Authenticate Develocity injection integ tests with workload identity (#1112 )

## Changes Follow-up to #1109. That PR left `suite-integ-test-other.yml` on `DV_SOLUTIONS_ACCESS_KEY`. `integ-test-inject-develocity.yml` now gets a GitHub OIDC token, in `solutions.develocity.cloud=<token>` form, from the same pre-step as #1109. The token goes where the access key went before: - **`inject-develocity`**: the `DEVELOCITY_ACCESS_KEY` / `GRADLE_ENTERPRISE_ACCESS_KEY` env var, set per matrix entry through `$GITHUB_ENV` - **`inject-develocity-with-access-key`**: the `develocity-access-key` input - **`inject-develocity-short-lived-token-failed`**: both env vars and the input - **`inject-develocity-with-access-key-from-input-actions`**: the `DEVELOCITY_ACCESS_KEY` env var setup-gradle exchanges the OIDC token at `/api/auth/token` the same way it exchanges an access key. The `DEVELOCITY_ACCESS_KEY` secret is removed from the reusable workflow. `id-token: write` is granted along the chain: `ci-integ-test*.yml` → `suite-integ-test-other.yml` → the jobs. Fork PRs are already skipped for these jobs. Part of gradle/dv#74660. After this merges, nothing in gradle/actions uses `DV_SOLUTIONS_ACCESS_KEY`. ## Verification - [ ] CI-integ-test on this PR: `develocity-injection` jobs green, Build Scans published to solutions.develocity.cloud
Bump Gradle Wrapper from 9.9.0 to 9.9.1 in /.github/workflow-samples/java-toolchain (#1123 )
2026-11-14 18:44:46 +00:00 · 2026-11-12 10:53:43 -06:00 · 2026-11-11 17:39:07 -06:00 · 2026-11-11 17:26:08 -06:00 · 2026-11-11 16:50:19 -06:00 · 2026-11-11 12:42:02 -06:00
17 changed files with 147 additions and 29 deletions
@@ -1,7 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=21bd5da2de49b642904077f38c0efdc7778e92b3ed0889392dca61b97e389607
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.8.2-bin.zip
+distributionSha256Sum=d8a18a7a841dd5df825d35a685fad6f2d7f12ac0c280e57b67c27b4a520ba228
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.9.1-bin.zip
 networkTimeout=10000
 retries=0
 retryBackOffMs=500
@@ -1,7 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=21bd5da2de49b642904077f38c0efdc7778e92b3ed0889392dca61b97e389607
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.8.2-bin.zip
+distributionSha256Sum=0b00b0ffe07c4d4789c12d4935a44a7057d55774b7540bd4a3f76f336deb177a
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.9.0-bin.zip
 networkTimeout=10000
 retries=0
 retryBackOffMs=500
@@ -1,7 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=21bd5da2de49b642904077f38c0efdc7778e92b3ed0889392dca61b97e389607
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.8.2-bin.zip
+distributionSha256Sum=d8a18a7a841dd5df825d35a685fad6f2d7f12ac0c280e57b67c27b4a520ba228
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.9.1-bin.zip
 networkTimeout=10000
 retries=0
 retryBackOffMs=500
@@ -1,7 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=21bd5da2de49b642904077f38c0efdc7778e92b3ed0889392dca61b97e389607
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.8.2-bin.zip
+distributionSha256Sum=d8a18a7a841dd5df825d35a685fad6f2d7f12ac0c280e57b67c27b4a520ba228
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.9.1-bin.zip
 networkTimeout=10000
 retries=0
 retryBackOffMs=500
@@ -14,6 +14,9 @@ permissions:

 jobs:
  check-format-and-unit-test:
+    permissions:
+      contents: read
+      id-token: write
    runs-on: ubuntu-latest

    steps:
@@ -36,13 +39,31 @@ jobs:
      run: |
        npm exec -y -- pacote extract @gradle-tech/[email protected] ~/.node_libraries/@gradle-tech/develocity-agent

