Minor update to setup-gradle README

- Mostly with `setup-gradle`
- Some with `gradle-actions`

.github/actions/build-dist/action.yml

@@ -3,14 +3,19 @@ name: 'Build and upload distribution'
 runs:
   using: "composite"
   steps: 
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 20
     - name: Build distribution
       shell: bash
       run: |
+        npm -v
+        node -v
         npm install
         npm run build
+      working-directory: sources
     - name: Upload distribution
-      uses: actions/upload-artifact@v3
+      uses: actions/upload-artifact@v4
       with:
         name: dist
         path: dist/
-

.github/actions/download-dist/action.yml

@@ -6,7 +6,7 @@ runs:
   steps: 
     - name: Download dist
       if: ${{ env.DOWNLOAD_DIST == 'true' }}
-      uses: actions/download-artifact@v3
+      uses: actions/download-artifact@v4
       with:
         name: dist
         path: dist/

.github/dependabot.yml

@@ -20,14 +20,10 @@ updates:
     schedule:
       interval: "weekly"
     ignore:
-      - dependency-name: "@types/node"
+      - dependency-name: "@types/node" # Breaking change: update with next major release
+      - dependency-name: "@octokit/rest" # Tied to node version
     groups:
-      runtime-dependencies:
-        patterns:
-        - "@actions/*"
-        - "@octokit/rest"
-        - "string-argv"
-      dev-dependencies:
+      npm-dependencies:
         patterns:
         - "*"
       
@@ -68,7 +64,7 @@ updates:
     schedule:
       interval: "daily"
   - package-ecosystem: "gradle"
-    directory: "test/init-scripts"
+    directory: "sources/test/init-scripts"
     registries:
       - gradle-plugin-portal
     schedule:

.github/workflow-samples/gradle-plugin/gradle/wrapper/gradle-wrapper.properties

@@ -1,7 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=38f66cd6eef217b4c35855bb11ea4e9fbc53594ccccb5fb82dfd317ef8c2c5a3
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.2-bin.zip
+distributionSha256Sum=9d926787066a081739e8200858338b4a69e837c3a821a33aca9db09dd4a41026
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.5-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME

.github/workflow-samples/gradle-plugin/gradlew

@@ -83,7 +83,8 @@ done
 # This is normally unused
 # shellcheck disable=SC2034
 APP_BASE_NAME=${0##*/}
-APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd "${APP_HOME:-./}" > /dev/null && pwd -P ) || exit
 
 # Use the maximum available, or set MAX_FD != -1 to use that value.
 MAX_FD=maximum
@@ -144,7 +145,7 @@ if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
     case $MAX_FD in #(
       max*)
         # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC3045
+        # shellcheck disable=SC2039,SC3045
         MAX_FD=$( ulimit -H -n ) ||
             warn "Could not query maximum file descriptor limit"
     esac
@@ -152,7 +153,7 @@ if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
       '' | soft) :;; #(
       *)
         # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC3045
+        # shellcheck disable=SC2039,SC3045
         ulimit -n "$MAX_FD" ||
             warn "Could not set maximum file descriptor limit to $MAX_FD"
     esac
@@ -201,11 +202,11 @@ fi
 # Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
 DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
 
-# Collect all arguments for the java command;
-#   * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of
-#     shell script including quotes and variable substitutions, so put them in
-#     double quotes to make sure that they get re-expanded; and
-#   * put everything else in single quotes, so that it's not re-expanded.
+# Collect all arguments for the java command:
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
+#     and any embedded shellness will be escaped.
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
+#     treated as '${Hostname}' itself on the command line.
 
 set -- \
         "-Dorg.gradle.appname=$APP_BASE_NAME" \

.github/workflow-samples/groovy-dsl/gradle/wrapper/gradle-wrapper.properties

@@ -1,7 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=38f66cd6eef217b4c35855bb11ea4e9fbc53594ccccb5fb82dfd317ef8c2c5a3
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.2-bin.zip
+distributionSha256Sum=9d926787066a081739e8200858338b4a69e837c3a821a33aca9db09dd4a41026
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.5-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME

.github/workflow-samples/groovy-dsl/gradlew

@@ -83,7 +83,8 @@ done
 # This is normally unused
 # shellcheck disable=SC2034
 APP_BASE_NAME=${0##*/}
-APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd "${APP_HOME:-./}" > /dev/null && pwd -P ) || exit
 
 # Use the maximum available, or set MAX_FD != -1 to use that value.
 MAX_FD=maximum
@@ -144,7 +145,7 @@ if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
     case $MAX_FD in #(
       max*)
         # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC3045
+        # shellcheck disable=SC2039,SC3045
         MAX_FD=$( ulimit -H -n ) ||
             warn "Could not query maximum file descriptor limit"
     esac
@@ -152,7 +153,7 @@ if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
       '' | soft) :;; #(
       *)
         # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC3045
+        # shellcheck disable=SC2039,SC3045
         ulimit -n "$MAX_FD" ||
             warn "Could not set maximum file descriptor limit to $MAX_FD"
     esac
@@ -201,11 +202,11 @@ fi
 # Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
 DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
 
-# Collect all arguments for the java command;
-#   * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of
-#     shell script including quotes and variable substitutions, so put them in
-#     double quotes to make sure that they get re-expanded; and
-#   * put everything else in single quotes, so that it's not re-expanded.
+# Collect all arguments for the java command:
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
+#     and any embedded shellness will be escaped.
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
+#     treated as '${Hostname}' itself on the command line.
 
 set -- \
         "-Dorg.gradle.appname=$APP_BASE_NAME" \

.github/workflow-samples/groovy-dsl/settings.gradle

@@ -1,6 +1,6 @@
 plugins {
-    id "com.gradle.enterprise" version "3.13.4"
-    id "com.gradle.common-custom-user-data-gradle-plugin" version "1.11"
+    id "com.gradle.enterprise" version "3.16.1"
+    id "com.gradle.common-custom-user-data-gradle-plugin" version "1.12.1"
 }
 
 gradleEnterprise {

.github/workflow-samples/java-toolchain/gradle/wrapper/gradle-wrapper.properties

@@ -1,7 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=38f66cd6eef217b4c35855bb11ea4e9fbc53594ccccb5fb82dfd317ef8c2c5a3
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.2-bin.zip
+distributionSha256Sum=9d926787066a081739e8200858338b4a69e837c3a821a33aca9db09dd4a41026
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.5-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME

.github/workflow-samples/java-toolchain/gradlew

@@ -83,7 +83,8 @@ done
 # This is normally unused
 # shellcheck disable=SC2034
 APP_BASE_NAME=${0##*/}
-APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd "${APP_HOME:-./}" > /dev/null && pwd -P ) || exit
 
 # Use the maximum available, or set MAX_FD != -1 to use that value.
 MAX_FD=maximum
@@ -144,7 +145,7 @@ if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
     case $MAX_FD in #(
       max*)
         # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC3045
+        # shellcheck disable=SC2039,SC3045
         MAX_FD=$( ulimit -H -n ) ||
             warn "Could not query maximum file descriptor limit"
     esac
@@ -152,7 +153,7 @@ if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
       '' | soft) :;; #(
       *)
         # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC3045
+        # shellcheck disable=SC2039,SC3045
         ulimit -n "$MAX_FD" ||
             warn "Could not set maximum file descriptor limit to $MAX_FD"
     esac
@@ -201,11 +202,11 @@ fi
 # Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
 DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
 
-# Collect all arguments for the java command;
-#   * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of
-#     shell script including quotes and variable substitutions, so put them in
-#     double quotes to make sure that they get re-expanded; and
-#   * put everything else in single quotes, so that it's not re-expanded.
+# Collect all arguments for the java command:
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
+#     and any embedded shellness will be escaped.
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
+#     treated as '${Hostname}' itself on the command line.
 
 set -- \
         "-Dorg.gradle.appname=$APP_BASE_NAME" \

.github/workflow-samples/java-toolchain/settings.gradle

@@ -1,5 +1,5 @@
 plugins {
-    id("org.gradle.toolchains.foojay-resolver-convention") version("0.4.0")
+    id("org.gradle.toolchains.foojay-resolver-convention") version("0.7.0")
 }
 
 rootProject.name = 'basic'

.github/workflow-samples/kotlin-dsl/build.gradle.kts

@@ -8,9 +8,9 @@ repositories {
 
 dependencies {
     api("org.apache.commons:commons-math3:3.6.1")
-    implementation("com.google.guava:guava:32.0.1-jre")
+    implementation("com.google.guava:guava:33.0.0-jre")
 
-    testImplementation("org.junit.jupiter:junit-jupiter:5.9.3")
+    testImplementation("org.junit.jupiter:junit-jupiter:5.10.1")
 }
 
 tasks.test {

.github/workflow-samples/kotlin-dsl/gradle/wrapper/gradle-wrapper.properties

@@ -1,7 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=38f66cd6eef217b4c35855bb11ea4e9fbc53594ccccb5fb82dfd317ef8c2c5a3
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.2-bin.zip
+distributionSha256Sum=9d926787066a081739e8200858338b4a69e837c3a821a33aca9db09dd4a41026
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.5-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME

.github/workflow-samples/kotlin-dsl/gradlew

@@ -83,7 +83,8 @@ done
 # This is normally unused
 # shellcheck disable=SC2034
 APP_BASE_NAME=${0##*/}
-APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd "${APP_HOME:-./}" > /dev/null && pwd -P ) || exit
 
 # Use the maximum available, or set MAX_FD != -1 to use that value.
 MAX_FD=maximum
@@ -144,7 +145,7 @@ if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
     case $MAX_FD in #(
       max*)
         # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC3045
+        # shellcheck disable=SC2039,SC3045
         MAX_FD=$( ulimit -H -n ) ||
             warn "Could not query maximum file descriptor limit"
     esac
@@ -152,7 +153,7 @@ if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
       '' | soft) :;; #(
       *)
         # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
-        # shellcheck disable=SC3045
+        # shellcheck disable=SC2039,SC3045
         ulimit -n "$MAX_FD" ||
             warn "Could not set maximum file descriptor limit to $MAX_FD"
     esac
@@ -201,11 +202,11 @@ fi
 # Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
 DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
 
-# Collect all arguments for the java command;
-#   * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of
-#     shell script including quotes and variable substitutions, so put them in
-#     double quotes to make sure that they get re-expanded; and
-#   * put everything else in single quotes, so that it's not re-expanded.
+# Collect all arguments for the java command:
+#   * DEFAULT_JVM_OPTS, JAVA_OPTS, JAVA_OPTS, and optsEnvironmentVar are not allowed to contain shell fragments,
+#     and any embedded shellness will be escaped.
+#   * For example: A user cannot expect ${Hostname} to be expanded, as it is an environment variable and will be
+#     treated as '${Hostname}' itself on the command line.
 
 set -- \
         "-Dorg.gradle.appname=$APP_BASE_NAME" \

.github/workflow-samples/kotlin-dsl/settings.gradle.kts

@@ -1,6 +1,6 @@
 plugins {
-    id("com.gradle.enterprise") version "3.13.4"
-    id("com.gradle.common-custom-user-data-gradle-plugin") version "1.11"
+    id("com.gradle.enterprise") version "3.16.1"
+    id("com.gradle.common-custom-user-data-gradle-plugin") version "1.12.1"
 }
 
 gradleEnterprise {

.github/workflow-samples/no-ge/build.gradle

@@ -0,0 +1 @@
+// Required to keep dependabot happy

.github/workflow-samples/no-ge/settings.gradle

@@ -0,0 +1 @@
+rootProject.name = 'no-ge'

.github/workflow-samples/no-wrapper-gradle-5/build.gradle

@@ -1,5 +1,5 @@
 plugins {
-    id "com.gradle.build-scan" version "3.13.4" 
+    id "com.gradle.build-scan" version "3.16.1" 
 }
 
 gradleEnterprise {

.github/workflow-samples/no-wrapper/settings.gradle

@@ -1,5 +1,5 @@
 plugins {
-    id "com.gradle.enterprise" version "3.13.4"
+    id "com.gradle.enterprise" version "3.16.1"
 }
 
 gradleEnterprise {

.github/workflows/ci-codeql.yml

@@ -1,22 +1,10 @@
-# For most projects, this workflow file will not need changing; you simply need
-# to commit it to your repository.
-#
-# You may wish to alter this file to override the set of languages analyzed,
-# or to provide custom queries or build logic.
-#
-# ******** NOTE ********
-# We have attempted to detect the languages in your repository. Please check
-# the `language` matrix defined below to confirm you have the correct set of
-# supported CodeQL languages.
-#
 name: CI-codeql
 
 on:
   push:
-    branches: [ main ]
+    branches: [ "main" ]
   pull_request:
-    # The branches below must be a subset of the branches above
-    branches: [ main ]
+    branches: [ "main" ]
   schedule:
     - cron: '25 23 * * 2'
 
