecycle docs | | Current | none | — | — | A single expandable section covers every end-of-life version, naming them in its summary line and listing the affected release lines in its body. The upgrade legend likewise appears once per job, however many versions carry the info icon. Notes on what is deliberately *not* reported: - **Patch releases.** Only the major and minor version are considered, so being on `9.7.0` when `9.7.1` exists is not flagged. - **Pre-releases.** Release candidates, milestones and snapshots are never reported, so testing against a nightly or an RC produces no annotations. The latest Gradle release is determined from the wrapper checksum data already bundled with the action, so no network access is required. That data is refreshed weekly, and the two-minor grace band absorbs the lag. Note that the annotations are emitted independently of `add-job-summary`: setting it to `never` suppresses the Job Summary itself, but the warning and notice annotations remain. ### Examples The `demo-job-summary` workflow has a `support-status-eol-and-outdated` job that builds with three end-of-life versions (`6.9.4`, `7.4`, `7.6.6`), two out-of-date versions (`8.0.2`, `8.14.5`) and the current release, so all three statuses appear in one summary: * **Job Summary**: https://github.com/gradle/actions/actions/runs/34166688755#summary-101879071306 * **Annotations**: https://github.com/gradle/actions/actions/runs/34166688755/job/101879071306 (expand annotations) That workflow is never triggered automatically; run it manually against a branch to review the rendering. ### Implementation * Adds `GradleVersion`, parsing and ordering versions the same way Gradle's own `org.gradle.util.GradleVersion` does. This replaces the previous `versionIsAtLeast` helper and removes the `semver` dependency. * Adds `gradle-support-status.ts`, which owns the classification policy and both of its presentations (annotations and Job Summary section) behind a three-function API, so `job-summary.ts` only asks for the icon and the rendered block. ### Testing * Unit tests for version ordering, classification, the annotations and the rendered summary. * `integ-test-gradle-support-status.yml`, which derives its expected versions from the bundled release data so the assertions cannot drift from the action's own view, then asserts against the real job log. * The demo workflow job linked above, for reviewing the rendering by eye. Documented under [Build reporting](https://github.com/gradle/actions/blob/main/docs/setup-gradle.md#gradle-version-support-status) in `docs/setup-gradle.md`. --------- Co-authored-by: Louis Jacomet <[email protected]> Co-authored-by: Daz DeBoer <[email protected]> Co-authored-by: Claude Opus 5 (1M context) <[email protected]> |
||
|
Christoph Obexer
|
575435b1ea |
Use the root-qualified :wrapper task (#1064)
Replaces the unqualified `wrapper` task name with the root-project-qualified `:wrapper` in the two places this repo names it: - `.github/workflows/demo-job-summary.yml` — the kotlin-dsl sample invocation - `docs/wrapper-validation.md` — the guidance for regenerating an unverifiable `gradle-wrapper.jar` An unqualified `wrapper` matches the task in every project of a multi-project build. The root-qualified form is unambiguous, matches the gradle/gradle convention, and is required under Configure on Demand. Part of the org-wide rollout tracked in gradle/gradle-private#5228; original issue gradle/gradle#37761. Signed-off-by: Christoph Obexer <[email protected]> |
||
|
bot-githubaction
|
a27deee331 | [bot] Update dist directory | ||
|
Daz DeBoerandClaude Opus 5
|
02d4784b6e |
Relax Develocity access key format validation (#1061)
Develocity access keys have the format `server=key[;server=key]*`. The
short-lived-token code validated that format with:
```
/^([^;=\s]+=\w+)(;[^;=\s]+=\w+)*$/
```
This is too strict about `key`, and an OIDC token value fails it. There
were two independent problems:
1. `\w+` rejects the `.`, `-`, `_` and `=` padding a JWT contains.
2. Even had the regex passed, `parse` split each entry with
`hostKey.split('=')` and took `pair[1]`, so a key containing `=` would
have been **silently truncated** — a worse failure than rejection, since
the mangled key would then be sent to the server.
## Change
Drop `accessKeyRegexp` and the separate `isValid` gate; validate
structurally in `parse` instead, asserting only what is needed to split
the value:
- split on `;`, then split each entry on its **first** `=` only
- hostname: non-empty and free of whitespace (it cannot contain `=` or
`;` by construction)
- key: non-empty and free of whitespace — nothing else is assumed about
its shape
Two small intentional behaviour deltas beyond the fix:
- The whole value is now trimmed, so a trailing newline on a secret no
longer rejects the key. Internal whitespace still rejects.
- Empty entries (`host=key;`, `;host=key`) still reject, as before.
## Testing
Added cases to `short-lived-token.test.ts`: a JWT-shaped key value,
first-separator-only splitting (`host1=a=b==` → key `a=b==`),
surrounding-whitespace tolerance, a `raw()` round-trip preserving `==`
padding, and a table of nine rejection cases. 32 tests pass; prettier,
eslint and `./build` are clean.
