(beam) branch master updated: [CI] Make Gradle caches read-only for untrusted presubmit workflow runs (#40358)

[yhu]

This is an automated email from the ASF dual-hosted git repository.

Abacn pushed a commit to branch master
in repository https://gitbox.apache.org/repos/asf/beam.git


The following commit(s) were added to refs/heads/master by this push:
     new 7a40f365e05 [CI] Make Gradle caches read-only for untrusted presubmit 
workflow runs (#40358)
7a40f365e05 is described below

commit 7a40f365e0500f2dc029546058d945d8a56c8549
Author: Yi Hu <ya...@google.com>
AuthorDate: Wed Sep 30 14:27:11 2026 -0400

    [CI] Make Gradle caches read-only for untrusted presubmit workflow runs 
(#40358)
    
    - Set `cache-read-only` in `setup-environment-action` unless triggered by 
`push`, `schedule`, or a workflow rerun (`run_attempt > 1`).
    
    - Restrict remote Gradle build cache (`beam-cache.apache.org`) pushes to 
`push` and `schedule` events.
    
    - Re-enable Gradle cache in `beam_PreCommit_Java` and 
`beam_PreCommit_Java_Dataflow` workflows.
---
 .github/actions/setup-environment-action/action.yml | 1 +
 .github/workflows/beam_PreCommit_Java.yml           | 1 -
 .github/workflows/beam_PreCommit_Java_Dataflow.yml  | 1 -
 settings.gradle.kts                                 | 7 ++++++-
 4 files changed, 7 insertions(+), 3 deletions(-)

diff --git a/.github/actions/setup-environment-action/action.yml 
b/.github/actions/setup-environment-action/action.yml
index f25f9ed7bfc..5c2afb39437 100644
--- a/.github/actions/setup-environment-action/action.yml
+++ b/.github/actions/setup-environment-action/action.yml
@@ -98,6 +98,7 @@ runs:
       with:
         cache-disabled: ${{ inputs.disable-cache }}
         validate-wrappers: false
+        cache-read-only: ${{ !(github.event_name == 'schedule' || 
github.event_name == 'push' || github.run_attempt > 1) }}
     - name: Install Go
       if: ${{ inputs.go-version != '' }}
       uses: actions/setup-go@v6
diff --git a/.github/workflows/beam_PreCommit_Java.yml 
b/.github/workflows/beam_PreCommit_Java.yml
index 0d4e876b350..ddfbec257a1 100644
--- a/.github/workflows/beam_PreCommit_Java.yml
+++ b/.github/workflows/beam_PreCommit_Java.yml
@@ -183,7 +183,6 @@ jobs:
         uses: ./.github/actions/setup-environment-action
         with:
           python-version: default
-          disable-cache: true
       - name: run Java PreCommit script
         uses: ./.github/actions/gradle-command-self-hosted-action
         with:
diff --git a/.github/workflows/beam_PreCommit_Java_Dataflow.yml 
b/.github/workflows/beam_PreCommit_Java_Dataflow.yml
index febcf9ab3ff..b7693492393 100644
--- a/.github/workflows/beam_PreCommit_Java_Dataflow.yml
+++ b/.github/workflows/beam_PreCommit_Java_Dataflow.yml
@@ -90,7 +90,6 @@ jobs:
         uses: ./.github/actions/setup-environment-action
         with:
           python-version: default
-          disable-cache: true
       - name: Run Dataflow Worker tests
         uses: ./.github/actions/gradle-command-self-hosted-action
         with:
diff --git a/settings.gradle.kts b/settings.gradle.kts
index 33f7447f320..2681148095d 100644
--- a/settings.gradle.kts
+++ b/settings.gradle.kts
@@ -73,7 +73,12 @@ buildCache {
             password = System.getenv("GRADLE_ENTERPRISE_CACHE_PASSWORD")
         }
         isEnabled = 
!System.getenv("GRADLE_ENTERPRISE_CACHE_USERNAME").isNullOrBlank()
-        isPush = isCi && 
!System.getenv("GRADLE_ENTERPRISE_CACHE_USERNAME").isNullOrBlank()
+        isPush =
+            (isJenkinsBuild ||
+                (isGithubActionsBuild &&
+                    (System.getenv("GITHUB_EVENT_NAME") == "schedule" ||
+                        System.getenv("GITHUB_EVENT_NAME") == "push" ))) &&
+                
!System.getenv("GRADLE_ENTERPRISE_CACHE_USERNAME").isNullOrBlank()
     }
 }