Report EOL and maintenance status for Gradle versions (#1057)

This PR reports the support status of every Gradle version used in a
workflow:

- **End-of-life** — two or more major versions behind the latest
release.
- **Out of date** — one major version behind the latest release, or more
than two minor versions behind on the current major.

The information is surfaced as job annotations and in the Job Summary:
an icon beside the Gradle version in the build results table, and a
message below it.

| version kind | job annotation | version table | below the table |
| ------ | ----- | ---- | --------- |
| EOL | warning | ⚠️ | expandable section, pointing to the Gradle
Security Subscription |
| Out of date | notice | ℹ️ | one-line legend, pointing to the Gradle
release lifecycle docs |
| Current | none | — | — |

A single expandable section covers every end-of-life version, naming
them in its summary line and listing the affected release lines in its
body. The upgrade legend likewise appears once per job, however many
versions carry the info icon.

Notes on what is deliberately *not* reported:

- **Patch releases.** Only the major and minor version are considered,
so being on `9.7.0` when `9.7.1` exists is not flagged.
- **Pre-releases.** Release candidates, milestones and snapshots are
never reported, so testing against a nightly or an RC produces no
annotations.

The latest Gradle release is determined from the wrapper checksum data
already bundled with the action, so no network access is required. That
data is refreshed weekly, and the two-minor grace band absorbs the lag.

Note that the annotations are emitted independently of
`add-job-summary`: setting it to `never` suppresses the Job Summary
itself, but the warning and notice annotations remain.

### Examples

The `demo-job-summary` workflow has a `support-status-eol-and-outdated`
job that builds with three end-of-life versions (`6.9.4`, `7.4`,
`7.6.6`), two out-of-date versions (`8.0.2`, `8.14.5`) and the current
release, so all three statuses appear in one summary:

* **Job Summary**:
https://github.com/gradle/actions/actions/runs/34166688755#summary-101879071306
* **Annotations**:
https://github.com/gradle/actions/actions/runs/34166688755/job/101879071306
(expand annotations)

That workflow is never triggered automatically; run it manually against
a branch to review the rendering.

### Implementation

* Adds `GradleVersion`, parsing and ordering versions the same way
Gradle's own `org.gradle.util.GradleVersion` does. This replaces the
previous `versionIsAtLeast` helper and removes the `semver` dependency.
* Adds `gradle-support-status.ts`, which owns the classification policy
and both of its presentations (annotations and Job Summary section)
behind a three-function API, so `job-summary.ts` only asks for the icon
and the rendered block.

### Testing

* Unit tests for version ordering, classification, the annotations and
the rendered summary.
* `integ-test-gradle-support-status.yml`, which derives its expected
versions from the bundled release data so the assertions cannot drift
from the action's own view, then asserts against the real job log.
* The demo workflow job linked above, for reviewing the rendering by
eye.

Documented under [Build
reporting](https://github.com/gradle/actions/blob/main/docs/setup-gradle.md#gradle-version-support-status)
in `docs/setup-gradle.md`.

---------

Co-authored-by: Louis Jacomet <louis@gradle.com>
Co-authored-by: Daz DeBoer <daz@gradle.com>
Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

.github/workflows/ci-integ-test-full.yml

@@ -36,6 +36,7 @@ jobs:
   other-integ-tests:
     permissions:
       contents: write
+      actions: read
     needs: caching-integ-tests
     uses: ./.github/workflows/suite-integ-test-other.yml
     concurrency:

.github/workflows/ci-integ-test.yml

@@ -47,6 +47,7 @@ jobs:
   other-integ-tests:
     permissions:
       contents: write
+      actions: read
     needs: caching-integ-tests
     uses: ./.github/workflows/suite-integ-test-other.yml
     concurrency:

.github/workflows/demo-job-summary.yml

@@ -57,6 +57,79 @@ jobs:
         build-root-directory: .github/workflow-samples/groovy-dsl
         dependency-graph: generate-and-upload
 