🤖 Generated with [Claude Code](https://claude.com/claude-code)
---------
Co-authored-by: Claude Opus 5 (1M context) <[email protected]>
|
||
|
bot-githubaction
|
346a44564f | [bot] Update dist directory | ||
|
Daz DeBoerandClaude Sonnet 5
|
910b061d4d |
Add cache-provider: external to skip Gradle User Home caching (#1059)
Users relying on an external mechanism to save/restore Gradle User Home (e.g. Develocity Artifact Cache) previously had to set cache-disabled: true, which is confusing since caching isn't actually disabled — it's just not managed by this action — and the Job Summary misleadingly reported caching as "Disabled". cache-provider: external skips Gradle User Home restore/save (same as cache-disabled) but reports a distinct "External" status in the Job Summary, explaining that caching is handled by another provider. --------- Co-authored-by: Claude Sonnet 5 <[email protected]> |
||
|
bot-githubaction
|
4ca152ae04 | [bot] Update dist directory | ||
|
Daz DeBoerandClaude Sonnet 5
|
eed01f09d3 |
Add action heading to Gradle job summary (#1058)
Job summaries from setup-gradle/dependency-submission had no top-level heading, so they read poorly when another action's summary content lands in the same job. Name the action explicitly so the block is attributable when summaries are stacked. --------- Co-authored-by: Claude Sonnet 5 <[email protected]> |
||
|
dependabot[bot]
|
889dc537cf |
Bump the npm-dependencies group in /sources with 3 updates (#1038)
Bumps the npm-dependencies group in /sources with 3 updates: [@types/semver](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/semver), [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) and [globals](https://github.com/sindresorhus/globals). Updates `@types/semver` from 7.7.1 to 7.8.0 <details> <summary>Commits</summary> <ul> <li>See full diff in <a href="https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/semver">compare view</a></li> </ul> </details> <br /> Updates `@typescript-eslint/eslint-plugin` from 8.65.0 to 8.66.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/typescript-eslint/typescript-eslint/releases">@typescript-eslint/eslint-plugin's releases</a>.</em></p> <blockquote> <h2>v8.66.0</h2> <h2>8.66.0 (2026-08-03)</h2> <h3>🚀 Features</h3> <ul> <li><strong>typescript-estree:</strong> handle import.defer() as ImportExpression (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12609">#12609</a>)</li> </ul> <h3>🩹 Fixes</h3> <ul> <li><strong>eslint-plugin:</strong> [no-unnecessary-type-conversion] ignore shadowed built-ins (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12590">#12590</a>)</li> <li><strong>eslint-plugin:</strong> [prefer-nullish-coalescing] handle shadowed Boolean calls (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12591">#12591</a>)</li> <li><strong>eslint-plugin:</strong> [no-useless-default-assignment] don't report defaults used by other overloads (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12607">#12607</a>)</li> <li><strong>eslint-plugin:</strong> [no-unnecessary-type-parameters] check MappedType key remapping (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12588">#12588</a>)</li> <li><strong>eslint-plugin:</strong> [class-literal-property-style] preserve type annotations and don't drop decorators (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12617">#12617</a>)</li> <li><strong>website:</strong> list <code>onUnsupportedTypeScriptVersion</code> in parser options (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12585">#12585</a>)</li> </ul> <h3>❤️ Thank You</h3> <ul> <li>Evyatar Daud <a href="https://github.com/StyleShit"><code>@StyleShit</code></a></li> <li>Kirk Waiblinger <a href="https://github.com/kirkwaiblinger"><code>@kirkwaiblinger</code></a></li> <li>Steffen Schroeder</li> <li>송재욱</li> </ul> <p>See <a href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.66.0">GitHub Releases</a> for more information.</p> <p>You can read about our <a href="https://typescript-eslint.io/users/versioning">versioning strategy</a> and <a href="https://typescript-eslint.io/users/releases">releases</a> on our website.</p> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md">@typescript-eslint/eslint-plugin's changelog</a>.</em></p> <blockquote> <h2>8.66.0 (2026-08-03)</h2> <h3>🩹 Fixes</h3> <ul> <li><strong>eslint-plugin:</strong> [class-literal-property-style] preserve type annotations and don't drop decorators (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12617">#12617</a>)</li> <li><strong>eslint-plugin:</strong> [no-unnecessary-type-parameters] check MappedType key remapping (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12588">#12588</a>)</li> <li><strong>eslint-plugin:</strong> [no-useless-default-assignment] don't report defaults used by other overloads (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12607">#12607</a>)</li> <li><strong>eslint-plugin:</strong> [prefer-nullish-coalescing] handle shadowed Boolean calls (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12591">#12591</a>)</li> <li><strong>eslint-plugin:</strong> [no-unnecessary-type-conversion] ignore shadowed built-ins (<a href="https://redirect.github.com/typescript-eslint/typescript-eslint/pull/12590">#12590</a>)</li> </ul> <h3>❤️ Thank You</h3> <ul> <li>Evyatar Daud <a href="https://github.com/StyleShit"><code>@StyleShit</code></a></li> <li>송재욱</li> </ul> <p>See <a href="https://github.com/typescript-eslint/typescript-eslint/releases/tag/v8.66.0">GitHub Releases</a> for more information.</p> <p>You can read about our <a href="https://typescript-eslint.io/users/versioning">versioning strategy</a> and <a href="https://typescript-eslint.io/users/releases">releases</a> on our website.</p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/e51b11ba3ab31837762c675f62f0d4dcb1abc4fb"><code>e51b11b</code></a> chore(release): publish 8.66.0</li> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/20cb15e6dbed8f42b7857a75e34f96d231b95449"><code>20cb15e</code></a> chore(eslint-plugin): split prefer-optional-chain.test.ts in multiple files (...</li> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/780a8c52d54fcb6420232b2f53974959a9b26dff"><code>780a8c5</code></a> docs(eslint-plugin): [member-ordering] add lacking commas in default member t...</li> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/08dd427202e08de304cf172472e3a97de3f382cf"><code>08dd427</code></a> fix(eslint-plugin): [class-literal-property-style] preserve type annotations ...