Test with UNRELEASED gradle-actions-caching library v0.8.0-cc

Supplies develocityAccessToken / develocityServerUrl to the gated
project-entry caching feature, on the save path only. Restore stays ungated,
so it keeps passing no DevelocityConfig and the credentials remain undefined.

- cacheOptionsFrom gains an optional develocityConfig; when present it sets
  develocityServerUrl from getDevelocityUrl() and resolves develocityAccessToken
  via resolveAccessKeyForServer (fail-closed when the URL or matching key is
  absent).
- complete() takes a DevelocityConfig and passes it through to cacheOptionsFrom
  at the save call; setup()/restore continues to call cacheOptionsFrom with no
  DevelocityConfig.
- Both post actions (setup-gradle, dependency-submission) pass
  new DevelocityConfig() to complete().

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

.github/workflows/ci-check-and-unit-test.yml

@@ -26,7 +26,7 @@ jobs:
         cache-dependency-path: sources/package-lock.json
     - name: Setup Gradle
       # Use a released version to avoid breakages
-      uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+      uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
       env:
         ALLOWED_GRADLE_WRAPPER_CHECKSUMS: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 # Invalid wrapper jar used for testing
       with:

.github/workflows/ci-init-script-check.yml

@@ -43,7 +43,7 @@ jobs:
     - name: Setup Gradle
       if: steps.changes.outputs.any_changed == 'true' || github.event_name != 'pull_request'
       # Use a released version to avoid breakages
-      uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+      uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
       env:
         ALLOWED_GRADLE_WRAPPER_CHECKSUMS: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 # Invalid wrapper jar used for testing
     - name: Run integration tests

.github/workflows/ci-validate-wrappers.yml

@@ -12,6 +12,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10 # v6.0.3
-      - uses: gradle/actions/wrapper-validation@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+      - uses: gradle/actions/wrapper-validation@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
         with:
           allow-checksums: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855

sources/src/actions/dependency-submission/post.ts

@@ -1,6 +1,6 @@
 import * as setupGradle from '../../setup-gradle'
 
-import {CacheConfig, SummaryConfig} from '../../configuration'
+import {CacheConfig, DevelocityConfig, SummaryConfig} from '../../configuration'
 import {handlePostActionError} from '../../errors'
 import {forceExit} from '../../force-exit'
 
@@ -14,7 +14,7 @@ process.on('uncaughtException', e => handlePostActionError(e))
  */
 export async function run(): Promise<void> {
     try {
-        await setupGradle.complete(new CacheConfig(), new SummaryConfig())
+        await setupGradle.complete(new CacheConfig(), new DevelocityConfig(), new SummaryConfig())
     } catch (error) {
         handlePostActionError(error)
     }

sources/src/actions/setup-gradle/post.ts

@@ -1,7 +1,7 @@
 import * as setupGradle from '../../setup-gradle'
 import * as dependencyGraph from '../../dependency-graph'
 
-import {CacheConfig, DependencyGraphConfig, SummaryConfig} from '../../configuration'
+import {CacheConfig, DependencyGraphConfig, DevelocityConfig, SummaryConfig} from '../../configuration'
 import {handlePostActionError} from '../../errors'
 import {emitDeprecationWarnings, restoreDeprecationState} from '../../deprecation-collector'
 import {forceExit} from '../../force-exit'
@@ -19,7 +19,7 @@ export async function run(): Promise<void> {
         restoreDeprecationState()
         emitDeprecationWarnings()
 
-        if (await setupGradle.complete(new CacheConfig(), new SummaryConfig())) {
+        if (await setupGradle.complete(new CacheConfig(), new DevelocityConfig(), new SummaryConfig())) {
             // Only submit the dependency graphs once per job
             await dependencyGraph.complete(new DependencyGraphConfig())
         }

sources/src/cache-service.ts

@@ -8,6 +8,8 @@ export interface CacheOptions {
     strictMatch: boolean
     cleanup: string
     encryptionKey?: string
+    develocityAccessToken?: string
+    develocityServerUrl?: string
     includes: string[]
     excludes: string[]
 }
@@ -27,7 +29,18 @@ export type CacheCleanupStatus =
     | 'disabled-config-cache-hit'
     | 'disabled-readonly'
 
