ci: move Build Scans and cache to the OSS Community Develocity instance

.github/actions/gradle-setup/action.yml

@@ -10,6 +10,9 @@ inputs:
   gradle_encryption_key:
     description: 'Encryption key for Gradle remote cache'
     required: false
+  develocity_access_key:
+    description: 'Access key for the OSS Community Develocity Instance (Build Scan publishing and remote cache writes)'
+    required: false
 runs:
   using: composite
   steps:
@@ -33,3 +36,4 @@ runs:
         cache-encryption-key: ${{ inputs.gradle_encryption_key }}
         cache-cleanup: on-success
         add-job-summary: always
+        develocity-access-key: ${{ inputs.develocity_access_key }}

.github/workflows/ci.yml

@@ -14,11 +14,6 @@ concurrency:
 permissions:
   contents: read
 
-env:
-  GRADLE_CACHE_URL: ${{ secrets.GRADLE_CACHE_URL }}
-  GRADLE_CACHE_USERNAME: ${{ secrets.GRADLE_CACHE_USERNAME }}
-  GRADLE_CACHE_PASSWORD: ${{ secrets.GRADLE_CACHE_PASSWORD }}
-
 jobs:
   test-jvm:
     runs-on: ubuntu-latest
@@ -46,6 +41,7 @@ jobs:
           java_version: ${{ matrix.java-version }}
           cache_read_only: ${{ steps.cache_config.outputs.cache_read_only }}
           gradle_encryption_key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+          develocity_access_key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - name: Build and test (JVM)
         run: ./gradlew jvmTest
@@ -74,6 +70,7 @@ jobs:
         with:
           cache_read_only: ${{ steps.cache_config.outputs.cache_read_only }}
           gradle_encryption_key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+          develocity_access_key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - name: Test Android (host unit tests) and assemble
         run: ./gradlew :core:testAndroidHostTest :core:assembleAndroidMain
@@ -111,6 +108,7 @@ jobs:
         with:
           cache_read_only: ${{ steps.cache_config.outputs.cache_read_only }}
           gradle_encryption_key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+          develocity_access_key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - name: Build & test iOS (${{ matrix.ios-target }})
         run: ./gradlew :core:${{ matrix.ios-target }}Test
@@ -139,6 +137,7 @@ jobs:
       - uses: ./.github/actions/gradle-setup
         with:
           gradle_encryption_key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+          develocity_access_key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - name: Check public API compatibility
         run: ./gradlew checkKotlinAbi
@@ -153,6 +152,7 @@ jobs:
       - uses: ./.github/actions/gradle-setup
         with:
           gradle_encryption_key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+          develocity_access_key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - name: Verify architecture rules (ADR-008)
         run: ./gradlew :core:verifyModuleBoundary detekt
@@ -178,6 +178,7 @@ jobs:
         with:
           cache_read_only: ${{ steps.cache_config.outputs.cache_read_only }}
           gradle_encryption_key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+          develocity_access_key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - name: Run full check (gate)
         run: ./gradlew check
@@ -204,6 +205,7 @@ jobs:
         with:
           cache_read_only: ${{ steps.cache_config.outputs.cache_read_only }}
           gradle_encryption_key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+          develocity_access_key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - name: Generate coverage report (Kover XML)
         run: ./gradlew koverXmlReport
@@ -232,6 +234,7 @@ jobs:
         with:
           cache_read_only: 'true'
           gradle_encryption_key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+          develocity_access_key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - name: Check publishing secrets
         id: secrets

.github/workflows/docs.yml

@@ -42,6 +42,8 @@ jobs:
 
       - name: Set up Gradle
         uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+        with:
+          develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - name: Build aggregated documentation
         run: ./gradlew :dokkaGenerate --no-daemon

.github/workflows/release.yml

@@ -39,11 +39,6 @@ concurrency:
 permissions:
   contents: read
 
-env:
-  GRADLE_CACHE_URL: ${{ secrets.GRADLE_CACHE_URL }}
-  GRADLE_CACHE_USERNAME: ${{ secrets.GRADLE_CACHE_USERNAME }}
-  GRADLE_CACHE_PASSWORD: ${{ secrets.GRADLE_CACHE_PASSWORD }}
-
 jobs:
   publish:
     name: Publish ${{ inputs.version || github.ref_name }}
@@ -99,6 +94,7 @@ jobs:
         with:
           cache_read_only: 'true'
           gradle_encryption_key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+          develocity_access_key: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
 
       - name: Verify version matches tag
         run: |

README.md

@@ -8,6 +8,7 @@
 [![Maven Central](https://img.shields.io/maven-central/v/org.meshtastic/sdk-core)](https://central.sonatype.com/artifact/org.meshtastic/sdk-core)
 [![CI](https://github.com/meshtastic/meshtastic-sdk/actions/workflows/ci.yml/badge.svg)](https://github.com/meshtastic/meshtastic-sdk/actions/workflows/ci.yml)
 [![codecov](https://codecov.io/gh/meshtastic/meshtastic-sdk/branch/main/graph/badge.svg)](https://codecov.io/gh/meshtastic/meshtastic-sdk)
+[![Revved up by Develocity](https://img.shields.io/badge/Revved%20up%20by-Develocity-06A0CE?logo=Gradle&labelColor=02303A)](https://community.develocity.cloud/scans?search.rootProjectNames=meshtastic-sdk)
 [![API Docs](https://img.shields.io/badge/docs-Dokka-blue)](https://meshtastic.github.io/meshtastic-sdk/)
 
 📚 **[API Reference (Dokka)](https://meshtastic.github.io/meshtastic-sdk/)** — published from `main`.

build-logic/settings.gradle.kts

@@ -7,7 +7,7 @@
 
 plugins {
     id("com.gradle.develocity") version "4.5.0"
-    id("com.gradle.common-custom-user-data-gradle-plugin") version "2.7.0"
+    id("com.gradle.common-custom-user-data-gradle-plugin") version "2.8.0"
 }
 
 dependencyResolutionManagement {
@@ -26,8 +26,5 @@ dependencyResolutionManagement {
 rootProject.name = "build-logic"
 include(":convention")
 
-// Build Cache configuration (HTTP remote cache + local)
-apply(from = "../gradle/build-cache.settings.gradle")
-
-// Build Scans (Develocity)
+// Build Scans + remote Build Cache (Develocity OSS Community instance)
 apply(from = "../gradle/develocity.settings.gradle")

gradle/develocity.settings.gradle

@@ -6,16 +6,68 @@
  * SPDX-License-Identifier: GPL-3.0-or-later
  */
 
-// Build Scans — publish in CI only for debugging and performance profiling.
+/*
+ * Develocity — Build Scans and remote Build Cache on the OSS Community instance
+ * (https://community.develocity.cloud), project `meshtastic`.
+ *
+ * Applied from BOTH settings files: the build-logic included build does not
+ * inherit the root's configuration, and without its own it silently drops to
+ * local-cache-only.
+ *
+ * Replaces the former self-hosted HttpBuildCache: GRADLE_CACHE_URL / _USERNAME /
+ * _PASSWORD are no longer read anywhere in this repo.
+ */
+
+def isCI = System.getenv("CI") != null
+
 develocity {
+    server = "https://community.develocity.cloud"
+    projectId = "meshtastic"
     buildScan {
-        capture {
-            fileFingerprints = true
+        uploadInBackground = !isCI
+        // Unauthenticated builds (fork PRs, developers who never provisioned a key)
+        // publish nothing rather than failing. This replaces the previous CI-only
+        // gate: local builds publish too, once a developer has run
+        // `./gradlew provisionDevelocityAccessKey`.
+        publishing.onlyIf { it.authenticated }
+        // Fingerprints power cache-miss comparison (CI debugging); skip the payload locally.
+        capture { fileFingerprints = isCI }
+        // Public instance: no machine identity. Constants on purpose — scans already
+        // record OS/CPU and CCUD adds CI metadata. Keep the `if` OUTSIDE the closures:
+        // capture-free closures are what the configuration cache can serialize.
+        obfuscation {
+            ipAddresses { addresses -> addresses.collect { "0.0.0.0" } }
+            externalProcessName { "external-process" }
+            if (isCI) {
+                username { "ci" }
+                hostname { "ci-runner" }
+            } else {
+                username { "local-dev" }
+                hostname { "local-machine" }
+            }
         }
-        def isCi = System.getenv("CI") != null
-        publishing.onlyIf { isCi }
-        uploadInBackground = !isCi
-        termsOfUseUrl = "https://gradle.com/help/legal-terms-of-use"
-        termsOfUseAgree = "yes"
+    }
+}
+
+// Resolved outside the buildCache block: inside it the closure delegate is
+// BuildCacheConfiguration, which has no `develocity` property.
+def develocityBuildCache = develocity.buildCache
+def accessKey = System.getenv("DEVELOCITY_ACCESS_KEY")?.trim()
+
+buildCache {
+    // Off on CI: runners are ephemeral and every hit comes from the remote anyway.
+    local {
+        enabled = !isCI
+    }
+    remote(develocityBuildCache) {
+        enabled = true
+        // Write only from trusted events. Local dev is excluded by isCI, and
+        // pull_request runs are excluded here: a same-repository PR DOES receive
+        // repository secrets, so gating on the access key alone would let
+        // unmerged code write entries into the shared cache. Fork PRs have no
+        // key and are excluded twice over.
+        def eventName = System.getenv("GITHUB_EVENT_NAME")
+        def trustedForPush = eventName == "push" || eventName == "merge_group"
+        push = isCI && trustedForPush && accessKey != null && !accessKey.isEmpty()
     }
 }

settings.gradle.kts

@@ -11,13 +11,10 @@ pluginManagement {
 plugins {
     id("org.gradle.toolchains.foojay-resolver-convention") version "1.0.0"
     id("com.gradle.develocity") version "4.5.0"
-    id("com.gradle.common-custom-user-data-gradle-plugin") version "2.7.0"
+    id("com.gradle.common-custom-user-data-gradle-plugin") version "2.8.0"
 }
 
-// Build Cache configuration (HTTP remote cache + local)
-apply(from = "gradle/build-cache.settings.gradle")
-
-// Build Scans (Develocity)
+// Build Scans + remote Build Cache (Develocity OSS Community instance)
 apply(from = "gradle/develocity.settings.gradle")
 
 dependencyResolutionManagement {