</li> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/6be25d3b45f189d0c71018fb4ba7a2c9be4e14de"><code>6be25d3</code></a> fix(eslint-plugin): [no-unnecessary-type-parameters] check MappedType key rem...</li> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/8826d0ebf7ff178afb6b0e72bf22d9132e4c83a2"><code>8826d0e</code></a> fix(eslint-plugin): [no-useless-default-assignment] don't report defaults use...</li> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/7aecc1c44e60bc4b47402ce63a79587746766d9f"><code>7aecc1c</code></a> fix(eslint-plugin): [prefer-nullish-coalescing] handle shadowed Boolean calls...</li> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/5ffa76049a0dd6c73ba9c0a7e8388ab1324f740f"><code>5ffa760</code></a> fix(eslint-plugin): [no-unnecessary-type-conversion] ignore shadowed built-in...</li> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/f282f84df6418d405c5fbaa4312bf6c951b34957"><code>f282f84</code></a> chore(eslint-plugin): fix all <code>eslint-plugin/require-test-error-positions</code> (#...</li> <li><a href="https://github.com/typescript-eslint/typescript-eslint/commit/c8cafa4ae9a0b57a64ba23659eba25a01301684a"><code>c8cafa4</code></a> docs: [unified-signatures] caveats regarding signatures merging (<a href="https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin/issues/12581">#12581</a>)</li> <li>See full diff in <a href="https://github.com/typescript-eslint/typescript-eslint/commits/v8.66.0/packages/eslint-plugin">compare view</a></li> </ul> </details> <br /> Updates `globals` from 17.8.0 to 17.9.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/sindresorhus/globals/releases">globals's releases</a>.</em></p> <blockquote> <h2>v17.9.0</h2> <ul> <li>Update globals (2026-08-01) (<a href="https://redirect.github.com/sindresorhus/globals/issues/348">#348</a>) 5a958ed</li> </ul> <hr /> <p><a href="https://github.com/sindresorhus/globals/compare/v17.8.0...v17.9.0">https://github.com/sindresorhus/globals/compare/v17.8.0...v17.9.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/sindresorhus/globals/commit/8e7b9358b190d26acca88cc2804707fbcd90a229"><code>8e7b935</code></a> 17.9.0</li> <li><a href="https://github.com/sindresorhus/globals/commit/5a958ed06064fb879b64416655109d8eaffd2611"><code>5a958ed</code></a> Update globals (2026-08-01) (<a href="https://redirect.github.com/sindresorhus/globals/issues/348">#348</a>)</li> <li>See full diff in <a href="https://github.com/sindresorhus/globals/compare/v17.8.0...v17.9.0">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |
||
|
dependabot[bot]
|
968aeb62d7 |
Bump the github-actions group across 3 directories with 6 updates (#1039)
Bumps the github-actions group with 5 updates in the / directory: | Package | From | To | | --- | --- | --- | | [gradle/actions/setup-gradle](https://github.com/gradle/actions) | `6.2.0` | `6.3.0` | | [github/codeql-action/init](https://github.com/github/codeql-action) | `4.37.4` | `4.37.5` | | [github/codeql-action/analyze](https://github.com/github/codeql-action) | `4.37.4` | `4.37.5` | | [actions/setup-java](https://github.com/actions/setup-java) | `5.6.0` | `5.7.0` | | [gradle/actions/wrapper-validation](https://github.com/gradle/actions) | `6.2.0` | `6.3.0` | Bumps the github-actions group with 1 update in the /.github/actions/build-dist directory: [actions/setup-node](https://github.com/actions/setup-node). Bumps the github-actions group with 1 update in the /.github/actions/init-integ-test directory: [actions/setup-java](https://github.com/actions/setup-java). Updates `gradle/actions/setup-gradle` from 6.2.0 to 6.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/gradle/actions/releases">gradle/actions/setup-gradle's releases</a>.</em></p> <blockquote> <h2>v6.3.0</h2> <h2>Highlights</h2> <h3>Enhanced Caching: Windows fixes and a cache-protocol bump</h3> <p>This release updates <code>gradle-actions-caching</code> to <strong>v1.0.0</strong> (up from v0.7.0), which fixes two significant caching defects, both most visible on Windows:</p> <ul> <li> <p><strong>Cache entries failed to store at all on Windows.</strong>. Every entry failed with <code>Path Validation Error: Path(s) specified in the action for caching do(es) not exist</code>, even though the Gradle User Home was fully intact. Nothing was stored, so every downstream job ran against an empty Gradle User Home. The cause was a nested, unpatched copy of <code>@actions/glob</code> combined with a silently swallowed <code>require()</code> in the bundle, which left Windows path separators unnormalized.</p> </li> <li> <p><strong>Cache cleanup deleted instrumented jars that were in use.</strong> A bug in key hashing for paths shorter than 64 characters made cleanup judge freshly created <code>caches/jars-9</code> entries as unused and remove them, so the <code>instrumented-jars</code> entry was never saved and every job re-instrumented its classpaths.</p> <p>Also included: cache entry names are now consistent between the save and restore reports — restore previously fell back to showing the raw glob pattern (e.g. <code>/home/runner/.gradle/caches/modules-*/files-*/*/*/*/*/</code>) instead of <code>dependencies</code>.</p> </li> </ul> <blockquote> <p>[!IMPORTANT] <strong>Existing cache entries are invalidated by this release.</strong> The cache protocol version was bumped to <code>v2</code>, so the first run after upgrading will be a cache miss and will repopulate the cache. No configuration changes are required.</p> </blockquote> <h3>Basic caching warns instead of failing silently</h3> <p>The basic (open-source) caching provider now emits a warning and reports <code>(Entry not saved: save failed)</code> in the Job Summary when a cache save fails, rather than reporting success (<a href="https://redirect.github.com/gradle/actions/issues/1028">#1028</a>).</p> <h3>Dependency submission works with Isolated Projects</h3> <p><code>dependency-submission</code> now disables Isolated Projects via a promoted property, so dependency graph generation works on builds that enable it (<a href="https://redirect.github.com/gradle/actions/issues/1025">#1025</a>). Thanks to <a href="https://github.com/reinsch82"><code>@reinsch82</code></a> for the contribution.