clayburn opened a new pull request, #16613: URL: https://github.com/apache/grails-core/pull/16613
## Description Fixes #16346. CI builds were rejected with `403: Forbidden` when storing entries in the Apache Develocity remote build cache, so the cache was never populated. ASF Infra has now provisioned a Develocity access key with cache write access and stored it as the `GRAILS_DEVELOCITY_ACCESS_KEY` secret ([INFRA-28501](https://issues.apache.org/jira/browse/INFRA-28501)). ### Changes - **Use the new key through setup-gradle.** Every workflow now passes `secrets.GRAILS_DEVELOCITY_ACCESS_KEY` to the `develocity-access-key` input of `gradle/actions/setup-gradle`. setup-gradle exchanges it for a short-lived access token and exports that token to the build as `DEVELOCITY_ACCESS_KEY`, so the long-lived key never reaches the Gradle process. The Forge AWS deploy workflow, which previously passed no key, now does too. (`release-verify.yml` is left without a key on purpose: it verifies a release from a pristine environment.) - **Push only with credentials.** In every `settings.gradle` (root, `build-logic`, `grails-gradle`, `grails-forge`, `end-to-end`, `end-to-end/legacy-g7-command-plugin`), remote cache `push` is now enabled only when the `DEVELOCITY_ACCESS_KEY` environment variable is present, instead of whenever `CI` is set. Builds without credentials, such as pull requests from forks where secrets are unavailable, read from the cache but no longer attempt stores that get rejected. - **Groovy snapshot canary.** The canary init script read `GRAILS_DEVELOCITY_ACCESS_KEY`, which no workflow exports, so it never pushed to the cache. It now reads `DEVELOCITY_ACCESS_KEY`, consistent with the settings files. ### Verification Once CI runs from `apache/grails-core`, not this fork, the build scans should show remote cache stores succeeding instead of `403: Forbidden` (Performance → Build cache in the scan). -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