-export type ConfigurationCacheStatus = 'not-active' | 'restored' | 'not-restored' | 'restore-incomplete'
+// Mirrors ProjectCacheStatus in the gradle-actions-caching library. The first three are set on
+// restore (ungated); the rest on save, reflecting the opt-in + Develocity trial gate.
+export type ProjectCacheStatus =
+    | 'restore-incomplete'
+    | 'restored'
+    | 'not-restored'
+    | 'not-enabled'
+    | 'trial-expired'
+    | 'trial-not-licensed'
+    | 'not-stored-no-develocity-plugin'
+    | 'stored'
+    | 'stored-no-configuration-cache'
 
 export interface CacheEntryReport {
     entryName: string
@@ -49,7 +62,7 @@ export interface CacheEntryReport {
 export interface CacheReport {
     status: CacheStatus
     cleanup?: CacheCleanupStatus
-    configurationCache?: ConfigurationCacheStatus
+    projectCache?: ProjectCacheStatus
     entries: CacheEntryReport[]
 }
 

sources/src/caching-report.ts

@@ -1,4 +1,4 @@
-import {CacheCleanupStatus, CacheEntryReport, CacheReport, CacheStatus, ConfigurationCacheStatus} from './cache-service'
+import {CacheCleanupStatus, CacheEntryReport, CacheReport, CacheStatus, ProjectCacheStatus} from './cache-service'
 
 const DOCS = 'https://github.com/gradle/actions/blob/main/docs/setup-gradle.md'
 const DISTRIBUTION = 'https://github.com/gradle/actions/blob/main/DISTRIBUTION.md'
@@ -28,11 +28,19 @@ const CLEANUP_COPY: Record<CacheCleanupStatus, string> = {
     'disabled-readonly': `[Cache cleanup](${DOCS}#configuring-cache-cleanup) is always disabled when the cache is read-only.`
 }
 
-const CONFIG_CACHE_COPY: Record<ConfigurationCacheStatus, string> = {
-    'not-active': `Configuration cache state was not cached — set a [cache-encryption-key](${DOCS}#cache-encryption-key) to enable configuration-cache caching.`,
-    restored: `Configuration cache state was restored from the cache.`,
-    'not-restored': `Configuration cache state was not restored — no cached data was available (e.g. the first run for this cache key).`,
-    'restore-incomplete': `Configuration cache state was not restored — the Gradle User Home was not fully restored.`
+const PROJECT_CACHE_COPY: Record<ProjectCacheStatus, string> = {
+    // Restore (ungated).
+    'restore-incomplete': `Project state was not restored — the Gradle User Home was not fully restored.`,
+    restored: `Project state (build-logic and configuration cache) was restored from the cache.`,
+    'not-restored': `Project state was not restored — no cached data was available (e.g. the first run for this cache key).`,
+    // Save, Tier A gate. 'not-enabled' renders nothing (dropped by the .filter(Boolean) below).
+    'not-enabled': ``,
+    'trial-expired': `Project state was not cached — the Develocity caching trial has expired.`,
+    'trial-not-licensed': `Project state was not cached — a valid Develocity trial token is required.`,
+    // Save, post-gate outcomes.
+    'not-stored-no-develocity-plugin': `Project state was not cached — applying the Develocity plugin is required to cache build-logic and configuration-cache state.`,
+    stored: `Project state (build-logic and configuration cache) was saved to the cache.`,
+    'stored-no-configuration-cache': `Build-logic state was cached. Storing configuration-cache data requires a build running Gradle >= 8.6 and a [valid encryption key](${DOCS}#cache-encryption-key).`
 }
 
 /**
@@ -76,8 +84,9 @@ function renderCleanupLine(cleanup?: CacheCleanupStatus): string | undefined {
     return cleanup ? CLEANUP_COPY[cleanup] : undefined
 }
 