</p> <h3>Updated defaults</h3> <ul> <li>Injected Develocity Gradle plugin: <strong>4.4.2 → 4.5.0</strong></li> <li>36 new known-good wrapper checksums added for <code>wrapper-validation</code></li> </ul> <h2>What's Changed</h2> <ul> <li>Render configuration-cache status in the caching Job Summary by <a href="https://github.com/bigdaz"><code>@bigdaz</code></a> in <a href="https://redirect.github.com/gradle/actions/pull/989">gradle/actions#989</a></li> <li>Update gradle-actions-caching library to v0.8.0 by <a href="https://github.com/bot-githubaction"><code>@bot-githubaction</code></a> in <a href="https://redirect.github.com/gradle/actions/pull/993">gradle/actions#993</a></li> <li>Support experimental project-entry caching (configuration-cache + build-logic) by <a href="https://github.com/bigdaz"><code>@bigdaz</code></a> in <a href="https://redirect.github.com/gradle/actions/pull/994">gradle/actions#994</a></li> <li>Update gradle-actions-caching library to v0.9.0 by <a href="https://github.com/bot-githubaction"><code>@bot-githubaction</code></a> in <a href="https://redirect.github.com/gradle/actions/pull/996">gradle/actions#996</a></li> <li>Disable Isolated Projects via promoted property in dependency-submission by <a href="https://github.com/reinsch82"><code>@reinsch82</code></a> in <a href="https://redirect.github.com/gradle/actions/pull/1025">gradle/actions#1025</a></li> <li>Add Windows coverage for caching via a new smoke-test suite by <a href="https://github.com/bigdaz"><code>@bigdaz</code></a> in <a href="https://redirect.github.com/gradle/actions/pull/1027">gradle/actions#1027</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/gradle/actions/commit/9c971963bec38e04b3d30dcc455b5382be2fdbfb"><code>9c97196</code></a> Bump the github-actions group across 2 directories with 9 updates (<a href="https://redirect.github.com/gradle/actions/issues/1024">#1024</a>)</li> <li><a href="https://github.com/gradle/actions/commit/760e4a476b57fc6216ff816bbd682e14f43f66ee"><code>760e4a4</code></a> Bump the npm-dependencies group across 1 directory with 2 updates (<a href="https://redirect.github.com/gradle/actions/issues/1037">#1037</a>)</li> <li><a href="https://github.com/gradle/actions/commit/73e4c4222be7ce7f3685c9277a9e698ea3a28534"><code>73e4c42</code></a> Update gradle-actions-caching library to v1.0.0 (<a href="https://redirect.github.com/gradle/actions/issues/1029">#1029</a>)</li> <li><a href="https://github.com/gradle/actions/commit/a9d14388b4a819d9b607d85c115000e421e46eec"><code>a9d1438</code></a> Add dependabot ignore rules for TypeScript 7.x and <code>@types/node</code> 25.x/26.x</li> <li><a href="https://github.com/gradle/actions/commit/68f37005d75fc0fdb3e66cc267d1f007b3de27d1"><code>68f3700</code></a> [bot] Update dist directory</li> <li><a href="https://github.com/gradle/actions/commit/5971332a8f9f37459fbe710cc8b2ec8f125cdf54"><code>5971332</code></a> Bump Gradle Wrapper to 9.6.1, wrapper checksums, and Develocity plugin to 4.5...</li> <li><a href="https://github.com/gradle/actions/commit/b5bc804016a397046a67d7f83089c374ff4af6a7"><code>b5bc804</code></a> [bot] Update dist directory</li> <li><a href="https://github.com/gradle/actions/commit/dcbab4e9198b2315584afbb3d582bdaa2a7aee42"><code>dcbab4e</code></a> Bump npm-dependencies group with TypeScript 6.0.3, <code>@types/node</code> 24.x, and secu...</li> <li><a href="https://github.com/gradle/actions/commit/ca8d95717f747a46ed048a911f0e8a348829aef1"><code>ca8d957</code></a> Move non-smoke restore-gradle-home tests back to the integ-test suite (<a href="https://redirect.github.com/gradle/actions/issues/1032">#1032</a>)</li> <li><a href="https://github.com/gradle/actions/commit/4318659b28d9d152a98ad848b621397f3e386420"><code>4318659</code></a> [bot] Update dist directory</li> <li>Additional commits viewable in <a href="https://github.com/gradle/actions/compare/3f131e8634966bd73d06cc69884922b02e6faf92...9c971963bec38e04b3d30dcc455b5382be2fdbfb">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/init` from 4.37.4 to 4.37.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/init's releases</a>.</em></p> <blockquote> <h2>v4.37.5</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/init's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.36.2 - 04 Jun 2026</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/d1ba80a13dd99fba24a470575428917156a28b43"><code>d1ba80a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4067">#4067</a> from github/update-v4.37.5-1cd4d01d5</li> <li><a href="https://github.com/github/codeql-action/commit/e74600b0d945db9734eb044f95cd43f34b773451"><code>e74600b</code></a> Update changelog for v4.37.5</li> <li><a href="https://github.com/github/codeql-action/commit/1cd4d01d58f636bbdbffbfd3c121b3446d07e9f3"><code>1cd4d01</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4061">#4061</a> from github/henrymercer/turbo-system</li> <li><a href="https://github.com/github/codeql-action/commit/d2bfc30bc3373a3ec945dc3f93bc8b8f07fa16b9"><code>d2bfc30</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4050">#4050</a> from github/mbg/status/registries</li> <li><a href="https://github.com/github/codeql-action/commit/68028fcb1605f3cdd37e4e1845c3f78af017a3ea"><code>68028fc</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4062">#4062</a> from github/sam-robson/migrate-enterprise-release-pat</li> <li><a href="https://github.com/github/codeql-action/commit/c29563eeaafbc75499c7bb0d74bf77b3506c1cbd"><code>c29563e</code></a> ci: use federated enterprise release PAT</li> <li><a href="https://github.com/github/codeql-action/commit/155e5229973b426bd1ae2f83bb1bf42417fa2a8f"><code>155e522</code></a> Link the PR from the changelog entry</li> <li><a href="https://github.com/github/codeql-action/commit/2d3b351ea6452a9b21346f8d64567e5b833924de"><code>2d3b351</code></a> Handle network errors when streaming the CodeQL bundle download</li> <li><a href="https://github.com/github/codeql-action/commit/5d3eb98e4a780bfe1a53f57fbdc278ea5da1274b"><code>5d3eb98</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4055">#4055</a> from github/dependabot/npm_and_yarn/npm-minor-203262...</li> <li><a href="https://github.com/github/codeql-action/commit/c5f739bd6460e096aaf40962517e46a846b8b6b1"><code>c5f739b</code></a> Merge branch 'main' into dependabot/npm_and_yarn/npm-minor-2032624187</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/f205ea1c3313d32999d8d6a48b4f6530d4437b38...d1ba80a13dd99fba24a470575428917156a28b43">compare view</a></li> </ul> </details> <br /> Updates `github/codeql-action/analyze` from 4.37.4 to 4.37.5 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/releases">github/codeql-action/analyze's releases</a>.</em></p> <blockquote> <h2>v4.37.5</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> </blockquote> </details> <details> <summary>Changelog</summary> <p><em>Sourced from <a href="https://github.com/github/codeql-action/blob/main/CHANGELOG.md">github/codeql-action/analyze's changelog</a>.