clayburn opened a new pull request, #40551: URL: https://github.com/apache/beam/pull/40551
Addresses [INFRA-28474](https://issues.apache.org/jira/browse/INFRA-28474). The remote Gradle build cache at `beam-cache.apache.org` has been returning `403 Forbidden` since its credentials were revoked, so CI builds get no remote cache hits. That cache is a Develocity Build Cache Node, which is reaching end of life, so rather than restore its credentials this PR moves the remote cache to the Develocity build cache connector. Builds then use the built-in Edge node of `develocity.apache.org`, the same server Beam already publishes Build Scans to under the `beam` project. ### Changes **`settings.gradle.kts`** - Replace the `HttpBuildCache` pointing at `beam-cache.apache.org` with `remote(develocity.buildCache)`. - **Reads:** enabled for every build, including pull requests and local builds. The cache on `develocity.apache.org` is anonymously readable, so no credentials are needed. - **Writes:** only CI `push` and `schedule` runs that have a Develocity access key. This keeps the rule from #40358 that unmerged code never writes to the remote cache. - Remove Jenkins detection, since Beam CI no longer runs on Jenkins. **Workflows (308 files, mechanical)** - `DEVELOCITY_ACCESS_KEY` now comes from the `BEAM_DEVELOCITY_ACCESS_KEY` secret that Apache Infra created for the `beam` project. - Remove `GRADLE_ENTERPRISE_CACHE_USERNAME`/`GRADLE_ENTERPRISE_CACHE_PASSWORD`. The `GE_CACHE_USERNAME` and `GE_CACHE_PASSWORD` secrets are no longer used and can be deleted. ### Security - No workflow that receives the secret is triggered by `pull_request_target` or `issue_comment`, and fork PRs do not receive secrets, so untrusted code never sees the key. - The key goes only to builds of trusted code, and `isPush` further limits those builds to writing to the cache only on `push` and `schedule` events. ------------------------ Thank you for your contribution! Follow this checklist to help us incorporate your contribution quickly and easily: - [ ] If this contribution is large, please file an Apache [Individual Contributor License Agreement](https://www.apache.org/licenses/icla.pdf). _(Not large: one settings change plus a mechanical secret rename.)_ - [x] Replace these instructions with a description of your change and why you have made it. - [x] Mention the appropriate issue in your description (for example: `addresses #123` or `fixes #456`). - [ ] Update `CHANGES.md` with noteworthy changes. _(CI-only change with no user-facing impact.)_ See [CONTRIBUTING.md](https://github.com/apache/beam/blob/master/CONTRIBUTING.md) for more details. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