-function renderConfigCacheLine(configurationCache?: ConfigurationCacheStatus): string | undefined {
-    return configurationCache ? CONFIG_CACHE_COPY[configurationCache] : undefined
+function renderProjectCacheLine(projectCache?: ProjectCacheStatus): string | undefined {
+    // PROJECT_CACHE_COPY['not-enabled'] is '', which the .filter(Boolean) at the call site drops.
+    return projectCache ? PROJECT_CACHE_COPY[projectCache] : undefined
 }
 
 function renderProviderNote(providerNote?: ProviderNote): string | undefined {
@@ -99,10 +108,10 @@ function renderDetails(report: CacheReport): string {
         : `Entries: ${restored} restored, ${saved} saved - Expand for more details`
 
     const cleanup = report.status === 'enabled' ? renderCleanupLine(report.cleanup) : undefined
-    const configCache = renderConfigCacheLine(report.configurationCache)
+    const projectCache = renderProjectCacheLine(report.projectCache)
     const table = renderEntryTable(report.entries)
     const pre = `<pre>\n${renderEntryDetails(report.entries)}</pre>`
-    const body = [STATUS_COPY[report.status], cleanup, configCache, table, pre].filter(Boolean).join('\n\n')
+    const body = [STATUS_COPY[report.status], cleanup, projectCache, table, pre].filter(Boolean).join('\n\n')
 
     return `<details>
 <summary>${summary}</summary>

sources/src/develocity/short-lived-token.ts

@@ -174,3 +174,22 @@ export class DevelocityAccessCredentials {
         return this.accessKeyRegexp.test(allKeys)
     }
 }
+
+/**
+ * Resolve the access key that matches a given Develocity server, for use as the
+ * `develocityAccessToken` cache option. Returns `undefined` (fail-closed) when the access key is
+ * empty/malformed, the server URL is empty/unparseable, or no key matches the server's host.
+ */
+export function resolveAccessKeyForServer(accessKey: string, serverUrl: string): string | undefined {
+    const creds = DevelocityAccessCredentials.parse(accessKey)
+    if (!creds || !serverUrl) {
+        return undefined
+    }
+    let host: string
+    try {
+        host = new URL(serverUrl).hostname
+    } catch {
+        host = serverUrl // tolerate a bare hostname (no scheme)
+    }
+    return creds.keys.find(k => k.hostname === host)?.key
+}

sources/src/setup-gradle.ts

@@ -5,6 +5,7 @@ import * as path from 'path'
 import * as os from 'os'
 import * as jobSummary from './job-summary'
 import * as buildScan from './develocity/build-scan'
+import {resolveAccessKeyForServer} from './develocity/short-lived-token'
 
 import {loadBuildResults, markBuildResultsProcessed} from './build-results'
 import {getCacheService, getProviderNote} from './cache-service-loader'
@@ -54,7 +55,11 @@ export async function setup(
     return true
 }
 
-export async function complete(cacheConfig: CacheConfig, summaryConfig: SummaryConfig): Promise<boolean> {
+export async function complete(
+    cacheConfig: CacheConfig,
+    develocityConfig: DevelocityConfig,
+    summaryConfig: SummaryConfig
+): Promise<boolean> {
     if (!core.getState(GRADLE_SETUP_VAR)) {
         core.info('Gradle setup post-action only performed for first gradle/actions step in workflow.')
         return false
@@ -65,7 +70,11 @@ export async function complete(cacheConfig: CacheConfig, summaryConfig: SummaryC
 
     const gradleUserHome = core.getState(GRADLE_USER_HOME)
     const cacheService = await getCacheService(cacheConfig)
-    const cacheReport = await cacheService.save(gradleUserHome, buildResults, cacheOptionsFrom(cacheConfig))
+    const cacheReport = await cacheService.save(
+        gradleUserHome,
+        buildResults,
+        cacheOptionsFrom(cacheConfig, develocityConfig)
+    )
     await jobSummary.generateJobSummary(buildResults, cacheReport, getProviderNote(cacheConfig), summaryConfig)
 
     markBuildResultsProcessed()
@@ -75,7 +84,14 @@ export async function complete(cacheConfig: CacheConfig, summaryConfig: SummaryC
     return true
 }
 