</em></p> <blockquote> <h1>CodeQL Action Changelog</h1> <p>See the <a href="https://github.com/github/codeql-action/releases">releases page</a> for the relevant changes to the CodeQL CLI and language packs.</p> <h2>[UNRELEASED]</h2> <p>No user facing changes.</p> <h2>4.37.6 - 04 Aug 2026</h2> <ul> <li>Changed the default filepath for the new remote file address format that was introduced in CodeQL Action 4.37.0 / 3.37.0 to <code>.github/codeql-config.yml</code> to align it with the suggested path that is used elsewhere. <a href="https://redirect.github.com/github/codeql-action/pull/4070">#4070</a></li> </ul> <h2>4.37.5 - 03 Aug 2026</h2> <ul> <li>Fixed a bug where a network error while streaming the download of the CodeQL bundle could terminate the <code>init</code> Action instead of falling back to downloading the bundle before extracting it. <a href="https://redirect.github.com/github/codeql-action/pull/4061">#4061</a></li> </ul> <h2>4.37.4 - 29 Jul 2026</h2> <ul> <li>This version of the CodeQL Action adds support for the <code>tools</code> input for the <code>codeql-action/init</code> step to be specified using a <code>github-codeql-tools</code> <a href="https://docs.github.com/en/organizations/managing-organization-settings/managing-custom-properties-for-repositories-in-your-organization">repository property</a>. This feature will gradually be rolled out following the release of this version. Once rolled out, this allows for the CodeQL CLI version that is used in GitHub-managed workflows, such as Default Setup, to be set to a custom value. For example, customers who run into issues with rate limits when a new CodeQL CLI version is released can set the value to <code>toolcache</code> to always use the CodeQL CLI version that is available in the runner toolcache. For Advanced Setup workflows, the value provided for <code>tools</code> in the workflow definition always takes precedence unless the value of the repository property starts with <code>!</code>. <a href="https://redirect.github.com/github/codeql-action/pull/4037">#4037</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.2">2.26.2</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4051">#4051</a></li> </ul> <h2>4.37.3 - 22 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.37.2 - 21 Jul 2026</h2> <ul> <li>The new address format for the <code>config-file</code> input that was introduced in CodeQL Action 4.37.0 is now enabled by default. In addition to the format described there, the <code>remote=</code> prefix can now be used to explicitly indicate that the input refers to a remote file. All previous input formats continue to be accepted as well. <a href="https://redirect.github.com/github/codeql-action/pull/4023">#4023</a></li> <li>The CodeQL Action can now make use of <a href="https://docs.github.com/en/code-security/how-tos/secure-at-scale/configure-organization-security/manage-usage-and-access/giving-org-access-private-registries">configured private registries</a> in Default Setup to retrieve CodeQL configuration files from remote repositories that require authentication. This will allow customers to store their CodeQL configuration in a single repository that can then be referenced by Default Setup workflows in other repositories. We expect to roll this and other, related changes out to everyone in July. <a href="https://redirect.github.com/github/codeql-action/pull/4007">#4007</a></li> </ul> <h2>4.37.1 - 16 Jul 2026</h2> <ul> <li><em>Upcoming breaking change</em>: Add a deprecation warning for customers using CodeQL version 2.20.6 and earlier. These versions of CodeQL were discontinued on 1 July 2026 alongside GitHub Enterprise Server 3.16, and will be unsupported by the next minor release of the CodeQL Action. <a href="https://redirect.github.com/github/codeql-action/pull/3956">#3956</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.1">2.26.1</a>. <a href="https://redirect.github.com/github/codeql-action/pull/4019">#4019</a></li> </ul> <h2>4.37.0 - 08 Jul 2026</h2> <ul> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.26.0">2.26.0</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3995">#3995</a></li> <li>In addition to the existing input format, the <code>config-file</code> input for the <code>codeql-action/init</code> step will soon support a new <code>[owner/]repo[@ref][:path]</code> format. All components except the repository name are optional. If omitted, <code>owner</code> defaults to the same owner as the repository the analysis is running for, <code>ref</code> to <code>main</code>, and <code>path</code> to <code>.github/codeql-action.yaml</code>. Support for this format ships in this version of the CodeQL Action, but will only be enabled over the coming weeks. <a href="https://redirect.github.com/github/codeql-action/pull/3973">#3973</a></li> </ul> <h2>4.36.3 - 01 Jul 2026</h2> <p>No user facing changes.</p> <h2>4.36.2 - 04 Jun 2026</h2> <ul> <li>Cache CodeQL CLI version information across Actions steps. <a href="https://redirect.github.com/github/codeql-action/pull/3943">#3943</a></li> <li>Reduce requests while waiting for analysis processing by using exponential backoff when polling SARIF processing status. <a href="https://redirect.github.com/github/codeql-action/pull/3937">#3937</a></li> <li>Update default CodeQL bundle version to <a href="https://github.com/github/codeql-action/releases/tag/codeql-bundle-v2.25.6">2.25.6</a>. <a href="https://redirect.github.com/github/codeql-action/pull/3948">#3948</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/github/codeql-action/commit/d1ba80a13dd99fba24a470575428917156a28b43"><code>d1ba80a</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4067">#4067</a> from github/update-v4.37.5-1cd4d01d5</li> <li><a href="https://github.com/github/codeql-action/commit/e74600b0d945db9734eb044f95cd43f34b773451"><code>e74600b</code></a> Update changelog for v4.37.5</li> <li><a href="https://github.com/github/codeql-action/commit/1cd4d01d58f636bbdbffbfd3c121b3446d07e9f3"><code>1cd4d01</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4061">#4061</a> from github/henrymercer/turbo-system</li> <li><a href="https://github.com/github/codeql-action/commit/d2bfc30bc3373a3ec945dc3f93bc8b8f07fa16b9"><code>d2bfc30</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4050">#4050</a> from github/mbg/status/registries</li> <li><a href="https://github.com/github/codeql-action/commit/68028fcb1605f3cdd37e4e1845c3f78af017a3ea"><code>68028fc</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4062">#4062</a> from github/sam-robson/migrate-enterprise-release-pat</li> <li><a href="https://github.com/github/codeql-action/commit/c29563eeaafbc75499c7bb0d74bf77b3506c1cbd"><code>c29563e</code></a> ci: use federated enterprise release PAT</li> <li><a href="https://github.com/github/codeql-action/commit/155e5229973b426bd1ae2f83bb1bf42417fa2a8f"><code>155e522</code></a> Link the PR from the changelog entry</li> <li><a href="https://github.com/github/codeql-action/commit/2d3b351ea6452a9b21346f8d64567e5b833924de"><code>2d3b351</code></a> Handle network errors when streaming the CodeQL bundle download</li> <li><a href="https://github.com/github/codeql-action/commit/5d3eb98e4a780bfe1a53f57fbdc278ea5da1274b"><code>5d3eb98</code></a> Merge pull request <a href="https://redirect.github.com/github/codeql-action/issues/4055">#4055</a> from github/dependabot/npm_and_yarn/npm-minor-203262...