ci(GitHub): Bump gradle/actions from 3 to 4

[dependabot]

Bumps gradle/actions from 3 to 4.

Release notes

Sourced from gradle/actions's releases.

v4.0.0

Final release of v4.0.0 of the setup-gradle, dependency-submission and wrapper-validation actions provided under gradle/actions. This release is available under the v4 tag.

Major changes from the v3 release

The arguments parameter has been removed

Using the action to execute Gradle via the arguments parameter was deprecated in v3 and this parameter has been removed. See here for more details.

Cache cleanup enabled by default

After a number of fixes and improvements, this release enables cache-cleanup by default for all Jobs using the setup-gradle and dependency-submission actions.

Improvements and bugfixes related cache cleanup:

• By default, cache cleanup is not run if any Gradle build fails (#71)
• Cache cleanup is not run after configuration-cache reuse (#19)

This feature should help to minimize the size of entries written to the GitHub Actions cache, speeding up builds and reducing cache usage.

Wrapper validation enabled by default

In v3, the setup-gradle action was enhanced to support Gradle wrapper validation, removing the need to use a separate workflow file with the gradle/actions/wrapper-validation action.

With this release, wrapper validation has been significantly improved, and is now enabled by default (#12):

• The allow-snapshot-wrappers makes it possible to validate snapshot wrapper jars using setup-gradle.
• Checksums for nightly and snapshot Gradle versions are now validated (#281).
• Valid wrapper checksums are cached in Gradle User Home, reducing the need to retrieve checksum values remotely (#172).
• Reduce network calls in wrapper-validation for new Gradle versions: By only fetching wrapper checksums for Gradle versions that were not known when this action was released, this release reduces the likelihood that a network failure could cause failure in wrapper validation (#171)
• Improved error message when wrapper-validation finds no wrapper jars (#284)

Wrapper validation is important for supply-chain integrity. Enabling this feature by default will increase the coverage of wrapper validation on projects using GitHub Actions.

New input parameters for Dependency Graph generation

Some dependency-graph inputs that could previously only be configured via environment variables now have dedicated action inputs:

• dependency-graph-report-dir: sets the location where dependency-graph reports will be generated
• dependency-graph-exclude-projects and dependency-graph-include-projects: select which Gradle projects will contribute to the generated dependency graph.
• dependency-graph-exclude-configurations and dependency-graph-include-configurations: select which Gradle configurations will contribute to the generated dependency graph.

Other improvements

• In Job summary, the action now provides an explanation when cache is set to read-only or disabled (#255)
• When setup-gradle requests a specific Gradle version, the action will no longer download and install that version if it is already available on the PATH of the runner (#270)
• To attempt to speed up builds, the setup-gradle and dependency-submission actions now attempt to use the D: drive for Gradle User Home if it is available (#290)

Deprecations and breaking changes

... (truncated)

Commits

• 16bf8bc Rework docs for Develocity support
• faf4eea [bot] Update dist directory
• 4b7cc6e Differentiate Gradle 8.1 from 8.10 when checking version (#358)
• 0873530 Increase Gradle version coverage for init-scripts
• f67327f [bot] Update dist directory
• d32a10b Dependency updates (#356)
• e598a32 Quote version 8.10 in integ test
• d6c8cf8 Bump unzip-stream from 0.3.1 to 0.3.4 in /sources
• 79ea5b8 Bump org.junit.jupiter:junit-jupiter
• d77a030 Bump com.google.guava:guava in /.github/workflow-samples/kotlin-dsl
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Summary by CodeRabbit

• New Features

  • Upgraded the Gradle setup action to version 4 in multiple workflow configurations, enhancing the build and setup process in the CI/CD pipeline.

• Bug Fixes

  • Improved build performance and compatibility with the latest Gradle features through the action upgrade.

[coderabbitai]

Walkthrough

Walkthrough

The changes involve updating the Gradle setup action version in multiple GitHub Actions workflow files from v3 to v4. This update is consistent across the build.yml, pr-baseline.yml, and release.yml files, indicating a unified enhancement to the Gradle setup process within the CI/CD pipeline.

Changes

Files	Change Summary
.github/workflows/build.yml,	Updated Gradle setup action from gradle/actions/setup-gradle@v3 to gradle/actions/setup-gradle@v4.
.github/workflows/pr-baseline.yml,	Updated Gradle setup action from gradle/actions/setup-gradle@v3 to gradle/actions/setup-gradle@v4.
.github/workflows/release.yml	Updated Gradle setup action from gradle/actions/setup-gradle@v3 to gradle/actions/setup-gradle@v4.

Poem

🐇 In the meadow where the bunnies play,
We hop with joy on this fine day!
Gradle's new version, oh what a thrill,
Builds will be faster, with more skill!
Let's dance and twirl, our hearts so light,
Cheers to the changes, everything feels right! 🥳

---

Thank you for using CodeRabbit. We offer it for free to the OSS community and would appreciate your support in helping us grow. If you find it useful, would you consider giving us a shout-out on your favorite social media?

Share

• X
• Mastodon
• Reddit
• LinkedIn

Tips

Chat

There are 3 ways to chat with CodeRabbit:

• Review comments: Directly reply to a review comment made by CodeRabbit. Example:
  • I pushed a fix in commit <commit_id>.
  • Generate unit testing code for this file.
  • Open a follow-up GitHub issue for this discussion.
• Files and specific lines of code (under the "Files changed" tab): Tag @coderabbitai in a new review comment at the desired location with your query. Examples:
  • @coderabbitai generate unit testing code for this file.
  • @coderabbitai modularize this function.
• PR comments: Tag @coderabbitai in a new PR comment to ask questions about the PR branch. For the best results, please provide a very specific query, as very limited context is provided in this mode. Examples:
  • @coderabbitai generate interesting stats about this repository and render them as a table.
  • @coderabbitai show all the console.log statements in this repository.
  • @coderabbitai read src/utils.ts and generate unit testing code.
  • @coderabbitai read the files in the src/scheduler package and generate a class diagram using mermaid and a README in the markdown format.
  • @coderabbitai help me debug CodeRabbit configuration file.