@@ -32,39 +20,20 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        language: [ 'javascript' ]
-        # CodeQL supports [ 'cpp', 'csharp', 'go', 'java', 'javascript', 'python', 'ruby' ]
-        # Learn more about CodeQL language support at https://git.io/codeql-language-support
+        language: [ 'javascript-typescript' ]
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL
-      uses: github/codeql-action/init@v2
+      uses: github/codeql-action/init@v3
       with:
         languages: ${{ matrix.language }}
-        # If you wish to specify custom queries, you can do so here or in a config file.
-        # By default, queries listed here will override any specified in a config file.
-        # Prefix the list here with "+" to use these queries and those in the config file.
-        # queries: ./path/to/local/query, your-org/your-repo/queries@main
-
-    # Autobuild attempts to build any compiled languages  (C/C++, C#, or Java).
-    # If this step fails, then you should remove it and run the build manually (see below)
-    - name: Autobuild
-      uses: github/codeql-action/autobuild@v2
-
-    # ℹ️ Command-line programs to run using the OS shell.
-    # 📚 https://git.io/JvXDl
-
-    # ✏️ If the Autobuild fails above, remove it and uncomment the following three lines
-    #    and modify them (or add more) to build your code if your project
-    #    uses a compiled language
-
-    #- run: |
-    #   make bootstrap
-    #   make release
+        config: |
+          paths: 
+          - sources/src
 
     - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v2
+      uses: github/codeql-action/analyze@v3

.github/workflows/ci-dependency-review.yml

@@ -15,6 +15,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout Repository'
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@v3
+        uses: actions/dependency-review-action@v4

.github/workflows/ci-full-check.yml

@@ -9,6 +9,7 @@ on:
   push:
     branches: 
       - main
+      - release/**
     paths:
       - '.github/**'
       - 'dist/**'
@@ -25,12 +26,19 @@ jobs:
       cache-key-prefix: ${{github.run_number}}-
 
   caching-config:
-    uses: ./.github/workflows/integ-test-action-inputs-caching.yml
+    uses: ./.github/workflows/integ-test-caching-config.yml
     with:
       cache-key-prefix: ${{github.run_number}}-
 
   dependency-graph:
     uses: ./.github/workflows/integ-test-dependency-graph.yml
+    permissions:
+      contents: write
+    with:
+      cache-key-prefix: ${{github.run_number}}-
+
+  dependency-graph-failures:
+    uses: ./.github/workflows/integ-test-dependency-graph-failures.yml
     with:
       cache-key-prefix: ${{github.run_number}}-
 
@@ -44,15 +52,24 @@ jobs:
     with:
       cache-key-prefix: ${{github.run_number}}-
 
+  develocity-injection:
+    uses: ./.github/workflows/integ-test-inject-develocity.yml
+    with:
+      cache-key-prefix: ${{github.run_number}}-
+    secrets:
+      DEVELOCITY_ACCESS_KEY: ${{ secrets.GE_SOLUTIONS_ACCESS_TOKEN }}
+
   provision-gradle-versions:
     uses: ./.github/workflows/integ-test-provision-gradle-versions.yml
     with:
       cache-key-prefix: ${{github.run_number}}-
 
-  # restore-configuration-cache:
-  #   uses: ./.github/workflows/integ-test-restore-configuration-cache.yml
-  #   with:
-  #     cache-key-prefix: ${{github.run_number}}-
+  restore-configuration-cache:
+    uses: ./.github/workflows/integ-test-restore-configuration-cache.yml
+    with:
+      cache-key-prefix: ${{github.run_number}}-
+    secrets:
+      GRADLE_ENCRYPTION_KEY: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
 
   restore-custom-gradle-home:
     uses: ./.github/workflows/integ-test-restore-custom-gradle-home.yml
@@ -83,3 +100,8 @@ jobs:
     uses: ./.github/workflows/integ-test-sample-gradle-plugin.yml
     with:
       cache-key-prefix: ${{github.run_number}}-
+
+  toolchain-detection:
+    uses: ./.github/workflows/integ-test-detect-java-toolchains.yml
+    with:
+      cache-key-prefix: ${{github.run_number}}-

.github/workflows/ci-init-script-check.yml

@@ -4,8 +4,8 @@ on:
   push:
     paths:
       - '.github/workflows/ci-init-script-check.yml'
-      - 'src/resources/init-scripts/**'
-      - 'test/init-scripts/**'
+      - 'sources/src/resources/init-scripts/**'
+      - 'sources/test/init-scripts/**'
   workflow_dispatch:
 
 jobs:
@@ -13,14 +13,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Setup Java
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@v4
       with:
         distribution: temurin
         java-version: 8
     - name: Setup Gradle
-      uses: gradle/gradle-build-action@v2.5.1 # Use a released version to avoid breakages
+      uses: gradle/actions/setup-gradle@v3-beta # Use a released version to avoid breakages
     - name: Run integration tests
-      working-directory: test/init-scripts
+      working-directory: sources/test/init-scripts
       run: ./gradlew check

.github/workflows/ci-quick-check.yml

@@ -3,14 +3,16 @@ name: CI-quick-check
 on:
   workflow_dispatch:
   push:
-    branches-ignore: main
+    branches-ignore: 
+    - main
+    - release/**
 
 jobs:
   build-distribution:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Build and upload distribution
       uses: ./.github/actions/build-dist
 
@@ -18,15 +20,16 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Configure Gradle as default for unit test
-      uses: ./
+      uses: ./setup-gradle
       with:
-        gradle-version: 8.2
+        gradle-version: 8.5
     - name: Run tests
       run: |
         npm install
         npm run all
+      working-directory: sources
 
   action-inputs:
     needs: build-distribution
@@ -45,7 +48,7 @@ jobs:
 
   caching-config:
     needs: build-distribution
-    uses: ./.github/workflows/integ-test-action-inputs-caching.yml
+    uses: ./.github/workflows/integ-test-caching-config.yml
     with:
       runner-os: '["ubuntu-latest"]'
       download-dist: true
@@ -53,6 +56,15 @@ jobs:
   dependency-graph:
     needs: build-distribution
     uses: ./.github/workflows/integ-test-dependency-graph.yml
+    permissions:
+      contents: write
+    with:
+      runner-os: '["ubuntu-latest"]'
+      download-dist: true
+
+  dependency-graph-failures:
+    needs: build-distribution
+    uses: ./.github/workflows/integ-test-dependency-graph-failures.yml
     with:
       runner-os: '["ubuntu-latest"]'
       download-dist: true
@@ -71,6 +83,15 @@ jobs:
       runner-os: '["ubuntu-latest"]'
       download-dist: true
 
+  develocity-injection:
+    needs: build-distribution
+    uses: ./.github/workflows/integ-test-inject-develocity.yml
+    with:
+      runner-os: '["ubuntu-latest"]'
+      download-dist: true
+    secrets:
+      DEVELOCITY_ACCESS_KEY: ${{ secrets.GE_SOLUTIONS_ACCESS_TOKEN }}
+
   provision-gradle-versions:
     needs: build-distribution
     uses: ./.github/workflows/integ-test-provision-gradle-versions.yml
@@ -78,12 +99,14 @@ jobs:
       runner-os: '["ubuntu-latest"]'
       download-dist: true
 