</li> <li><a href="https://github.com/github/codeql-action/commit/c5f739bd6460e096aaf40962517e46a846b8b6b1"><code>c5f739b</code></a> Merge branch 'main' into dependabot/npm_and_yarn/npm-minor-2032624187</li> <li>Additional commits viewable in <a href="https://github.com/github/codeql-action/compare/f205ea1c3313d32999d8d6a48b4f6530d4437b38...d1ba80a13dd99fba24a470575428917156a28b43">compare view</a></li> </ul> </details> <br /> Updates `actions/setup-java` from 5.6.0 to 5.7.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-java/releases">actions/setup-java's releases</a>.</em></p> <blockquote> <h2>v5.7.0</h2> <h2>What's Changed</h2> <ul> <li>Fix npm audit failures on releases/v5 by <a href="https://github.com/brunoborges"><code>@brunoborges</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/1154">actions/setup-java#1154</a></li> <li>Backport <a href="https://redirect.github.com/actions/setup-java/issues/1151">#1151</a>: Fix missing wrapper cache distributions by <a href="https://github.com/brunoborges"><code>@brunoborges</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/1153">actions/setup-java#1153</a></li> <li>Deprecate legacy Adopt distributions in v5 by <a href="https://github.com/brunoborges"><code>@brunoborges</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/1186">actions/setup-java#1186</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-java/compare/v5.6.0...v5.7.0">https://github.com/actions/setup-java/compare/v5.6.0...v5.7.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-java/commit/b6effb05e454b25005698d916606bdc6ffcbf961"><code>b6effb0</code></a> Deprecate legacy Adopt distributions in v5 (<a href="https://redirect.github.com/actions/setup-java/issues/1186">#1186</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/e498d2a66a953492f322542257b22125c989b422"><code>e498d2a</code></a> Backport <a href="https://redirect.github.com/actions/setup-java/issues/1151">#1151</a>: Fix missing wrapper cache distributions (<a href="https://redirect.github.com/actions/setup-java/issues/1153">#1153</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/6a3384db745932178632d0e22b2bd28cad1678e6"><code>6a3384d</code></a> Fix npm audit failures on releases/v5 (<a href="https://redirect.github.com/actions/setup-java/issues/1154">#1154</a>)</li> <li>See full diff in <a href="https://github.com/actions/setup-java/compare/03ad4de0992f5dab5e18fcb136590ce7c4a0ac95...b6effb05e454b25005698d916606bdc6ffcbf961">compare view</a></li> </ul> </details> <br /> Updates `gradle/actions/wrapper-validation` from 6.2.0 to 6.3.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/gradle/actions/releases">gradle/actions/wrapper-validation's releases</a>.</em></p> <blockquote> <h2>v6.3.0</h2> <h2>Highlights</h2> <h3>Enhanced Caching: Windows fixes and a cache-protocol bump</h3> <p>This release updates <code>gradle-actions-caching</code> to <strong>v1.0.0</strong> (up from v0.7.0), which fixes two significant caching defects, both most visible on Windows:</p> <ul> <li> <p><strong>Cache entries failed to store at all on Windows.</strong>. Every entry failed with <code>Path Validation Error: Path(s) specified in the action for caching do(es) not exist</code>, even though the Gradle User Home was fully intact. Nothing was stored, so every downstream job ran against an empty Gradle User Home. The cause was a nested, unpatched copy of <code>@actions/glob</code> combined with a silently swallowed <code>require()</code> in the bundle, which left Windows path separators unnormalized.</p> </li> <li> <p><strong>Cache cleanup deleted instrumented jars that were in use.</strong> A bug in key hashing for paths shorter than 64 characters made cleanup judge freshly created <code>caches/jars-9</code> entries as unused and remove them, so the <code>instrumented-jars</code> entry was never saved and every job re-instrumented its classpaths.</p> <p>Also included: cache entry names are now consistent between the save and restore reports — restore previously fell back to showing the raw glob pattern (e.g. <code>/home/runner/.gradle/caches/modules-*/files-*/*/*/*/*/</code>) instead of <code>dependencies</code>.</p> </li> </ul> <blockquote> <p>[!IMPORTANT] <strong>Existing cache entries are invalidated by this release.</strong> The cache protocol version was bumped to <code>v2</code>, so the first run after upgrading will be a cache miss and will repopulate the cache. No configuration changes are required.</p> </blockquote> <h3>Basic caching warns instead of failing silently</h3> <p>The basic (open-source) caching provider now emits a warning and reports <code>(Entry not saved: save failed)</code> in the Job Summary when a cache save fails, rather than reporting success (<a href="https://redirect.github.com/gradle/actions/issues/1028">#1028</a>).</p> <h3>Dependency submission works with Isolated Projects</h3> <p><code>dependency-submission</code> now disables Isolated Projects via a promoted property, so dependency graph generation works on builds that enable it (<a href="https://redirect.github.com/gradle/actions/issues/1025">#1025</a>). Thanks to <a href="https://github.com/reinsch82"><code>@reinsch82</code></a> for the contribution.