stempler / bnd-platform

Build OSGi bundles and Eclipse Update Sites from existing JARs, e.g. from Maven repositories (Plugin for Gradle)
Apache License 2.0
79 stars 30 forks source link

chore(deps): update gradle/actions action to v4 #133

Closed renovate[bot] closed 2 weeks ago

renovate[bot] commented 1 month ago

Mend Renovate

This PR contains the following updates:

Package Type Update Change OpenSSF
gradle/actions action major v3.5.0 -> v4.0.0 OpenSSF Scorecard

Release Notes

gradle/actions (gradle/actions) ### [`v4.0.0`](https://togithub.com/gradle/actions/releases/tag/v4.0.0) [Compare Source](https://togithub.com/gradle/actions/compare/v3.5.0...v4) Final release of `v4.0.0` of the `setup-gradle`, `dependency-submission` and `wrapper-validation` actions provided under `gradle/actions`. This release is available under the `v4` tag. ##### Major changes from the `v3` release ##### The `arguments` parameter has been removed Using the action to execute Gradle via the ` arguments `parameter was deprecated in `v3` and this parameter has been removed. [See here for more details](https://togithub.com/gradle/actions/blob/v4.0.0-rc.1/docs/deprecation-upgrade-guide.md#using-the-action-to-execute-gradle-via-the-arguments-parameter-is-deprecated). ##### Cache cleanup enabled by default After a number of fixes and improvements, this release enables [cache-cleanup](https://togithub.com/gradle/actions/blob/v4.0.0-rc.1/docs/setup-gradle.md#configuring-cache-cleanup) by default for all Jobs using the `setup-gradle` and `dependency-submission` actions. Improvements and bugfixes related cache cleanup: - By default, cache cleanup is not run if any Gradle build fails ([#​71](https://togithub.com/gradle/actions/issues/71)) - Cache cleanup is not run after configuration-cache reuse ([#​19](https://togithub.com/gradle/actions/issues/19)) This feature should help to minimize the size of entries written to the GitHub Actions cache, speeding up builds and reducing cache usage. ##### Wrapper validation enabled by default In `v3`, the `setup-gradle` action was enhanced to support Gradle wrapper validation, removing the need to use a separate workflow file with the `gradle/actions/wrapper-validation` action. With this release, wrapper validation has been significantly improved, and is now enabled by default ([#​12](https://togithub.com/gradle/actions/issues/12)): - The `allow-snapshot-wrappers` makes it possible to validate snapshot wrapper jars using `setup-gradle`. - Checksums for [nightly and snapshot Gradle versions](https://services.gradle.org/distributions-snapshots/) are now validated ([#​281](https://togithub.com/gradle/actions/issues/281)). - Valid wrapper checksums are cached in Gradle User Home, reducing the need to retrieve checksum values remotely ([#​172](https://togithub.com/gradle/actions/issues/172)). - Reduce network calls in `wrapper-validation` for new Gradle versions: By only fetching wrapper checksums for Gradle versions that were not known when this action was released, this release reduces the likelihood that a network failure could cause failure in wrapper validation ([#​171](https://togithub.com/gradle/actions/issues/171)) - Improved error message when `wrapper-validation` finds no wrapper jars ([#​284](https://togithub.com/gradle/actions/issues/284)) Wrapper validation is important for supply-chain integrity. Enabling this feature by default will increase the coverage of wrapper validation on projects using GitHub Actions. ##### New input parameters for Dependency Graph generation Some dependency-graph inputs that could previously only be configured via environment variables now have dedicated action inputs: - `dependency-graph-report-dir`: sets the location where dependency-graph reports will be generated - `dependency-graph-exclude-projects` and `dependency-graph-include-projects`: [select which Gradle projects will contribute to the generated dependency graph](https://togithub.com/gradle/actions/blob/v4.0.0-rc.1/docs/dependency-submission.md#selecting-gradle-projects-that-will-contribute-to-the-dependency-graph). - `dependency-graph-exclude-configurations` and `dependency-graph-include-configurations`: [select which Gradle configurations will contribute to the generated dependency graph](https://togithub.com/gradle/actions/blob/v4.0.0-rc.1/docs/dependency-submission.md#selecting-gradle-configurations-that-will-contribute-to-the-dependency-graph). ##### Other improvements - In Job summary, the action now provides an explanation when cache is set to `read-only` or `disabled` ([#​255](https://togithub.com/gradle/actions/issues/255)) - When `setup-gradle` requests a specific Gradle version, the action will no longer download and install that version if it is already available on the `PATH` of the runner ([#​270](https://togithub.com/gradle/actions/issues/270)) - To attempt to speed up builds, the `setup-gradle` and `dependency-submission` actions now attempt to use the `D:` drive for Gradle User Home if it is available ([#​290](https://togithub.com/gradle/actions/issues/290)) ##### Deprecations and breaking changes - The `gradle-home-cache-cleanup` input parameter has been deprecated and replaced by `cache-cleanup` - The undocumented `dependency-graph: clear` parameter has been removed without replacement - The following parameters deprecated in `v3` have been removed: - [arguments](https://togithub.com/gradle/actions/blob/v4.0.0-rc.1/docs/deprecation-upgrade-guide.md#using-the-action-to-execute-gradle-via-the-arguments-parameter-is-deprecated) - [build-scan-terms-of-service-url and build-scan-terms-of-service-agree](https://togithub.com/gradle/actions/blob/v4.0.0-rc.1/docs/deprecation-upgrade-guide.md#the-build-scan-terms-of-service-input-parameters-have-been-renamed) ##### Changelog - Only fetch checksums for unknown wrapper versions by [@​bigdaz](https://togithub.com/bigdaz) in [https://github.com/gradle/actions/pull/292](https://togithub.com/gradle/actions/pull/292) - Isolate 'dependency-submission' action from 'setup-gradle' by [@​bigdaz](https://togithub.com/bigdaz) in [https://github.com/gradle/actions/pull/293](https://togithub.com/gradle/actions/pull/293) - Caching improvements by [@​bigdaz](https://togithub.com/bigdaz) in [https://github.com/gradle/actions/pull/294](https://togithub.com/gradle/actions/pull/294) - Config cache cleanup by [@​bigdaz](https://togithub.com/bigdaz) in [https://github.com/gradle/actions/pull/295](https://togithub.com/gradle/actions/pull/295) - Delete excluded paths on restore Gradle Home by [@​bigdaz](https://togithub.com/bigdaz) in [https://github.com/gradle/actions/pull/298](https://togithub.com/gradle/actions/pull/298) - Use faster D: drive on windows for Gradle User Home and Gradle downloads by [@​bigdaz](https://togithub.com/bigdaz) in [https://github.com/gradle/actions/pull/299](https://togithub.com/gradle/actions/pull/299) - Always set the GRADLE_USER_HOME env var by [@​bigdaz](https://togithub.com/bigdaz) in [https://github.com/gradle/actions/pull/300](https://togithub.com/gradle/actions/pull/300) - Fix windows by [@​bigdaz](https://togithub.com/bigdaz) in [https://github.com/gradle/actions/pull/302](https://togithub.com/gradle/actions/pull/302) - Use pre-installed Gradle when available by [@​bigdaz](https://togithub.com/bigdaz) in [https://github.com/gradle/actions/pull/301](https://togithub.com/gradle/actions/pull/301) - Prepare for v4 release by [@​bigdaz](https://togithub.com/bigdaz) in [https://github.com/gradle/actions/pull/303](https://togithub.com/gradle/actions/pull/303) - Include RUNNER_ARCH in cache key by [@​bigdaz](https://togithub.com/bigdaz) in [https://github.com/gradle/actions/pull/305](https://togithub.com/gradle/actions/pull/305) - Introduce dependency graph params by [@​bigdaz](https://togithub.com/bigdaz) in [https://github.com/gradle/actions/pull/304](https://togithub.com/gradle/actions/pull/304) - Finish enabling cache-cleanup by default by [@​bigdaz](https://togithub.com/bigdaz) in [https://github.com/gradle/actions/pull/306](https://togithub.com/gradle/actions/pull/306) - Bump references to Develocity Gradle plugin from 3.17.5 to 3.17.6 by [@​bot-githubaction](https://togithub.com/bot-githubaction) in [https://github.com/gradle/actions/pull/315](https://togithub.com/gradle/actions/pull/315) - Group cache-cleanup log messages by [@​bigdaz](https://togithub.com/bigdaz) in [https://github.com/gradle/actions/pull/319](https://togithub.com/gradle/actions/pull/319) - Enable wrapper-validation by default in setup-gradle by [@​bigdaz](https://togithub.com/bigdaz) in [https://github.com/gradle/actions/pull/318](https://togithub.com/gradle/actions/pull/318) - Improve error messages for min-wrapper-count by [@​bigdaz](https://togithub.com/bigdaz) in [https://github.com/gradle/actions/pull/321](https://togithub.com/gradle/actions/pull/321) **Full Changelog**: https://github.com/gradle/actions/compare/v3.5.0...v4.0.0

Configuration

πŸ“… Schedule: Branch creation - At any time (no schedule defined), Automerge - At any time (no schedule defined).

🚦 Automerge: Disabled by config. Please merge this manually once you are satisfied.

β™» Rebasing: Whenever PR becomes conflicted, or you tick the rebase/retry checkbox.

πŸ”• Ignore: Close this PR and you won't be reminded about this update again.



This PR was generated by Mend Renovate. View the repository job log.