+  # Exercises every Gradle version support status in a single Job Summary: end-of-life versions all
+  # share one expandable section and are each marked with a warning sign, out-of-date versions share
+  # a single info sign and legend, and the current version is left unmarked.
+  # Three end-of-life versions and two out-of-date ones exercise the plural wording throughout, and
+  # the two 7.x versions alongside a 6.x one check that each affected release line is named once,
+  # as "Gradle 6.x and 7.x releases".
+  # Versions are picked relative to Gradle 9.x being current; revisit once Gradle 10 is released.
+  support-status-eol-and-outdated:
+    needs: build-distribution
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    # Java 11, since Gradle 6.x cannot run on the Java 17 used elsewhere in this workflow.
+    - name: Initialize integ-test
+      uses: ./.github/actions/init-integ-test
+      with:
+        java-version: '11'
+
+    - name: Setup Gradle 6.9.4 (end-of-life)
+      uses: ./setup-gradle
+      with:
+        gradle-version: '6.9.4'
+    - name: Build with Gradle 6.9.4
+      working-directory: .github/workflow-samples/no-wrapper
+      run: gradle help
+
+    - name: Setup Gradle 7.4 (end-of-life)
+      uses: ./setup-gradle
+      with:
+        gradle-version: '7.4'
+    - name: Build with Gradle 7.4
+      working-directory: .github/workflow-samples/no-wrapper
+      run: gradle help
+
+    - name: Setup Gradle 7.6.6 (end-of-life)
+      uses: ./setup-gradle
+      with:
+        gradle-version: '7.6.6'
+    - name: Build with Gradle 7.6.6
+      working-directory: .github/workflow-samples/no-wrapper
+      run: gradle help
+
+    - name: Setup Gradle 8.0.2 (out of date)
+      uses: ./setup-gradle
+      with:
+        gradle-version: '8.0.2'
+    - name: Build with Gradle 8.0.2
+      working-directory: .github/workflow-samples/no-wrapper
+      run: gradle help
+
+    - name: Setup Gradle 8.14.5 (out of date)
+      uses: ./setup-gradle
+      with:
+        gradle-version: '8.14.5'
+    - name: Build with Gradle 8.14.5
+      working-directory: .github/workflow-samples/no-wrapper
+      run: gradle help
+
+    # Gradle 9 and later require Java 17
+    - name: Setup Java 17
+      uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0
+      with:
+        distribution: temurin
+        java-version: 17
+    - name: Setup Gradle current (no status reported)
+      uses: ./setup-gradle
+      with:
+        gradle-version: current
+    - name: Build with the current Gradle version
+      working-directory: .github/workflow-samples/no-wrapper
+      run: gradle help
+
   successful-builds-with-no-summary:
     needs: build-distribution
     runs-on: ubuntu-latest