+    - name: Get GitHub OIDC token for Develocity
+      id: develocity-oidc
+      shell: bash
+      run: |
+        if [ -z "$ACTIONS_ID_TOKEN_REQUEST_URL" ]; then
+          echo "::warning::No GitHub OIDC token available (e.g. PR from a fork), Develocity will not be authenticated"
+          exit 0
+        fi
+        token=$(curl -sSfG -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
+          --data-urlencode "audience=https://solutions.develocity.cloud" \
+          "$ACTIONS_ID_TOKEN_REQUEST_URL" | jq -r .value)
+        echo "::add-mask::$token"
+        # Exchange the OIDC token for a short-lived Develocity access token, for the Develocity npm agent that reads DEVELOCITY_ACCESS_KEY directly
+        access_token=$(curl -sSf --retry 3 -X POST -H "Authorization: Bearer $token" \
+          "https://solutions.develocity.cloud/api/auth/token?expiresInHours=2")
+        echo "::add-mask::$access_token"
+        echo "token-access-key=solutions.develocity.cloud=$access_token" >> "$GITHUB_OUTPUT"
+
    - name: Install npm dependencies
      run: |
        npm clean-install
      working-directory: sources
      env:
        NODE_OPTIONS: '-r @gradle-tech/develocity-agent/preload'
-        DEVELOCITY_ACCESS_KEY: '${{ secrets.DV_SOLUTIONS_ACCESS_KEY }}'
+        DEVELOCITY_ACCESS_KEY: '${{ steps.develocity-oidc.outputs.token-access-key }}'

    - name: Check formatting and compile
      run: |
@@ -51,7 +72,7 @@ jobs:
      working-directory: sources
      env:
        NODE_OPTIONS: '-r @gradle-tech/develocity-agent/preload'
-        DEVELOCITY_ACCESS_KEY: '${{ secrets.DV_SOLUTIONS_ACCESS_KEY }}'
+        DEVELOCITY_ACCESS_KEY: '${{ steps.develocity-oidc.outputs.token-access-key }}'

    - name: Run unit tests
      run: |
@@ -59,4 +80,4 @@ jobs:
      working-directory: sources
      env:
        NODE_OPTIONS: '-r @gradle-tech/develocity-agent/preload'
-        DEVELOCITY_ACCESS_KEY: '${{ secrets.DV_SOLUTIONS_ACCESS_KEY }}'
+        DEVELOCITY_ACCESS_KEY: '${{ steps.develocity-oidc.outputs.token-access-key }}'
@@ -37,6 +37,7 @@ jobs:
    permissions:
      contents: write
      actions: read
+      id-token: write
    needs: caching-integ-tests
    uses: ./.github/workflows/suite-integ-test-other.yml
    concurrency:
@@ -48,6 +48,7 @@ jobs:
    permissions:
      contents: write
      actions: read
+      id-token: write
    needs: caching-integ-tests
    uses: ./.github/workflows/suite-integ-test-other.yml
    concurrency:
@@ -20,6 +20,7 @@ jobs:
    if: github.repository == 'gradle/actions'
    permissions:
      contents: write
+      id-token: write
    runs-on: ubuntu-latest

    steps:
@@ -38,13 +39,31 @@ jobs:
      run: |
        npm exec -y -- pacote extract @gradle-tech/[email protected] ~/.node_libraries/@gradle-tech/develocity-agent

+    - name: Get GitHub OIDC token for Develocity
+      id: develocity-oidc
+      shell: bash
+      run: |
+        if [ -z "$ACTIONS_ID_TOKEN_REQUEST_URL" ]; then
+          echo "::warning::No GitHub OIDC token available (e.g. PR from a fork), Develocity will not be authenticated"
+          exit 0
+        fi
+        token=$(curl -sSfG -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
+          --data-urlencode "audience=https://solutions.develocity.cloud" \
+          "$ACTIONS_ID_TOKEN_REQUEST_URL" | jq -r .value)
+        echo "::add-mask::$token"
+        # Exchange the OIDC token for a short-lived Develocity access token, for the Develocity npm agent that reads DEVELOCITY_ACCESS_KEY directly
+        access_token=$(curl -sSf --retry 3 -X POST -H "Authorization: Bearer $token" \
+          "https://solutions.develocity.cloud/api/auth/token?expiresInHours=2")
+        echo "::add-mask::$access_token"
+        echo "token-access-key=solutions.develocity.cloud=$access_token" >> "$GITHUB_OUTPUT"
+
    - name: Install npm dependencies
      run: |
        npm clean-install
      working-directory: sources
      env:
        NODE_OPTIONS: '-r @gradle-tech/develocity-agent/preload'
-        DEVELOCITY_ACCESS_KEY: '${{ secrets.DV_SOLUTIONS_ACCESS_KEY }}'
+        DEVELOCITY_ACCESS_KEY: '${{ steps.develocity-oidc.outputs.token-access-key }}'