</p> <h3>Updated defaults</h3> <ul> <li>Injected Develocity Gradle plugin: <strong>4.4.2 → 4.5.0</strong></li> <li>36 new known-good wrapper checksums added for <code>wrapper-validation</code></li> </ul> <h2>What's Changed</h2> <ul> <li>Render configuration-cache status in the caching Job Summary by <a href="https://github.com/bigdaz"><code>@bigdaz</code></a> in <a href="https://redirect.github.com/gradle/actions/pull/989">gradle/actions#989</a></li> <li>Update gradle-actions-caching library to v0.8.0 by <a href="https://github.com/bot-githubaction"><code>@bot-githubaction</code></a> in <a href="https://redirect.github.com/gradle/actions/pull/993">gradle/actions#993</a></li> <li>Support experimental project-entry caching (configuration-cache + build-logic) by <a href="https://github.com/bigdaz"><code>@bigdaz</code></a> in <a href="https://redirect.github.com/gradle/actions/pull/994">gradle/actions#994</a></li> <li>Update gradle-actions-caching library to v0.9.0 by <a href="https://github.com/bot-githubaction"><code>@bot-githubaction</code></a> in <a href="https://redirect.github.com/gradle/actions/pull/996">gradle/actions#996</a></li> <li>Disable Isolated Projects via promoted property in dependency-submission by <a href="https://github.com/reinsch82"><code>@reinsch82</code></a> in <a href="https://redirect.github.com/gradle/actions/pull/1025">gradle/actions#1025</a></li> <li>Add Windows coverage for caching via a new smoke-test suite by <a href="https://github.com/bigdaz"><code>@bigdaz</code></a> in <a href="https://redirect.github.com/gradle/actions/pull/1027">gradle/actions#1027</a></li> </ul> <!-- raw HTML omitted --> </blockquote> <p>... (truncated)</p> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/gradle/actions/commit/9c971963bec38e04b3d30dcc455b5382be2fdbfb"><code>9c97196</code></a> Bump the github-actions group across 2 directories with 9 updates (<a href="https://redirect.github.com/gradle/actions/issues/1024">#1024</a>)</li> <li><a href="https://github.com/gradle/actions/commit/760e4a476b57fc6216ff816bbd682e14f43f66ee"><code>760e4a4</code></a> Bump the npm-dependencies group across 1 directory with 2 updates (<a href="https://redirect.github.com/gradle/actions/issues/1037">#1037</a>)</li> <li><a href="https://github.com/gradle/actions/commit/73e4c4222be7ce7f3685c9277a9e698ea3a28534"><code>73e4c42</code></a> Update gradle-actions-caching library to v1.0.0 (<a href="https://redirect.github.com/gradle/actions/issues/1029">#1029</a>)</li> <li><a href="https://github.com/gradle/actions/commit/a9d14388b4a819d9b607d85c115000e421e46eec"><code>a9d1438</code></a> Add dependabot ignore rules for TypeScript 7.x and <code>@types/node</code> 25.x/26.x</li> <li><a href="https://github.com/gradle/actions/commit/68f37005d75fc0fdb3e66cc267d1f007b3de27d1"><code>68f3700</code></a> [bot] Update dist directory</li> <li><a href="https://github.com/gradle/actions/commit/5971332a8f9f37459fbe710cc8b2ec8f125cdf54"><code>5971332</code></a> Bump Gradle Wrapper to 9.6.1, wrapper checksums, and Develocity plugin to 4.5...</li> <li><a href="https://github.com/gradle/actions/commit/b5bc804016a397046a67d7f83089c374ff4af6a7"><code>b5bc804</code></a> [bot] Update dist directory</li> <li><a href="https://github.com/gradle/actions/commit/dcbab4e9198b2315584afbb3d582bdaa2a7aee42"><code>dcbab4e</code></a> Bump npm-dependencies group with TypeScript 6.0.3, <code>@types/node</code> 24.x, and secu...</li> <li><a href="https://github.com/gradle/actions/commit/ca8d95717f747a46ed048a911f0e8a348829aef1"><code>ca8d957</code></a> Move non-smoke restore-gradle-home tests back to the integ-test suite (<a href="https://redirect.github.com/gradle/actions/issues/1032">#1032</a>)</li> <li><a href="https://github.com/gradle/actions/commit/4318659b28d9d152a98ad848b621397f3e386420"><code>4318659</code></a> [bot] Update dist directory</li> <li>Additional commits viewable in <a href="https://github.com/gradle/actions/compare/3f131e8634966bd73d06cc69884922b02e6faf92...9c971963bec38e04b3d30dcc455b5382be2fdbfb">compare view</a></li> </ul> </details> <br /> Updates `actions/setup-node` from 6.4.0 to 7.0.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-node/releases">actions/setup-node's releases</a>.</em></p> <blockquote> <h2>v7.0.0</h2> <h2>What's Changed</h2> <h3>Enhancements:</h3> <ul> <li>Add cache-primary-key and cache-matched-key as outputs by <a href="https://github.com/gowridurgad"><code>@gowridurgad</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1577">actions/setup-node#1577</a></li> <li>Migrate to ESM and upgrade dependencies by <a href="https://github.com/gowridurgad"><code>@gowridurgad</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1574">actions/setup-node#1574</a></li> </ul> <h3>Bug fixes:</h3> <ul> <li>Remove dummy NODE_AUTH_TOKEN export by <a href="https://github.com/gowridurgad"><code>@gowridurgad</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1558">actions/setup-node#1558</a></li> <li>Only use <code>mirrorToken</code> in <code>getManifest</code> if it's provided by <a href="https://github.com/deiga"><code>@deiga</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1548">actions/setup-node#1548</a></li> </ul> <h3>Documentation updates:</h3> <ul> <li>Add documentation for publishing to npm with Trusted Publisher (OIDC) by <a href="https://github.com/chiranjib-swain"><code>@chiranjib-swain</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1536">actions/setup-node#1536</a></li> <li>docs: Update restore-only cache documentation by <a href="https://github.com/priya-kinthali"><code>@priya-kinthali</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1550">actions/setup-node#1550</a></li> <li>docs: Update caching recommendations to mitigate cache poisoning risks by <a href="https://github.com/chiranjib-swain"><code>@chiranjib-swain</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1567">actions/setup-node#1567</a></li> </ul> <h3>Dependency update:</h3> <ul> <li>Upgrade <code>@actions/cache</code> to 5.1.0, log cache write denied by <a href="https://github.com/jasongin"><code>@jasongin</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1569">actions/setup-node#1569</a></li> </ul> <h2>New Contributors</h2> <ul> <li><a href="https://github.com/chiranjib-swain"><code>@chiranjib-swain</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-node/pull/1536">actions/setup-node#1536</a></li> <li><a href="https://github.com/deiga"><code>@deiga</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-node/pull/1548">actions/setup-node#1548</a></li> <li><a href="https://github.com/jasongin"><code>@jasongin</code></a> made their first contribution in <a href="https://redirect.github.com/actions/setup-node/pull/1569">actions/setup-node#1569</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-node/compare/v6...v7.0.0">https://github.com/actions/setup-node/compare/v6...v7.0.0</a></p> <h2>v6.5.0</h2> <h2>What's Changed</h2> <ul> <li>Update <code>@actions/cache</code> to 5.1.0 and add security overrides for undici and fast-xml-parser by <a href="https://github.com/HarithaVattikuti"><code>@HarithaVattikuti</code></a> in <a href="https://redirect.github.com/actions/setup-node/pull/1579">actions/setup-node#1579</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-node/compare/v6.4.0...v6.5.0">https://github.com/actions/setup-node/compare/v6.4.0...v6.5.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-node/commit/820762786026740c76f36085b0efc47a31fe5020"><code>8207627</code></a> Migrate to ESM and upgrade dependencies (<a href="https://redirect.github.com/actions/setup-node/issues/1574">#1574</a>)</li> <li><a href="https://github.com/actions/setup-node/commit/04be95cf3511ea51ebf9f224ddfb99cc7ab87cd4"><code>04be95c</code></a> Add cache-primary-key and cache-matched-key as outputs (<a href="https://redirect.github.com/actions/setup-node/issues/1577">#1577</a>)</li> <li><a href="https://github.com/actions/setup-node/commit/7c2c68d20d402ed6a201ada70a81341941093140"><code>7c2c68d</code></a> docs: Update caching recommendations to mitigate cache poisoning risks (<a href="https://redirect.github.com/actions/setup-node/issues/1567">#1567</a>)</li> <li><a href="https://github.com/actions/setup-node/commit/6a61c0375d66246de94630495909f12cf8dac84d"><code>6a61c03</code></a> Merge pull request <a href="https://redirect.github.com/actions/setup-node/issues/1569">#1569</a> from jasongin/update-actions-cache-5.1.0</li> <li><a href="https://github.com/actions/setup-node/commit/30eb73b41ded577900c1ebf968ef95cdf8f7434f"><code>30eb73b</code></a> Resolve high-severity audit issues</li> <li><a href="https://github.com/actions/setup-node/commit/4e1a87a501d0302f99e30e2748568adcb388d09f"><code>4e1a87a</code></a> Update dist</li> <li><a href="https://github.com/actions/setup-node/commit/360237f0c01778d0c17291f75c56d6feae4f7574"><code>360237f</code></a> Strict equality</li> <li><a href="https://github.com/actions/setup-node/commit/4f8aac5beb2f0854bc79651567a18c67eb0b9de3"><code>4f8aac5</code></a> Bump <code>@actions/cache</code> to 5.1.0, log cache write denied</li> <li><a href="https://github.com/actions/setup-node/commit/f4a67bbeca970f103397d3d2b9462cf787cd2980"><code>f4a67bb</code></a> Only use <code>mirrorToken</code> in <code>getManifest</code> if it's provided (<a href="https://redirect.github.com/actions/setup-node/issues/1548">#1548</a>)</li> <li><a href="https://github.com/actions/setup-node/commit/0355742c943ddb13ca8a6b700f824231caa91e75"><code>0355742</code></a> Remove dummy NODE_AUTH_TOKEN export (<a href="https://redirect.github.com/actions/setup-node/issues/1558">#1558</a>)</li> <li>Additional commits viewable in <a href="https://github.com/actions/setup-node/compare/48b55a011bda9f5d6aeb4c2d9c7362e8dae4041e...820762786026740c76f36085b0efc47a31fe5020">compare view</a></li> </ul> </details> <br /> Updates `actions/setup-java` from 5.6.0 to 5.7.0 <details> <summary>Release notes</summary> <p><em>Sourced from <a href="https://github.com/actions/setup-java/releases">actions/setup-java's releases</a>.</em></p> <blockquote> <h2>v5.7.0</h2> <h2>What's Changed</h2> <ul> <li>Fix npm audit failures on releases/v5 by <a href="https://github.com/brunoborges"><code>@brunoborges</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/1154">actions/setup-java#1154</a></li> <li>Backport <a href="https://redirect.github.com/actions/setup-java/issues/1151">#1151</a>: Fix missing wrapper cache distributions by <a href="https://github.com/brunoborges"><code>@brunoborges</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/1153">actions/setup-java#1153</a></li> <li>Deprecate legacy Adopt distributions in v5 by <a href="https://github.com/brunoborges"><code>@brunoborges</code></a> in <a href="https://redirect.github.com/actions/setup-java/pull/1186">actions/setup-java#1186</a></li> </ul> <p><strong>Full Changelog</strong>: <a href="https://github.com/actions/setup-java/compare/v5.6.0...v5.7.0">https://github.com/actions/setup-java/compare/v5.6.0...v5.7.0</a></p> </blockquote> </details> <details> <summary>Commits</summary> <ul> <li><a href="https://github.com/actions/setup-java/commit/b6effb05e454b25005698d916606bdc6ffcbf961"><code>b6effb0</code></a> Deprecate legacy Adopt distributions in v5 (<a href="https://redirect.github.com/actions/setup-java/issues/1186">#1186</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/e498d2a66a953492f322542257b22125c989b422"><code>e498d2a</code></a> Backport <a href="https://redirect.github.com/actions/setup-java/issues/1151">#1151</a>: Fix missing wrapper cache distributions (<a href="https://redirect.github.com/actions/setup-java/issues/1153">#1153</a>)</li> <li><a href="https://github.com/actions/setup-java/commit/6a3384db745932178632d0e22b2bd28cad1678e6"><code>6a3384d</code></a> Fix npm audit failures on releases/v5 (<a href="https://redirect.github.com/actions/setup-java/issues/1154">#1154</a>)</li> <li>See full diff in <a href="https://github.com/actions/setup-java/compare/03ad4de0992f5dab5e18fcb136590ce7c4a0ac95...b6effb05e454b25005698d916606bdc6ffcbf961">compare view</a></li> </ul> </details> <br /> Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`. [//]: # (dependabot-automerge-start) [//]: # (dependabot-automerge-end) --- <details> <summary>Dependabot commands and options</summary> <br /> You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot show <dependency name> ignore conditions` will show all of the ignore conditions of the specified dependency - `@dependabot ignore <dependency name> major version` will close this group update PR and stop Dependabot creating any more for the specific dependency's major version (unless you unignore this specific dependency's major version or upgrade to it yourself) - `@dependabot ignore <dependency name> minor version` will close this group update PR and stop Dependabot creating any more for the specific dependency's minor version (unless you unignore this specific dependency's minor version or upgrade to it yourself) - `@dependabot ignore <dependency name>` will close this group update PR and stop Dependabot creating any more for the specific dependency (unless you unignore this specific dependency or upgrade to it yourself) - `@dependabot unignore <dependency name>` will remove all of the ignore conditions of the specified dependency - `@dependabot unignore <dependency name> <ignore condition>` will remove the ignore condition of the specified dependency and ignore conditions </details> Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> |