.github/workflows/integ-test-gradle-support-status.yml

@@ -0,0 +1,148 @@
+name: Test Gradle support status reporting
+
+on:
+  workflow_call:
+    inputs:
+      cache-key-prefix:
+        type: string
+        default: '0'
+      skip-dist:
+        type: boolean
+        default: false
+
+env:
+  SKIP_DIST: ${{ inputs.skip-dist }}
+  GRADLE_BUILD_ACTION_CACHE_KEY_PREFIX: gradle-support-status-${{ inputs.cache-key-prefix }}
+
+permissions:
+  contents: read
+
+jobs:
+  report-outdated-versions:
+    runs-on: ubuntu-latest
+    outputs:
+      prev-oldest: ${{ steps.versions.outputs.prev-oldest }}
+      prev-newest: ${{ steps.versions.outputs.prev-newest }}
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+    - name: Initialize integ-test
+      uses: ./.github/actions/init-integ-test
+
+    # Derived from the bundled release data so the expectations cannot drift from the action's own view.
+    - name: Determine versions for each support status
+      id: versions
+      run: |
+        set -euo pipefail
+        eval "$(jq -r '
+          [ .[].version
+            | select(test("^[0-9]+\\.[0-9]+(\\.[0-9]+)?$"))
+            | {v: ., k: (((split(".") | map(tonumber)) + [0, 0, 0]) | .[0:3])}
+          ]
+          | sort_by(.k) as $finals
+          | ($finals | last) as $latest
+          | [$finals[] | select(.k[0] == $latest.k[0] - 1)] as $prev
+          | "KNOWN_LATEST=\($latest.v)",
+            "PREV_OLDEST=\($prev | first | .v)",
+            "PREV_NEWEST=\($prev | last | .v)"
+        ' sources/src/wrapper-validation/wrapper-checksums.json)"
+
+        echo "Known latest : ${KNOWN_LATEST}"
+        echo "Previous major, oldest : ${PREV_OLDEST}"
+        echo "Previous major, newest : ${PREV_NEWEST}"
+
+        {
+          echo "prev-oldest=${PREV_OLDEST}"
+          echo "prev-newest=${PREV_NEWEST}"
+        } >> "$GITHUB_OUTPUT"
+
+    - name: Setup Gradle with an end-of-life version
+      uses: ./setup-gradle
+      with:
+        cache-read-only: false
+        gradle-version: '7.6.4'
+    - name: Build with the end-of-life version
+      working-directory: .github/workflow-samples/no-wrapper
+      run: gradle help "-DgradleVersionCheck=7.6.4"
+
+    - name: Setup Gradle with the oldest release of the previous major
+      uses: ./setup-gradle
+      with:
+        gradle-version: ${{ steps.versions.outputs.prev-oldest }}
+    - name: Build with the oldest release of the previous major
+      working-directory: .github/workflow-samples/no-wrapper
+      run: gradle help "-DgradleVersionCheck=${{ steps.versions.outputs.prev-oldest }}"
+
+    - name: Setup Gradle with the newest release of the previous major
+      uses: ./setup-gradle
+      with:
+        gradle-version: ${{ steps.versions.outputs.prev-newest }}
+    - name: Build with the newest release of the previous major
+      working-directory: .github/workflow-samples/no-wrapper
+      run: gradle help "-DgradleVersionCheck=${{ steps.versions.outputs.prev-newest }}"
+
+  verify-report:
+    needs: report-outdated-versions
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      actions: read
+    steps:
+    - name: Check the support-status report was emitted
+      env:
+        GH_TOKEN: ${{ github.token }}
+        PREV_OLDEST: ${{ needs.report-outdated-versions.outputs.prev-oldest }}
+        PREV_NEWEST: ${{ needs.report-outdated-versions.outputs.prev-newest }}
+      run: |
+        set -euo pipefail
+
+        job_id=$(gh api \
+          "/repos/${GITHUB_REPOSITORY}/actions/runs/${GITHUB_RUN_ID}/attempts/${GITHUB_RUN_ATTEMPT}/jobs" \
+          --paginate --jq '.jobs[] | select(.name | endswith("report-outdated-versions")) | .id')
+        if [ -z "$job_id" ]; then
+          echo "Could not find the 'report-outdated-versions' Job in this workflow run"
+          exit 1
+        fi
+        gh api --allow-escape-sequences "/repos/${GITHUB_REPOSITORY}/actions/jobs/${job_id}/logs" > job.log
+
+        assert_logged() {
+          if ! grep -qF -- "$1" job.log; then
+            echo "Expected the Job log to contain: $1"
+            echo "--- support-status output found instead ---"
+            grep -E '##\[(warning|notice)\]|<summary>:warning:|consider upgrading' job.log || echo "(none)"
+            exit 1
+          fi
+        }
+        refute_logged() {
+          if grep -qF -- "$1" job.log; then
+            echo "Did not expect the Job log to contain: $1"
+            exit 1
+          fi
+        }
+
+        # The runner renders '::warning::'/'::notice::' into the log as '##[warning]'/'##[notice]'.
+        assert_logged "##[warning]Gradle 7.6.4 is end-of-life"
+        assert_logged "##[notice]Gradle ${PREV_OLDEST} is out of date: consider updating to the latest Gradle version."
+        assert_logged "##[notice]Gradle ${PREV_NEWEST} is out of date: consider updating to the latest Gradle version."
+
+        # Out-of-date versions get a notice, never a warning.
+        refute_logged "##[warning]Gradle ${PREV_OLDEST}"
+        refute_logged "##[warning]Gradle ${PREV_NEWEST}"
+
+        # The job summary is echoed to the log, so the rendered report can be checked directly.
+        assert_logged "<summary>:warning: Gradle 7.6.4 is end-of-life</summary>"
+        assert_logged "Update to the latest Gradle version."
+        assert_logged "<a href=\"https://gradle.org/security-subscription/?utm_source=github-action\">Gradle Security Subscription</a>"
+
+        # Table signs: a warning for end-of-life, the info sign for everything still supported.
+        assert_logged "<td align='center'>7.6.4 :warning:</td>"
+        assert_logged "<td align='center'>${PREV_OLDEST} :information_source:</td>"
+        assert_logged "<td align='center'>${PREV_NEWEST} :information_source:</td>"
+
+        # One legend for the whole job, no matter how many versions carry the info sign.
+        legends=$(grep -cF -- "consider upgrading" job.log || true)
+        if [ "$legends" != "1" ]; then
+          echo "Expected exactly one upgrade legend, found ${legends}"
+          exit 1
+        fi
+        assert_logged "<p>:information_source: Gradle version is out of date — consider upgrading. See <a href=\"https://docs.gradle.org/current/userguide/feature_lifecycle.html#eol_support\">Gradle release lifecycle</a></p>"

.github/workflows/suite-integ-test-other.yml

@@ -28,6 +28,14 @@ jobs:
     secrets:
       DEVELOCITY_ACCESS_KEY: ${{ secrets.DV_SOLUTIONS_ACCESS_KEY }}
 
+  gradle-support-status:
+    permissions:
+      contents: read
+      actions: read
+    uses: ./.github/workflows/integ-test-gradle-support-status.yml
+    with:
+      skip-dist: ${{ inputs.skip-dist }}
+
   provision-gradle-versions:
     uses: ./.github/workflows/integ-test-provision-gradle-versions.yml
     with: