From 7d3a6af5713feb963e02629758fe73a34d36c6dd Mon Sep 17 00:00:00 2001 From: James Rich Date: Sun, 2 Aug 2026 19:28:37 -0500 Subject: [PATCH] ci: restrict Develocity cache writes to trusted events MIME-Version: 1.0 Content-Type: text/plain; charset=UTF-8 Content-Transfer-Encoding: 8bit Remote cache writes were gated on CI plus a non-empty DEVELOCITY_ACCESS_KEY. A same-repository pull request DOES receive repository secrets, so PR builds were writing entries into the shared cache — unmerged code could serve results to main. Require GITHUB_EVENT_NAME to be push or merge_group as well. Cache population is unaffected: main-check.yml (push to main) and merge-queue.yml (merge_group) are both still trusted writers, and they are the runs whose outputs correspond to code that actually landed. pull-request.yml becomes pull-only, which is what it should have been. Verified against a CI-shaped environment: CI=true GITHUB_EVENT_NAME=pull_request -> pull-only CI=true GITHUB_EVENT_NAME=push -> writes enabled CI=true GITHUB_EVENT_NAME=merge_group -> writes enabled Fork PRs have no key and are excluded twice over; local builds are excluded by isCI. This restores the protection the self-hosted HttpBuildCache had before #6531 — it gated on GITHUB_EVENT_NAME and excluded pull_request. The same gap was found and fixed across the six repos being onboarded now (meshtastic/kzstd#36 and siblings); this brings android back in line. --- .../main/kotlin/MeshtasticDevelocitySettingsPlugin.kt | 9 ++++++++- 1 file changed, 8 insertions(+), 1 deletion(-) diff --git a/build-logic/settings-plugin/src/main/kotlin/MeshtasticDevelocitySettingsPlugin.kt b/build-logic/settings-plugin/src/main/kotlin/MeshtasticDevelocitySettingsPlugin.kt index 6f624d2a28..928df2849f 100644 --- a/build-logic/settings-plugin/src/main/kotlin/MeshtasticDevelocitySettingsPlugin.kt +++ b/build-logic/settings-plugin/src/main/kotlin/MeshtasticDevelocitySettingsPlugin.kt @@ -61,7 +61,14 @@ class MeshtasticDevelocitySettingsPlugin : Plugin { remote(develocity.buildCache) { isEnabled = true val accessKey = System.getenv("DEVELOCITY_ACCESS_KEY")?.trim() - isPush = isCI && !accessKey.isNullOrEmpty() + // Write only from trusted events. A same-repository pull request DOES + // receive repository secrets, so gating on the access key alone let PR + // builds write into the shared cache; excluding pull_request here keeps + // unmerged code out of it. Fork PRs have no key and are excluded twice + // over, and local builds are excluded by isCI. + val event = System.getenv("GITHUB_EVENT_NAME") + val trustedForPush = event == "push" || event == "merge_group" + isPush = isCI && trustedForPush && !accessKey.isNullOrEmpty() } } }