    - name: Build distribution
      run: |
@@ -54,7 +73,7 @@ jobs:
      env:
        NODE_OPTIONS: '-r @gradle-tech/develocity-agent/preload'
        DEVELOCITY_URL: 'https://solutions.develocity.cloud'
-        DEVELOCITY_ACCESS_KEY: '${{ secrets.DV_SOLUTIONS_ACCESS_KEY }}'
+        DEVELOCITY_ACCESS_KEY: '${{ steps.develocity-oidc.outputs.token-access-key }}'

    - name: Copy the generated sources/dist directory to the top-level dist
      run: |
@@ -259,6 +259,9 @@ jobs:

  develocity-access-key-set:
    needs: build-distribution
+    permissions:
+      contents: read
+      id-token: write
    runs-on: ubuntu-latest
    steps:
    - name: Checkout sources
@@ -266,10 +269,24 @@ jobs:
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

+    - name: Get GitHub OIDC token for Develocity
+      id: develocity-oidc
+      shell: bash
+      run: |
+        if [ -z "$ACTIONS_ID_TOKEN_REQUEST_URL" ]; then
+          echo "::warning::No GitHub OIDC token available (e.g. PR from a fork), Develocity will not be authenticated"
+          exit 0
+        fi
+        token=$(curl -sSfG -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
+          --data-urlencode "audience=https://solutions.develocity.cloud" \
+          "$ACTIONS_ID_TOKEN_REQUEST_URL" | jq -r .value)
+        echo "::add-mask::$token"
+        echo "access-key=solutions.develocity.cloud=$token" >> "$GITHUB_OUTPUT"
+
    - name: Setup Gradle
      uses: ./setup-gradle
      with:
-        develocity-access-key: ${{ secrets.DV_SOLUTIONS_ACCESS_KEY }}
+        develocity-access-key: ${{ steps.develocity-oidc.outputs.access-key }}
    - name: Build kotlin-dsl project
      working-directory: .github/workflow-samples/kotlin-dsl
      run: ./gradlew assemble
@@ -12,9 +12,6 @@ on:
      skip-dist:
        type: boolean
        default: false
-    secrets:
-      DEVELOCITY_ACCESS_KEY:
-        required: true

 env:
  SKIP_DIST: ${{ inputs.skip-dist }}
@@ -46,12 +43,14 @@ jobs:
          - plugin-version: '4.6.1'
            accessKeyEnv: DEVELOCITY_ACCESS_KEY
    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+      id-token: write
    env:
      DEVELOCITY_INJECTION_ENABLED: true
      DEVELOCITY_INJECTION_URL: https://solutions.develocity.cloud
      DEVELOCITY_INJECTION_DEVELOCITY_PLUGIN_VERSION: ${{ matrix.plugin-version }}
      DEVELOCITY_INJECTION_CCUD_PLUGIN_VERSION: '2.2.1'
-      ${{matrix.accessKeyEnv}}: ${{ secrets.DEVELOCITY_ACCESS_KEY }}