-function cacheOptionsFrom(config: CacheConfig): CacheOptions {
+function cacheOptionsFrom(config: CacheConfig, develocityConfig?: DevelocityConfig): CacheOptions {
+    // Trial credentials are threaded only on the save path (when develocityConfig is provided).
+    // On restore they stay undefined, which is fine: project-entry restore is ungated.
+    const develocityServerUrl = develocityConfig?.getDevelocityUrl() || undefined
+    const develocityAccessToken =
+        develocityConfig && develocityServerUrl
+            ? resolveAccessKeyForServer(develocityConfig.getDevelocityAccessKey(), develocityServerUrl)
+            : undefined
     return {
         disabled: config.isCacheDisabled(),
         readOnly: config.isCacheReadOnly(),
@@ -84,6 +100,8 @@ function cacheOptionsFrom(config: CacheConfig): CacheOptions {
         strictMatch: config.isCacheStrictMatch(),
         cleanup: config.getCacheCleanupOption(),
         encryptionKey: config.getCacheEncryptionKey() || undefined,
+        develocityAccessToken,
+        develocityServerUrl,
         includes: config.getCacheIncludes(),
         excludes: config.getCacheExcludes()
     }

sources/test/jest/caching-report.test.ts

@@ -79,37 +79,52 @@ describe('renderCachingReport', () => {
         expect(md).toContain('<summary>Entries: 1 restored, 0 saved - Expand for more details</summary>')
     })
 
-    it('renders the configuration-cache status line inside the details', () => {
+    it('renders the project-cache status line inside the details', () => {
         const report: CacheReport = {
             status: 'enabled',
             cleanup: 'enabled',
-            configurationCache: 'restored',
+            projectCache: 'restored',
             entries: [entry()]
         }
         const md = renderCachingReport(report, ENHANCED)
 
         const detailsBody = md.slice(md.indexOf('</summary>'))
-        expect(detailsBody).toContain('Configuration cache state was restored from the cache.')
+        expect(detailsBody).toContain(
+            'Project state (build-logic and configuration cache) was restored from the cache.'
+        )
     })
 
-    it('explains an inactive configuration cache with a link to the encryption key docs', () => {
+    it('explains an omitted configuration cache with a link to the encryption key docs', () => {
         const report: CacheReport = {
             status: 'enabled',
             cleanup: 'enabled',
-            configurationCache: 'not-active',
+            projectCache: 'stored-no-configuration-cache',
             entries: [entry()]
         }
         const md = renderCachingReport(report, ENHANCED)
 
-        expect(md).toContain('Configuration cache state was not cached')
+        expect(md).toContain('Build-logic state was cached.')
         expect(md).toContain('#cache-encryption-key')
     })
 
-    it('omits the configuration-cache line when the status is absent', () => {
+    it('renders nothing for the not-enabled project-cache status', () => {
+        const report: CacheReport = {
+            status: 'enabled',
+            cleanup: 'enabled',
+            projectCache: 'not-enabled',
+            entries: [entry()]
+        }
+        const md = renderCachingReport(report, ENHANCED)
+
+        expect(md).not.toContain('Project state')
+        expect(md).not.toContain('Build-logic state')
+    })
+
+    it('omits the project-cache line when the status is absent', () => {
         const report: CacheReport = {status: 'enabled', cleanup: 'enabled', entries: [entry()]}
         const md = renderCachingReport(report, ENHANCED)
 
-        expect(md).not.toContain('Configuration cache state')
+        expect(md).not.toContain('Project state')
     })
 
     it('renders a compact disabled report with no note and no details', () => {

sources/test/jest/short-lived-token.test.ts

@@ -1,7 +1,7 @@
 import nock from "nock";
 import {describe, expect, it} from '@jest/globals'
 
-import {DevelocityAccessCredentials, getToken} from "../../src/develocity/short-lived-token";
+import {DevelocityAccessCredentials, getToken, resolveAccessKeyForServer} from "../../src/develocity/short-lived-token";
 
 describe('short lived tokens', () => {
     it('parse valid access key should return an object', async () => {
@@ -134,3 +134,37 @@ describe('short lived tokens with retry', () => {
             .toBeNull()
     })
 })
+
+describe('resolveAccessKeyForServer', () => {
+    it('returns the key matching the server host from a full URL', () => {
+        expect(resolveAccessKeyForServer('ge.example.com=key1;other=key2', 'https://ge.example.com')).toBe('key1')
+    })
+
+    it('matches on hostname, ignoring scheme, port and path', () => {
+        expect(resolveAccessKeyForServer('ge.example.com=key1', 'https://ge.example.com:8443/path')).toBe('key1')
+    })
+
+    it('tolerates a bare hostname with no scheme', () => {
+        expect(resolveAccessKeyForServer('ge.example.com=key1', 'ge.example.com')).toBe('key1')
+    })
+
+    it('selects the matching key when multiple are present', () => {
+        expect(resolveAccessKeyForServer('dev=key1;ge.example.com=key2', 'https://ge.example.com')).toBe('key2')
+    })
+
+    it('returns undefined when no key matches the server host', () => {
+        expect(resolveAccessKeyForServer('ge.example.com=key1', 'https://other.example.com')).toBeUndefined()
+    })
+
+    it('returns undefined for an empty server URL', () => {
+        expect(resolveAccessKeyForServer('ge.example.com=key1', '')).toBeUndefined()
+    })
+
+    it('returns undefined for an empty access key', () => {
+        expect(resolveAccessKeyForServer('', 'https://ge.example.com')).toBeUndefined()
+    })
+
+    it('returns undefined for a malformed access key', () => {
+        expect(resolveAccessKeyForServer('not-a-valid-access-key', 'https://ge.example.com')).toBeUndefined()
+    })
+})

sources/vendor/gradle-actions-caching/index.d.ts

@@ -37,6 +37,8 @@ export declare interface CacheOptions {
     strictMatch: boolean;
     cleanup: 'always' | 'on-success' | 'never';
     encryptionKey?: string;
+    develocityAccessToken?: string;
+    develocityServerUrl?: string;
     includes: string[];
     excludes: string[];
 }
@@ -45,12 +47,22 @@ export declare interface CacheOptions {
 export declare interface CacheReport {
     status: CacheStatus;
     cleanup?: CacheCleanupStatus;
+    projectCache?: ProjectCacheStatus;
     entries: CacheEntryReport[];
 }
 
 /** @public */
 export declare type CacheStatus = 'enabled' | 'read-only' | 'write-only' | 'disabled' | 'disabled-existing-home' | 'not-available';
 
+/**
+ * Status of project-entry caching (build-logic artifacts + configuration-cache data) for a run.
+ * The first three are set on restore (always ungated); the rest are set on save and reflect the
+ * two-tier gate (opt-in + Develocity trial, then encryption key + Gradle version). Still beta.
+ *
+ * @public
+ */
+declare type ProjectCacheStatus = 'restore-incomplete' | 'restored' | 'not-restored' | 'not-enabled' | 'trial-expired' | 'trial-not-licensed' | 'not-stored-no-develocity-plugin' | 'stored' | 'stored-no-configuration-cache';
+
 /** @public */
 export declare function restore(gradleUserHome: string, cacheOptions: CacheOptions): Promise<void>;
 

sources/vendor/gradle-actions-caching/package.json

@@ -1,6 +1,6 @@
 {
   "name": "gradle-actions-caching",
-  "version": "0.7.0",
+  "version": "0.8.0-cc",
   "type": "module",
   "main": "./index.js",
   "types": "./index.d.ts",