-  # restore-configuration-cache:
-  #   needs: build-distribution
-  #   uses: ./.github/workflows/integ-test-restore-configuration-cache.yml
-  #   with:
-  #     runner-os: '["ubuntu-latest"]'
-  #     download-dist: true
+  restore-configuration-cache:
+    needs: build-distribution
+    uses: ./.github/workflows/integ-test-restore-configuration-cache.yml
+    with:
+      runner-os: '["ubuntu-latest"]'
+      download-dist: true
+    secrets:
+      GRADLE_ENCRYPTION_KEY: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
 
   restore-containerized-gradle-home:
     needs: build-distribution
@@ -124,3 +147,10 @@ jobs:
     with:
       runner-os: '["ubuntu-latest"]'
       download-dist: true
+
+  toolchain-detection:
+    needs: build-distribution
+    uses: ./.github/workflows/integ-test-detect-java-toolchains.yml
+    with:
+      runner-os: '["ubuntu-latest"]'
+      download-dist: true

.github/workflows/ci-verify-outputs.yml

@@ -8,6 +8,7 @@ on:
   push:
     branches: 
       - main
+      - release/**
       - dependabot/**
 
 jobs:
@@ -15,13 +16,17 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
+    - uses: actions/setup-node@v4
+      with:
+        node-version: 20
     - name: Build
       run: |
         npm -v
         node -v
         npm install
         npm run build
+      working-directory: sources
 
     - name: Compare the expected and actual dist/ directories
       run: |
@@ -33,7 +38,7 @@ jobs:
       id: diff
 
     # If index.js was different than expected, upload the expected version as an artifact
-    - uses: actions/upload-artifact@v3
+    - uses: actions/upload-artifact@v4
       if: ${{ failure() && steps.diff.conclusion == 'failure' }}
       with:
         name: dist

.github/workflows/demo-failure-cases.yml

@@ -9,9 +9,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Test build failure
-      uses: ./
+      uses: ./setup-gradle
       continue-on-error: true
       with:
         build-root-directory: .github/workflow-samples/kotlin-dsl
@@ -21,9 +21,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Test wrapper missing
-      uses: ./
+      uses: ./setup-gradle
       continue-on-error: true
       with:
         build-root-directory: .github/workflow-samples/no-wrapper
@@ -33,9 +33,9 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Test bad config value
-      uses: ./
+      uses: ./setup-gradle
       continue-on-error: true
       with:
         build-root-directory: .github/workflow-samples/no-wrapper

.github/workflows/demo-job-summary.yml

@@ -8,25 +8,26 @@ env:
   GRADLE_BUILD_ACTION_CACHE_DEBUG_ENABLED: true
 
 jobs:
-  run-gradle-builds:
+  many-gradle-builds:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Build distribution
       shell: bash
       run: |
         npm install
         npm run build
+      working-directory: sources
     - name: Setup Gradle
-      uses: ./
+      uses: ./setup-gradle
     - name: Build kotlin-dsl project
       working-directory: .github/workflow-samples/kotlin-dsl
       run: ./gradlew assemble
-    - name: Build kotlin-dsl project without build scan
+    - name: Build kotlin-dsl project without Build Scan®
       working-directory: .github/workflow-samples/kotlin-dsl
       run: ./gradlew assemble check --no-scan
-    - name: Build kotlin-dsl project with build scan publish failure
+    - name: Build kotlin-dsl project with Build Scan® publish failure
       working-directory: .github/workflow-samples/kotlin-dsl
       run: ./gradlew check -Dgradle.enterprise.url=https://not.valid.server
     - name: Build groovy-dsl project
@@ -41,3 +42,48 @@ jobs:
       working-directory: .github/workflow-samples/groovy-dsl
       continue-on-error: true
       run: ./gradlew not-a-real-task
+
+  successful-builds-with-no-summary:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Build distribution
+      shell: bash
+      run: |
+        npm install
+        npm run build
+      working-directory: sources
+    - name: Setup Gradle
+      uses: ./setup-gradle
+      with:
+        add-job-summary: on-failure
+    - name: Build kotlin-dsl project
+      working-directory: .github/workflow-samples/kotlin-dsl
+      run: ./gradlew assemble
+    - name: Build kotlin-dsl project without Build Scan®
+      working-directory: .github/workflow-samples/kotlin-dsl
+      run: ./gradlew assemble check --no-scan
+
+  pre-existing-gradle-home:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Build distribution
+      shell: bash
+      run: |
+        npm install
+        npm run build
+      working-directory: sources
+    - name: Pre-create Gradle User Home
+      shell: bash
+      run: |
+        mkdir ~/.gradle
+        mkdir ~/.gradle/caches
+        touch ~/.gradle/caches/dummy.txt
+    - name: Setup Gradle
+      uses: ./setup-gradle
+    - name: Run build
+      working-directory: .github/workflow-samples/groovy-dsl
+      run: ./gradlew assemble

.github/workflows/demo-pr-build-scan-comment.yml

@@ -1,27 +1,51 @@
-name: Demo adding build scan comment to PR
+name: Demo adding Build Scan® comment to PR
 on:
   pull_request:
     types: [assigned, review_requested]
+
+permissions:
+  pull-requests: write
+
 jobs:
-  gradle:
+  successful-build-with-always-comment:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout project sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Setup Gradle
-      uses: ./
+      uses: ./setup-gradle
+      with:
+        add-job-summary-as-pr-comment: always
     - name: Run build with Gradle wrapper
       id: gradle
       working-directory: .github/workflow-samples/kotlin-dsl
       run: ./gradlew build --scan
-    - name: "Add build scan URL as PR comment"
-      uses: actions/github-script@v6
+
+  successful-build-with-comment-on-failure:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout project sources
+      uses: actions/checkout@v4
+    - name: Setup Gradle
+      uses: ./setup-gradle
       with:
-        github-token: ${{secrets.GITHUB_TOKEN}}
-        script: |
-          github.rest.issues.createComment({
-            issue_number: context.issue.number,
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            body: 'PR ready for review: ${{ steps.gradle.outputs.build-scan-url }}'
-          })
+        add-job-summary-as-pr-comment: on-failure
+    - name: Run build with Gradle wrapper
+      id: gradle
+      working-directory: .github/workflow-samples/kotlin-dsl
+      run: ./gradlew build --scan
+
+  failing-build-with-comment-on-failure:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout project sources
+      uses: actions/checkout@v4
+    - name: Setup Gradle
+      uses: ./setup-gradle
+      with:
+        add-job-summary-as-pr-comment: on-failure
+    - name: Run build with Gradle wrapper
+      id: gradle
+      working-directory: .github/workflow-samples/kotlin-dsl
+      run: ./gradlew no-a-real-task --scan
+      continue-on-error: true

.github/workflows/dependency-submission-save.yml

@@ -0,0 +1,25 @@
+name: Test dependency-submission save
+
+on:
+  workflow_dispatch:
+  push:
+
+permissions:
+  contents: read
+
+env:
+  GRADLE_BUILD_ACTION_CACHE_DEBUG_ENABLED: true
+
+jobs:
+  dependency-submission-save:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Generate and save dependency graph
+      uses: ./dependency-submission
+      with:
+        build-root-directory: .github/workflow-samples/groovy-dsl
+        dependency-graph-action: generate-and-save
+      env:
+        GITHUB_DEPENDENCY_GRAPH_REF: 'refs/tags/v0.0.1' # Use a different ref to avoid updating the real dependency graph for the repository

.github/workflows/dependency-submission-submit.yml

@@ -0,0 +1,23 @@
+name: Test dependency-submission submit
+
+on:
+  workflow_run:
+    workflows: ['Test dependency-submission save']
+    types: [completed]
+
+permissions:
+  contents: write
+
+env:
+  GRADLE_BUILD_ACTION_CACHE_DEBUG_ENABLED: true
+
+jobs:
+  dependency-submission-submit:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Download and submit dependency graph
+      uses: ./dependency-submission
+      with:
+        dependency-graph-action: retrieve-and-submit

.github/workflows/dependency-submission.yml

@@ -0,0 +1,24 @@
+name: Test dependency-submission
+
+on:
+  workflow_dispatch:
+  push:
+
+permissions:
+  contents: write
+
+env:
+  GRADLE_BUILD_ACTION_CACHE_DEBUG_ENABLED: true
+
+jobs:
+  test-dependency-submission:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Generate and submit dependencies
+      uses: ./dependency-submission
+      with:
+        build-root-directory: .github/workflow-samples/groovy-dsl
+      env:
+        GITHUB_DEPENDENCY_GRAPH_REF: 'refs/tags/v0.0.1' # Use a different ref to avoid updating the real dependency graph for the repository

.github/workflows/integ-test-action-inputs.yml

@@ -25,11 +25,11 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Invoke with multi-line arguments
-      uses: ./
+      uses: ./setup-gradle
       with:
         build-root-directory: .github/workflow-samples/groovy-dsl
         arguments: |

.github/workflows/integ-test-cache-cleanup.yml

@@ -25,15 +25,15 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
-      uses: ./
+      uses: ./setup-gradle
       with:
         cache-read-only: false # For testing, allow writing cache entries on non-default branches
     - name: Build with 3.1
-      working-directory: test/jest/resources/cache-cleanup
+      working-directory: sources/test/jest/resources/cache-cleanup
       run: gradle --no-daemon --build-cache -Dcommons_math3_version="3.1" build
 
   # Second build will use the cache from the first build, but cleanup should remove unused artifacts
@@ -45,16 +45,16 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
-      uses: ./
+      uses: ./setup-gradle
       with:
         cache-read-only: false
         gradle-home-cache-cleanup: true
     - name: Build with 3.1.1
-      working-directory: test/jest/resources/cache-cleanup
+      working-directory: sources/test/jest/resources/cache-cleanup
       run: gradle --no-daemon --build-cache -Dcommons_math3_version="3.1.1" build
 
   check-clean-cache:
@@ -65,11 +65,11 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
-      uses: ./
+      uses: ./setup-gradle
       with:
         cache-read-only: true
     - name: Report Gradle User Home

.github/workflows/integ-test-caching-config.yml

@@ -1,4 +1,4 @@
-name: Test action inputs for caching
+name: Test caching configuration
 
 on:
   workflow_call:
@@ -25,11 +25,11 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
-      uses: ./
+      uses: ./setup-gradle
       with:
         cache-read-only: false # For testing, allow writing cache entries on non-default branches
         # Add "enterprise" to main cache entry but omit "notifications"
@@ -38,7 +38,8 @@ jobs:
             enterprise
         # Exclude build-cache from main cache entry
         gradle-home-cache-excludes: |
-            caches/build-cache-1
+            caches/build-cache-*
+            caches/*/executionHistory
     - name: Build using Gradle wrapper
       working-directory: .github/workflow-samples/groovy-dsl
       run: ./gradlew test
@@ -52,18 +53,19 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
-      uses: ./
+      uses: ./setup-gradle
       with:
         # Use the same configuration as used in the seed build
         gradle-home-cache-includes: |
             caches
             enterprise
         gradle-home-cache-excludes: |
-            caches/build-cache-1
+            caches/build-cache-*
+            caches/*/executionHistory
         cache-read-only: true
     - name: Execute Gradle build with --offline
       working-directory: .github/workflow-samples/groovy-dsl
@@ -77,46 +79,46 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
-      uses: ./
+      uses: ./setup-gradle
       with:
         cache-disabled: true
     - name: Run Gradle build
       id: gradle
       working-directory: .github/workflow-samples/no-wrapper${{ matrix.build-root-suffix }}
       run: gradle help "-DgradleVersionCheck=${{matrix.gradle}}"
-    - name: Check build scan url is captured
+    - name: Check Build Scan url is captured
       if: ${{ !steps.gradle.outputs.build-scan-url }}
-      uses: actions/github-script@v6
+      uses: actions/github-script@v7
       with:
         script: |
-          core.setFailed('No build scan detected')
+          core.setFailed('No Build Scan detected')
 
   # Test that build scans are captured when caching is disabled because Gradle User Home already exists
   cache-disabled-pre-existing-gradle-home:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Create dummy Gradle User Home
       run: mkdir -p ~/.gradle/caches
     - name: Setup Gradle
-      uses: ./
+      uses: ./setup-gradle
     - name: Run Gradle build
       id: gradle
       working-directory: .github/workflow-samples/no-wrapper${{ matrix.build-root-suffix }}
       run: gradle help "-DgradleVersionCheck=${{matrix.gradle}}"
-    - name: Check build scan url is captured
+    - name: Check Build Scan url is captured
       if: ${{ !steps.gradle.outputs.build-scan-url }}
-      uses: actions/github-script@v6
+      uses: actions/github-script@v7
       with:
         script: |
-          core.setFailed('No build scan detected')
+          core.setFailed('No Build Scan detected')
 
   # Test seed the cache with cache-write-only and verify with cache-read-only
   seed-build-write-only:
@@ -128,11 +130,11 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
-      uses: ./
+      uses: ./setup-gradle
       with:
         cache-write-only: true
     - name: Build using Gradle wrapper
@@ -149,11 +151,11 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
-      uses: ./
+      uses: ./setup-gradle
       with:
         cache-read-only: true
     - name: Execute Gradle build with --offline

.github/workflows/integ-test-dependency-graph-failures.yml

@@ -0,0 +1,103 @@
+name: Test dependency graph
+
+on:
+  workflow_call:
+    inputs:
+      cache-key-prefix:
+        type: string
+      runner-os:
+        type: string
+        default: '["ubuntu-latest"]'
+      download-dist:
+        type: boolean
+        default: false
+
+env:
+  DOWNLOAD_DIST: ${{ inputs.download-dist }}
+  GRADLE_BUILD_ACTION_CACHE_KEY_PREFIX: dependency-graph-${{ inputs.cache-key-prefix }}
+  GRADLE_BUILD_ACTION_CACHE_DEBUG_ENABLED: true
+
+jobs:
+  unsupported-gradle-version-warning:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Download distribution if required
+      uses: ./.github/actions/download-dist
+    - name: Setup Gradle for dependency-graph generate
+      uses: ./setup-gradle
+      with:
+        gradle-version: 7.0.1
+        dependency-graph: generate
+        dependency-graph-continue-on-failure: true
+    - name: Run with unsupported Gradle version
+      working-directory: .github/workflow-samples/groovy-dsl
+      run: |
+        if gradle help | grep -q 'warning::Dependency Graph is not supported for Gradle 7.0.1. No dependency snapshot will be generated.';
+        then
+          echo "Got the expected warning"
+        else
+          echo "Did not get the expected warning"
+          exit 1
+        fi
+
+  unsupported-gradle-version-failure:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Download distribution if required
+      uses: ./.github/actions/download-dist
+    - name: Setup Gradle for dependency-graph generate
+      uses: ./setup-gradle
+      with:
+        gradle-version: 7.0.1
+        dependency-graph: generate
+        dependency-graph-continue-on-failure: false
+    - name: Run with unsupported Gradle version
+      working-directory: .github/workflow-samples/groovy-dsl
+      run: |
+        if gradle help; then
+          echo "Expected build to fail with Gradle 7.0.1"
+          exit 1
+        fi
+
+  insufficient-permissions-warning:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Download distribution if required
+      uses: ./.github/actions/download-dist
+    - name: Setup Gradle for dependency-graph generate
+      uses: ./setup-gradle
+      with:
+        dependency-graph: generate-and-submit
+        dependency-graph-continue-on-failure: true
+    - name: Run with insufficient permissions
+      working-directory: .github/workflow-samples/groovy-dsl
+      run: ./gradlew help
+      # This test is primarily for demonstration: it's unclear how to check for warnings emitted in the post-action
+
+  SHOULD_FAIL-insufficient-permissions-failure:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    continue-on-error: true
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Download distribution if required
+      uses: ./.github/actions/download-dist
+    - name: Setup Gradle for dependency-graph generate
+      uses: ./setup-gradle
+      with:
+        dependency-graph: generate-and-submit
+        dependency-graph-continue-on-failure: false
+    - name: Run with insufficient permissions
+      working-directory: .github/workflow-samples/groovy-dsl
+      run: ./gradlew help
+      # This test is primarily for demonstration: it's unclear how to check for a failure in the post-action

.github/workflows/integ-test-dependency-graph.yml

@@ -1,4 +1,4 @@
-name: Test execution with caching
+name: Test dependency graph
 
 on:
   workflow_call:
@@ -12,6 +12,9 @@ on:
         type: boolean
         default: false
 
+permissions:
+  contents: write
+
 env:
   DOWNLOAD_DIST: ${{ inputs.download-dist }}
   GRADLE_BUILD_ACTION_CACHE_KEY_PREFIX: dependency-graph-${{ inputs.cache-key-prefix }}
@@ -25,13 +28,13 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle for dependency-graph generate
-      uses: ./
+      uses: ./setup-gradle
       with:
-        dependency-graph: generate
+        dependency-graph: generate-and-upload
     - name: Run gradle build
       run: ./gradlew build
       working-directory: .github/workflow-samples/groovy-dsl
@@ -43,11 +46,11 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle for dependency-graph generate
-      uses: ./
+      uses: ./setup-gradle
       with:
         dependency-graph: generate-and-submit
     - name: Run gradle build
@@ -55,14 +58,91 @@ jobs:
       working-directory: .github/workflow-samples/kotlin-dsl
   
   submit:
-    needs: [groovy-generate, kotlin-generate]
+    needs: [groovy-generate]
     runs-on: "ubuntu-latest"
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Submit dependency graphs
-      uses: ./
+      uses: ./setup-gradle
       with:
         dependency-graph: download-and-submit
+
+  multiple-builds:
+    strategy:
+      matrix:
+        os: ${{fromJSON(inputs.runner-os)}}
+    runs-on: ${{ matrix.os }}
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Download distribution if required
+      uses: ./.github/actions/download-dist
+    - name: Setup Gradle for dependency-graph generate
+      uses: ./setup-gradle
+      with:
+        dependency-graph: generate-and-submit
+    - id: gradle-assemble
+      run: ./gradlew assemble
+      working-directory: .github/workflow-samples/groovy-dsl
+    - id: gradle-build
+      run: ./gradlew build
+      working-directory: .github/workflow-samples/groovy-dsl
+    - id: gradle-build-again
+      run: ./gradlew build
+      working-directory: .github/workflow-samples/groovy-dsl
+    - name: Check generated dependency graphs
+      shell: bash
+      run: |
+        echo "gradle-assemble report file: ${{ steps.gradle-assemble.outputs.dependency-graph-file }}"
+        echo "gradle-build report file: ${{ steps.gradle-build.outputs.dependency-graph-file }}"
+        echo "gradle-build-again report file: ${{ steps.gradle-build-again.outputs.dependency-graph-file }}"
+        ls -l dependency-graph-reports
+        if [ ! -e "${{ steps.gradle-assemble.outputs.dependency-graph-file }}" ]; then
+            echo "Did not find gradle-assemble dependency graph file"
+            exit 1
+        fi
+        if [ ! -e "${{ steps.gradle-build.outputs.dependency-graph-file }}" ]; then
+            echo "Did not find gradle-build dependency graph files"
+            exit 1
+        fi
+        if [ ! -e "${{ steps.gradle-build-again.outputs.dependency-graph-file }}" ]; then
+            echo "Did not find gradle-build-again dependency graph files"
+            exit 1
+        fi
+        
+  config-cache:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Download distribution if required
+      uses: ./.github/actions/download-dist
+    - name: Setup Gradle for dependency-graph generate
+      uses: ./setup-gradle
+      with:
+        dependency-graph: generate-and-submit
+    - id: config-cache-store
+      run: ./gradlew assemble --configuration-cache
+      working-directory: .github/workflow-samples/groovy-dsl
+    - name: Check and delete generated dependency graph
+      shell: bash
+      run: |
+        if [ ! -e "${{ steps.config-cache-store.outputs.dependency-graph-file }}" ]; then
+            echo "Did not find config-cache-store dependency graph files"
+            exit 1
+        fi
+        rm ${{ steps.config-cache-store.outputs.dependency-graph-file }}
+    - id: config-cache-reuse
+      run: ./gradlew assemble --configuration-cache
+      working-directory: .github/workflow-samples/groovy-dsl
+    - name: Check no dependency graph is generated
+      shell: bash
+      run: |
+        if [ ! -z "$(ls -A dependency-graph-reports)" ]; then
+            echo "Expected no dependency graph files to be generated"
+            ls -l dependency-graph-reports
+            exit 1
+        fi        

.github/workflows/integ-test-detect-java-toolchains.yml

@@ -0,0 +1,93 @@
+name: Test detect java toolchains
+
+on:
+  workflow_call:
+    inputs:
+      cache-key-prefix:
+        type: string
+      runner-os:
+        type: string
+        default: '["ubuntu-latest", "windows-latest", "macos-latest"]'
+      download-dist:
+        type: boolean
+        default: false
+
+env:
+  DOWNLOAD_DIST: ${{ inputs.download-dist }}
+  GRADLE_BUILD_ACTION_CACHE_KEY_PREFIX: detect-java-toolchain-${{ inputs.cache-key-prefix }}
+  GRADLE_BUILD_ACTION_CACHE_DEBUG_ENABLED: true
+
+jobs:
+  # Test that pre-installed runner JDKs are detected
+  pre-installed-toolchains:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${{fromJSON(inputs.runner-os)}}
+    runs-on: ${{ matrix.os }}
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Download distribution if required
+      uses: ./.github/actions/download-dist
+    - name: Setup Gradle
+      uses: ./setup-gradle
+    - name: List detected toolchains
+      shell: bash
+      working-directory: .github/workflow-samples/groovy-dsl
+      run: | 
+        gradle --info javaToolchains > output.txt
+        cat output.txt
+    - name: Verify detected toolchains
+      shell: bash
+      working-directory: .github/workflow-samples/groovy-dsl
+      run: | 
+        grep -q 'Eclipse Temurin JDK 1.8' output.txt || (echo "::error::Did not detect preinstalled JDK 1.8" && exit 1)
+        grep -q 'Eclipse Temurin JDK 11' output.txt || (echo "::error::Did not detect preinstalled JDK 11" && exit 1)
+        grep -q 'Eclipse Temurin JDK 17' output.txt || (echo "::error::Did not detect preinstalled JDK 17" && exit 1)
+        grep -q 'Eclipse Temurin JDK 21' output.txt || (echo "::error::Did not detect preinstalled JDK 21" && exit 1)
+
+  # Test that JDKs provisioned by setup-java are detected
+  setup-java-installed-toolchain:
+    strategy:
+      fail-fast: false
+      matrix:
+        os: ${{fromJSON(inputs.runner-os)}}
+    runs-on: ${{ matrix.os }}
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Download distribution if required
+      uses: ./.github/actions/download-dist
+    - name: Setup Java 20
+      uses: actions/setup-java@v4
+      with:
+        distribution: 'temurin'
+        java-version: '20'
+    - name: Setup Java 16
+      uses: actions/setup-java@v4
+      with:
+        distribution: 'temurin'
+        java-version: '16'
+    - name: Setup Gradle
+      uses: ./setup-gradle
+    - name: List detected toolchains
+      shell: bash
+      working-directory: .github/workflow-samples/groovy-dsl
+      run: | 
+        gradle --info javaToolchains > output.txt
+        cat output.txt
+    - name: Verify setup JDKs are detected
+      shell: bash
+      working-directory: .github/workflow-samples/groovy-dsl
+      run: | 
+        grep -q 'Eclipse Temurin JDK 16' output.txt || (echo "::error::Did not detect setup-java installed JDK 16" && exit 1)
+        grep -q 'Eclipse Temurin JDK 20' output.txt || (echo "::error::Did not detect setup-java installed JDK 20" && exit 1)
+    - name: Verify pre-installed toolchains are detected
+      shell: bash
+      working-directory: .github/workflow-samples/groovy-dsl
+      run: | 
+        grep -q 'Eclipse Temurin JDK 1.8' output.txt || (echo "::error::Did not detect preinstalled JDK 1.8" && exit 1)
+        grep -q 'Eclipse Temurin JDK 11' output.txt || (echo "::error::Did not detect preinstalled JDK 11" && exit 1)
+        grep -q 'Eclipse Temurin JDK 17' output.txt || (echo "::error::Did not detect preinstalled JDK 17" && exit 1)
+        grep -q 'Eclipse Temurin JDK 21' output.txt || (echo "::error::Did not detect preinstalled JDK 21" && exit 1)

.github/workflows/integ-test-execution-with-caching.yml

@@ -25,11 +25,11 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Execute Gradle build
-      uses: ./
+      uses: ./setup-gradle
       with:
         cache-read-only: false # For testing, allow writing cache entries on non-default branches
         build-root-directory: .github/workflow-samples/groovy-dsl
@@ -44,11 +44,11 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Execute Gradle build
-      uses: ./
+      uses: ./setup-gradle
       with:
         cache-read-only: true
         build-root-directory: .github/workflow-samples/groovy-dsl

.github/workflows/integ-test-execution.yml

@@ -30,28 +30,22 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Test use defined Gradle version
-      uses: ./
+      uses: ./setup-gradle
       with:
         cache-read-only: false # For testing, allow writing cache entries on non-default branches
         gradle-version: 6.9
         build-root-directory: .github/workflow-samples/no-wrapper
         arguments: help -DgradleVersionCheck=6.9
     - name: Test use Gradle version alias
-      uses: ./
+      uses: ./setup-gradle
       with:
         gradle-version: release-candidate
         build-root-directory: .github/workflow-samples/no-wrapper
         arguments: help
-    - name: Test use defined Gradle executable
-      uses: ./
-      with:
-        gradle-executable: .github/workflow-samples/groovy-dsl/gradlew${{ matrix.script-suffix }}
-        build-root-directory: .github/workflow-samples/no-wrapper
-        arguments: help
 
   gradle-versions:
     strategy:
@@ -68,27 +62,27 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Java
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@v4
       with:
         distribution: temurin
         java-version: 8
     - name: Run Gradle build
-      uses: ./
+      uses: ./setup-gradle
       id: gradle
       with:
         cache-read-only: false # For testing, allow writing cache entries on non-default branches
         gradle-version: ${{matrix.gradle}}
         build-root-directory: .github/workflow-samples/no-wrapper${{ matrix.build-root-suffix }}
         arguments: help -DgradleVersionCheck=${{matrix.gradle}}
-    - name: Check build scan url
+    - name: Check Build Scan url
       if: ${{ !steps.gradle.outputs.build-scan-url }}
-      uses: actions/github-script@v6
+      uses: actions/github-script@v7
       with:
         script: |
-          core.setFailed('No build scan detected')    
+          core.setFailed('No Build Scan detected')    
   
    