Note: Be mindful of the bot's finite context window. It's strongly recommended to break down tasks such as reading entire modules into smaller chunks. For a focused discussion, use review comments to chat about specific files and their changes, instead of using the PR comments.

CodeRabbit Commands (Invoked using PR comments)

• @coderabbitai pause to pause the reviews on a PR.
• @coderabbitai resume to resume the paused reviews.
• @coderabbitai review to trigger an incremental review. This is useful when automatic reviews are disabled for the repository.
• @coderabbitai full review to do a full review from scratch and review all the files again.
• @coderabbitai summary to regenerate the summary of the PR.
• @coderabbitai resolve resolve all the CodeRabbit review comments.
• @coderabbitai configuration to show the current CodeRabbit configuration for the repository.
• @coderabbitai help to get help.

Other keywords and placeholders

• Add @coderabbitai ignore anywhere in the PR description to prevent this PR from being reviewed.
• Add @coderabbitai summary to generate the high-level summary at a specific location in the PR description.
• Add @coderabbitai or @coderabbitai title anywhere in the PR title to generate the title automatically.

CodeRabbit Configuration File (.coderabbit.yaml)

• You can programmatically configure CodeRabbit by adding a .coderabbit.yaml file to the root of your repository.
• Please see the configuration documentation for more information.
• If your editor has YAML language server enabled, you can add the path at the top of this file to enable auto-completion and validation: # yaml-language-server: $schema=https://coderabbit.ai/integrations/schema.v2.json

Documentation and Community

• Visit our Documentation for detailed information on how to use CodeRabbit.
• Join our Discord Community to get help, request features, and share feedback.
• Follow us on X/Twitter for updates and announcements.

[github-actions]

🔄 Baseline update started...

[github-actions]

❌ Baseline update failed!

[coderabbitai]

Actionable comments posted: 0

Review details

Configuration used: CodeRabbit UI
Review profile: ASSERTIVE

Commits

Files that changed from the base of the PR and between 61fa441 and cb17a9a.

Files selected for processing (3)

• .github/workflows/build.yml (1 hunks)
• .github/workflows/pr-baseline.yml (1 hunks)
• .github/workflows/release.yml (1 hunks)

Additional comments not posted (3)

.github/workflows/release.yml (1)

84-84: LGTM! Verify if the new features and improvements are applicable.

The code changes are approved. The update to the Gradle setup action version from v3 to v4 is consistent with the changes made in other workflow files, indicating a unified enhancement to the Gradle setup process within the CI/CD pipeline.

Please verify if the new features and improvements mentioned in the release notes for version 4.0.0 are applicable and beneficial to the project, such as:

• The removal of the arguments parameter, which was deprecated in version 3.
• The cache cleanup that is now enabled by default for jobs using the setup-gradle and dependency-submission actions.
• The enhanced wrapper validation that is enabled by default.
• The new input parameters for dependency graph generation.
• The better error messaging, optimizations for Gradle version checks, and attempts to speed up builds by utilizing available resources more effectively.

.github/workflows/pr-baseline.yml (1)

66-66: LGTM! The Gradle setup action version update looks good.

The code changes are approved. Updating the Gradle setup action from v3 to v4 can potentially introduce enhancements and improvements to the Gradle setup process within the CI/CD pipeline.

Based on the PR summary, some of the key changes and benefits in version 4 include:

• Removal of the deprecated arguments parameter
• Cache cleanup enabled by default for setup-gradle and dependency-submission actions
• Enhanced wrapper validation enabled by default
• New input parameters for dependency graph generation
• Better error messaging and optimizations for Gradle version checks
• Attempts to speed up builds by utilizing available resources more effectively

These changes aim to minimize cache size, improve build speeds, enhance supply-chain integrity, and provide more granular control over the generated dependency graph.

.github/workflows/build.yml (1)

89-89: Approve the Gradle setup action version update.

The code change is approved. Updating the Gradle setup action from v3 to v4 brings several improvements and enhancements, as outlined in the PR summary:

• Removal of the deprecated arguments parameter (verify if it was used in the previous version).
• Cache cleanup enabled by default for setup-gradle and dependency-submission actions.
• Enhanced wrapper validation enabled by default.
• New input parameters for dependency graph generation.
• Better error messaging and optimizations.

These changes aim to optimize build performance, improve supply-chain integrity, and ensure compatibility with the latest Gradle features.

Verify if the removed arguments parameter was used in the previous version by running the following script:

Verification successful

---

The arguments parameter was not used in the previous version.

The search for the arguments: parameter in the .github/workflows/build.yml file returned no results, confirming that it was not used in the previous version. Therefore, its removal in the update to v4 does not impact the workflow. The update to the Gradle setup action version is approved.

Scripts executed

The following scripts were executed for the analysis:

Script:

#!/bin/bash
# Description: Verify if the `arguments` parameter was used in the previous version.

# Test: Search for the `arguments` parameter usage in the file. Expect: No occurrences.
rg --type yaml 'arguments:' .github/workflows/build.yml

Length of output: 55