    steps:
    - name: Checkout sources
@@ -60,6 +59,19 @@ jobs:
      uses: ./.github/actions/init-integ-test
      with:
        java-version: ${{ matrix.java-version }}
+    - name: Get GitHub OIDC token for Develocity
+      id: develocity-oidc
+      shell: bash
+      run: |
+        if [ -z "$ACTIONS_ID_TOKEN_REQUEST_URL" ]; then
+          echo "::warning::No GitHub OIDC token available (e.g. PR from a fork), Develocity will not be authenticated"
+          exit 0
+        fi
+        token=$(curl -sSfG -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
+          --data-urlencode "audience=https://solutions.develocity.cloud" \
+          "$ACTIONS_ID_TOKEN_REQUEST_URL" | jq -r .value)
+        echo "::add-mask::$token"
+        echo "${{ matrix.accessKeyEnv }}=solutions.develocity.cloud=$token" >> "$GITHUB_ENV"
    - name: Setup Gradle
      id: setup-gradle
      uses: ./setup-gradle
@@ -104,6 +116,9 @@ jobs:
          - gradle: '5.6.4'
            java-version: 11
    runs-on: ${{ matrix.os }}
+    permissions:
+      contents: read
+      id-token: write
    steps:
      - name: Checkout sources
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -111,13 +126,26 @@ jobs:
        uses: ./.github/actions/init-integ-test
        with:
          java-version: ${{ matrix.java-version }}
+      - name: Get GitHub OIDC token for Develocity
+        id: develocity-oidc
+        shell: bash
+        run: |
+          if [ -z "$ACTIONS_ID_TOKEN_REQUEST_URL" ]; then
+            echo "::warning::No GitHub OIDC token available (e.g. PR from a fork), Develocity will not be authenticated"
+            exit 0
+          fi
+          token=$(curl -sSfG -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
+            --data-urlencode "audience=https://solutions.develocity.cloud" \
+            "$ACTIONS_ID_TOKEN_REQUEST_URL" | jq -r .value)
+          echo "::add-mask::$token"
+          echo "access-key=solutions.develocity.cloud=$token" >> "$GITHUB_OUTPUT"
      - name: Setup Gradle
        id: setup-gradle
        uses: ./setup-gradle
        with:
          cache-read-only: false # For testing, allow writing cache entries on non-default branches
          gradle-version: ${{ matrix.gradle }}
-          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
+          develocity-access-key: ${{ steps.develocity-oidc.outputs.access-key }}
          develocity-token-expiry: 1
      - name: Run Gradle build
        id: gradle
@@ -140,9 +168,6 @@ jobs:
      DEVELOCITY_INJECTION_URL: 'https://localhost:3333/'
      DEVELOCITY_INJECTION_DEVELOCITY_PLUGIN_VERSION: ${{ matrix.plugin-version }}
      DEVELOCITY_INJECTION_CCUD_PLUGIN_VERSION: '2.1'
-      # Access key also set as an env var, we want to check it does not leak
-      GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
-      DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
    strategy:
      fail-fast: false
      matrix:
@@ -160,6 +185,9 @@ jobs:
          - gradle: '5.6.4'
            java-version: 11
    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
    steps:
      - name: Checkout sources
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
@@ -167,13 +195,29 @@ jobs:
        uses: ./.github/actions/init-integ-test
        with:
          java-version: ${{ matrix.java-version }}
+      # Access key also set as an env var, we want to check it does not leak
+      - name: Get GitHub OIDC token for Develocity
+        id: develocity-oidc
+        shell: bash
+        run: |
+          if [ -z "$ACTIONS_ID_TOKEN_REQUEST_URL" ]; then
+            echo "::warning::No GitHub OIDC token available (e.g. PR from a fork), Develocity will not be authenticated"
+            exit 0
+          fi
+          token=$(curl -sSfG -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
+            --data-urlencode "audience=https://solutions.develocity.cloud" \
+            "$ACTIONS_ID_TOKEN_REQUEST_URL" | jq -r .value)
+          echo "::add-mask::$token"
+          echo "access-key=solutions.develocity.cloud=$token" >> "$GITHUB_OUTPUT"
+          echo "GRADLE_ENTERPRISE_ACCESS_KEY=solutions.develocity.cloud=$token" >> "$GITHUB_ENV"
+          echo "DEVELOCITY_ACCESS_KEY=solutions.develocity.cloud=$token" >> "$GITHUB_ENV"
      - name: Setup Gradle
        id: setup-gradle
        uses: ./setup-gradle
        with:
          gradle-version: ${{ matrix.gradle }}
          cache-read-only: false # For testing, allow writing cache entries on non-default branches
-          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
+          develocity-access-key: ${{ steps.develocity-oidc.outputs.access-key }}
      - name: Run Gradle build
        id: gradle
        working-directory: .github/workflow-samples/no-ge
@@ -184,8 +228,9 @@ jobs:
        run: "[ \"${GRADLE_ENTERPRISE_ACCESS_KEY}\" != \"\" ] || (echo 'GRADLE_ENTERPRISE_ACCESS_KEY is still supported in v3!'; exit 1)"

  inject-develocity-with-access-key-from-input-actions:
-    env:
-      DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
+    permissions:
+      contents: read
+      id-token: write
    strategy:
      fail-fast: false
      matrix:
@@ -210,6 +255,19 @@ jobs:
        uses: ./.github/actions/init-integ-test
        with:
          java-version: ${{ matrix.java-version }}
+      - name: Get GitHub OIDC token for Develocity
+        id: develocity-oidc
+        shell: bash
+        run: |
+          if [ -z "$ACTIONS_ID_TOKEN_REQUEST_URL" ]; then
+            echo "::warning::No GitHub OIDC token available (e.g. PR from a fork), Develocity will not be authenticated"
+            exit 0
+          fi
+          token=$(curl -sSfG -H "Authorization: Bearer $ACTIONS_ID_TOKEN_REQUEST_TOKEN" \
+            --data-urlencode "audience=https://solutions.develocity.cloud" \
+            "$ACTIONS_ID_TOKEN_REQUEST_URL" | jq -r .value)
+          echo "::add-mask::$token"
+          echo "DEVELOCITY_ACCESS_KEY=solutions.develocity.cloud=$token" >> "$GITHUB_ENV"
      - name: Setup Gradle
        id: setup-gradle
        uses: ./setup-gradle
@@ -22,11 +22,12 @@ jobs:

  develocity-injection:
    if: ${{ ! github.event.pull_request.head.repo.fork }}
+    permissions:
+      contents: read
+      id-token: write
    uses: ./.github/workflows/integ-test-inject-develocity.yml
    with:
      skip-dist: ${{ inputs.skip-dist }}
-    secrets:
-      DEVELOCITY_ACCESS_KEY: ${{ secrets.DV_SOLUTIONS_ACCESS_KEY }}

  gradle-support-status:
    permissions:
@@ -1,7 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=21bd5da2de49b642904077f38c0efdc7778e92b3ed0889392dca61b97e389607
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.8.2-bin.zip
+distributionSha256Sum=d8a18a7a841dd5df825d35a685fad6f2d7f12ac0c280e57b67c27b4a520ba228
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.9.1-bin.zip
 networkTimeout=10000
 retries=0
 retryBackOffMs=500
Author	SHA1	Message	Date
Iñaki Villar	445a164ce8	Authenticate Develocity injection integ tests with workload identity (#1112 ) ## Changes Follow-up to #1109. That PR left `suite-integ-test-other.yml` on `DV_SOLUTIONS_ACCESS_KEY`. `integ-test-inject-develocity.yml` now gets a GitHub OIDC token, in `solutions.develocity.cloud=<token>` form, from the same pre-step as #1109. The token goes where the access key went before: - `inject-develocity`: the `DEVELOCITY_ACCESS_KEY` / `GRADLE_ENTERPRISE_ACCESS_KEY` env var, set per matrix entry through `$GITHUB_ENV` - `inject-develocity-with-access-key`: the `develocity-access-key` input - `inject-develocity-short-lived-token-failed`: both env vars and the input - `inject-develocity-with-access-key-from-input-actions`: the `DEVELOCITY_ACCESS_KEY` env var setup-gradle exchanges the OIDC token at `/api/auth/token` the same way it exchanges an access key. The `DEVELOCITY_ACCESS_KEY` secret is removed from the reusable workflow. `id-token: write` is granted along the chain: `ci-integ-test*.yml` → `suite-integ-test-other.yml` → the jobs. Fork PRs are already skipped for these jobs. Part of gradle/dv#74660. After this merges, nothing in gradle/actions uses `DV_SOLUTIONS_ACCESS_KEY`. ## Verification - [ ] CI-integ-test on this PR: `develocity-injection` jobs green, Build Scans published to solutions.develocity.cloud	2026-11-12 10:53:43 -06:00
Iñaki Villar	fac0990588	Bump Gradle Wrapper from 9.9.0 to 9.9.1 in /.github/workflow-samples/java-toolchain (#1123 ) Bump Gradle Wrapper from 9.9.0 to 9.9.1. Release notes of Gradle 9.9.1 can be found here: https://docs.gradle.org/9.9.1/release-notes.html	2026-11-11 17:39:07 -06:00
Iñaki Villar	5ca09edddf	Bump Gradle Wrapper from 9.8.2 to 9.9.1 in /.github/workflow-samples/kotlin-dsl (#1124 ) Bump Gradle Wrapper from 9.8.2 to 9.9.1. Release notes of Gradle 9.9.1 can be found here: https://docs.gradle.org/9.9.1/release-notes.html	2026-11-11 17:26:08 -06:00
Iñaki Villar	a4182520b3	Bump Gradle Wrapper from 9.9.0 to 9.9.1 in /.github/workflow-samples/gradle-plugin (#1121 ) Bump Gradle Wrapper from 9.9.0 to 9.9.1. Release notes of Gradle 9.9.1 can be found here: https://docs.gradle.org/9.9.1/release-notes.html	2026-11-11 16:50:19 -06:00
Iñaki Villar	bfcb30cf34	Bump Gradle Wrapper from 9.9.0 to 9.9.1 in /sources/test/init-scripts (#1120 ) Bump Gradle Wrapper from 9.9.0 to 9.9.1. Release notes of Gradle 9.9.1 can be found here: https://docs.gradle.org/9.9.1/release-notes.html	2026-11-11 12:42:02 -06:00
bot-githubaction	031d955e6d	Bump Gradle Wrapper from 9.8.2 to 9.9.1. Release notes of Gradle 9.9.1 can be found here: https://docs.gradle.org/9.9.1/release-notes.html Signed-off-by: bot-githubaction <[email protected]>	2026-11-11 02:14:00 +00:00
bot-githubaction	ee2f5df6fa	Bump Gradle Wrapper from 9.9.0 to 9.9.1. Release notes of Gradle 9.9.1 can be found here: https://docs.gradle.org/9.9.1/release-notes.html Signed-off-by: bot-githubaction <[email protected]>	2026-11-11 02:13:09 +00:00
bot-githubaction	15e4fe97d0	Bump Gradle Wrapper from 9.9.0 to 9.9.1. Release notes of Gradle 9.9.1 can be found here: https://docs.gradle.org/9.9.1/release-notes.html Signed-off-by: bot-githubaction <[email protected]>	2026-11-11 02:12:18 +00:00
bot-githubaction	c2db668634	Bump Gradle Wrapper from 9.9.0 to 9.9.1. Release notes of Gradle 9.9.1 can be found here: https://docs.gradle.org/9.9.1/release-notes.html Signed-off-by: bot-githubaction <[email protected]>	2026-11-11 02:11:36 +00:00
Iñaki Villar	5a9182793c	Bump Gradle Wrapper from 9.8.2 to 9.9.0 in /.github/workflow-samples/gradle-plugin (#1116 ) Bump Gradle Wrapper from 9.8.2 to 9.9.0. Release notes of Gradle 9.9.0 can be found here: https://docs.gradle.org/9.9.0/release-notes.html	2026-11-10 17:26:16 -06:00
Iñaki Villar	b7deba1bb6	Bump Gradle Wrapper from 9.8.2 to 9.9.0 in /.github/workflow-samples/groovy-dsl (#1117 ) Bump Gradle Wrapper from 9.8.2 to 9.9.0. Release notes of Gradle 9.9.0 can be found here: https://docs.gradle.org/9.9.0/release-notes.html	2026-11-09 18:41:40 -06:00
Iñaki Villar	808476d4c7	Bump Gradle Wrapper from 9.8.2 to 9.9.0 in /.github/workflow-samples/java-toolchain (#1118 ) Bump Gradle Wrapper from 9.8.2 to 9.9.0. Release notes of Gradle 9.9.0 can be found here: https://docs.gradle.org/9.9.0/release-notes.html	2026-11-09 15:22:45 -06:00
Iñaki Villar	579b122e60	Bump Gradle Wrapper from 9.8.2 to 9.9.0 in /sources/test/init-scripts (#1115 ) Bump Gradle Wrapper from 9.8.2 to 9.9.0. Release notes of Gradle 9.9.0 can be found here: https://docs.gradle.org/9.9.0/release-notes.html	2026-11-09 14:10:15 -06:00
bot-githubaction	e85b2d6f6e	Bump Gradle Wrapper from 9.8.2 to 9.9.0. Release notes of Gradle 9.9.0 can be found here: https://docs.gradle.org/9.9.0/release-notes.html Signed-off-by: bot-githubaction <[email protected]>	2026-11-07 02:14:14 +00:00
bot-githubaction	d94be6b0be	Bump Gradle Wrapper from 9.8.2 to 9.9.0. Release notes of Gradle 9.9.0 can be found here: https://docs.gradle.org/9.9.0/release-notes.html Signed-off-by: bot-githubaction <[email protected]>	2026-11-07 02:13:46 +00:00
bot-githubaction	5fbd536b48	Bump Gradle Wrapper from 9.8.2 to 9.9.0. Release notes of Gradle 9.9.0 can be found here: https://docs.gradle.org/9.9.0/release-notes.html Signed-off-by: bot-githubaction <[email protected]>	2026-11-07 02:13:22 +00:00
bot-githubaction	f95d889790	Bump Gradle Wrapper from 9.8.2 to 9.9.0. Release notes of Gradle 9.9.0 can be found here: https://docs.gradle.org/9.9.0/release-notes.html Signed-off-by: bot-githubaction <[email protected]>	2026-11-07 02:12:34 +00:00
Iñaki Villar	96e7f85c08	Inline the OIDC token step and keep the existing assertions Use the same pre-step as #1109 instead of a composite action, drop the extra exchange check and the fake access key.	2026-11-05 11:28:41 -06:00
Iñaki Villar	f6e4f55eae	Test Develocity injection with workload identity instead of an access key The Develocity injection integration tests no longer use the long-lived DV_SOLUTIONS_ACCESS_KEY. The jobs that publish Build Scans pass a GitHub OIDC token as the access key, which setup-gradle exchanges for a short-lived token like any access key. The short-lived token failure job uses a fake access key.	2026-11-05 11:21:00 -06:00
Iñaki Villar	c8a326d857	Authenticate CI to Develocity with workload identity (#1109 ) ## Changes Moves the workflows that publish to solutions.develocity.cloud from the long-lived `DV_SOLUTIONS_ACCESS_KEY` to GitHub OIDC tokens, using Develocity workload identity. - `ci-check-and-unit-test.yml` and `ci-update-dist.yml`: the Develocity npm agent reads `DEVELOCITY_ACCESS_KEY` directly, and an OIDC token can't be used there. A pre-step mints the OIDC token and exchanges it at `/api/auth/token?expiresInHours=2`, the call setup-gradle makes, for a short-lived Develocity access token. The npm steps read it from `steps.develocity-oidc.outputs.token-access-key`. - `demo-job-summary.yml` (`develocity-access-key-set` job): a pre-step mints the OIDC token and passes it to `setup-gradle` as `develocity-access-key` in `host=token` form. setup-gradle exchanges it, the same as it does with an access key. Each job gets `id-token: write`. Pull requests from forks get no OIDC token, just as they get no secrets today: the step warns and exits cleanly, and the builds run unauthenticated. ## Not in this PR `suite-integ-test-other.yml` still passes `DV_SOLUTIONS_ACCESS_KEY` to `integ-test-inject-develocity.yml`. Those jobs test setup-gradle's own access-key handling: swapping a classic access key for a short-lived token, the `GRADLE_ENTERPRISE_ACCESS_KEY` variant, and not leaking the key when the exchange fails. Feeding them an OIDC token would still run the exchange, but would stop covering the classic access-key path. Should they keep a long-lived key on purpose? ## Verification - [x] CI-check-and-unit-test on this PR ([run 41095618008](https://github.com/gradle/actions/actions/runs/41095618008)): green, the OIDC token is exchanged, and the npm agent published Build Scans to solutions.develocity.cloud, for example [ejvi6m5cprrhg](https://solutions.develocity.cloud/s/ejvi6m5cprrhg) and [goncdygtosovo](https://solutions.develocity.cloud/s/goncdygtosovo) - [x] Demo Job Summary dispatched on this branch ([run 41095628373](https://github.com/gradle/actions/actions/runs/41095628373)), `develocity-access-key-set` job: green, setup-gradle logs `Requesting short-lived Develocity access token for solutions.develocity.cloud` with no warning. The sample project publishes to scans.gradle.com, as before. - [ ] CI-update-dist runs only on `main`/release branches and commits `dist`, so it is verified after merge	2026-10-30 11:08:40 -07:00
Inaki Villar	8e84bbf095	Authenticate CI to Develocity with workload identity The npm builds and the demo job summary used the long-lived DV_SOLUTIONS_ACCESS_KEY. They now mint a GitHub OIDC token for solutions.develocity.cloud. The npm agent reads DEVELOCITY_ACCESS_KEY directly, so for it the token is exchanged for a short-lived Develocity access token first. Signed-off-by: Inaki Villar <[email protected]>	2026-10-30 10:04:20 -07:00