.github/workflows/integ-test-inject-develocity.yml

@@ -0,0 +1,97 @@
+name: Test develocity injection
+
+on:
+  workflow_call:
+    inputs:
+      cache-key-prefix:
+        type: string
+      runner-os:
+        type: string
+        default: '["ubuntu-latest", "windows-latest", "macos-latest"]'
+      download-dist:
+        type: boolean
+        default: false
+    secrets:
+      DEVELOCITY_ACCESS_KEY:
+        required: true
+
+env:
+  DOWNLOAD_DIST: ${{ inputs.download-dist }}
+  GRADLE_BUILD_ACTION_CACHE_KEY_PREFIX: provision-gradle-versions-${{ inputs.cache-key-prefix }}
+  GRADLE_BUILD_ACTION_CACHE_DEBUG_ENABLED: true
+
+jobs:
+  inject-develocity:
+    env:
+      DEVELOCITY_INJECTION_ENABLED: true
+      DEVELOCITY_URL: https://ge.solutions-team.gradle.com
+      DEVELOCITY_PLUGIN_VERSION: 3.16.1
+      DEVELOCITY_CCUD_PLUGIN_VERSION: 1.12.1
+      GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }} # This env var has not (yet) been renamed/aliased in GE plugin 3.16.1
+    strategy:
+      matrix:
+        gradle: [current, 7.6.2, 6.9.4, 5.6.4]
+        os: ${{fromJSON(inputs.runner-os)}}
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Download distribution if required
+      uses: ./.github/actions/download-dist
+    - name: Setup Java
+      uses: actions/setup-java@v4
+      with:
+        distribution: temurin
+        java-version: 8
+    - name: Setup Gradle
+      id: setup-gradle
+      uses: ./setup-gradle
+      with:
+        cache-read-only: false # For testing, allow writing cache entries on non-default branches
+        gradle-version: ${{ matrix.gradle }}
+    - name: Run Gradle build
+      id: gradle
+      working-directory: .github/workflow-samples/no-ge
+      run: gradle help
+    - name: Check Build Scan url
+      if: ${{ !steps.gradle.outputs.build-scan-url }}
+      uses: actions/github-script@v7
+      with:
+        script: |
+          core.setFailed('No Build Scan detected')   
+
+  build-scan-publish:
+    strategy:
+      matrix:
+        gradle: [current, 7.6.2, 6.9.4, 5.6.4]
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Download distribution if required
+      uses: ./.github/actions/download-dist
+    - name: Setup Java
+      uses: actions/setup-java@v4
+      with:
+        distribution: temurin
+        java-version: 8
+    - name: Setup Gradle
+      id: setup-gradle
+      uses: ./setup-gradle
+      with:
+        cache-read-only: false # For testing, allow writing cache entries on non-default branches
+        gradle-version: ${{ matrix.gradle }}
+        build-scan-publish: true
+        build-scan-terms-of-service-url: "https://gradle.com/terms-of-service"
+        build-scan-terms-of-service-agree: "yes"
+    - name: Run Gradle build
+      id: gradle
+      working-directory: .github/workflow-samples/no-ge
+      run: gradle help
+    - name: Check Build Scan url
+      if: ${{ !steps.gradle.outputs.build-scan-url }}
+      uses: actions/github-script@v7
+      with:
+        script: |
+          core.setFailed('No Build Scan detected')   
+

.github/workflows/integ-test-provision-gradle-versions.yml

@@ -30,11 +30,11 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle with v6.9
-      uses: ./
+      uses: ./setup-gradle
       with:
         cache-read-only: false # For testing, allow writing cache entries on non-default branches
         gradle-version: 6.9
@@ -42,19 +42,30 @@ jobs:
       working-directory: .github/workflow-samples/no-wrapper
       run: gradle help "-DgradleVersionCheck=6.9"
     - name: Setup Gradle with v7.1.1
-      uses: ./
+      uses: ./setup-gradle
       with:
         gradle-version: 7.1.1
     - name: Test uses Gradle v7.1.1
       working-directory: .github/workflow-samples/no-wrapper
       run: gradle help "-DgradleVersionCheck=7.1.1"
     - name: Setup Gradle with release-candidate
-      uses: ./
+      uses: ./setup-gradle
       with:
         gradle-version: release-candidate
     - name: Test use release-candidate
       working-directory: .github/workflow-samples/no-wrapper
       run: gradle help
+    - name: Setup Gradle with current
+      id: gradle-current
+      uses: ./setup-gradle
+      with:
+        gradle-version: current
+    - name: Check current version output parameter
+      if: ${{ !startsWith(steps.gradle-current.outputs.gradle-version , '8.') }}
+      uses: actions/github-script@v7
+      with:
+        script: |
+          core.setFailed('Gradle version parameter not set correctly: value was "${{ steps.gradle-current.outputs.gradle-version }}"')    
   
   gradle-versions:
     strategy:
@@ -71,28 +82,35 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Java
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@v4
       with:
         distribution: temurin
         java-version: 8
     - name: Setup Gradle
-      uses: ./
+      id: setup-gradle
+      uses: ./setup-gradle
       with:
         cache-read-only: false # For testing, allow writing cache entries on non-default branches
         gradle-version: ${{ matrix.gradle }}
+    - name: Check output parameter
+      if: ${{ steps.setup-gradle.outputs.gradle-version != matrix.gradle }}
+      uses: actions/github-script@v7
+      with:
+        script: |
+          core.setFailed('Gradle version parameter not set correctly: value was "${{ steps.setup-gradle.outputs.gradle-version }}"')    
     - name: Run Gradle build
       id: gradle
       working-directory: .github/workflow-samples/no-wrapper${{ matrix.build-root-suffix }}
       run: gradle help "-DgradleVersionCheck=${{matrix.gradle}}"
-    - name: Check build scan url
+    - name: Check Build Scan url
       if: ${{ !steps.gradle.outputs.build-scan-url }}
-      uses: actions/github-script@v6
+      uses: actions/github-script@v7
       with:
         script: |
-          core.setFailed('No build scan detected')    
+          core.setFailed('No Build Scan detected')    
   
    

.github/workflows/integ-test-restore-configuration-cache.yml

@@ -11,6 +11,9 @@ on:
       download-dist:
         type: boolean
         default: false
+    secrets:
+      GRADLE_ENCRYPTION_KEY:
+        required: true
 
 env:
   DOWNLOAD_DIST: ${{ inputs.download-dist }}
@@ -27,16 +30,23 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
+    - name: Setup Java to ensure consistency
+      uses: actions/setup-java@v4
+      with:
+        distribution: 'liberica'
+        java-version: '21'
     - name: Setup Gradle
-      uses: ./
+      uses: ./setup-gradle
       with:
         cache-read-only: false # For testing, allow writing cache entries on non-default branches
+        cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+        gradle-version: 8.6-rc-1
     - name: Groovy build with configuration-cache enabled
       working-directory: .github/workflow-samples/groovy-dsl
-      run: ./gradlew test --configuration-cache
+      run: gradle test --configuration-cache
 
   verify-build-groovy:
     env:
@@ -48,19 +58,26 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
+    - name: Setup Java to ensure consistency
+      uses: actions/setup-java@v4
+      with:
+        distribution: 'liberica'
+        java-version: '21'
     - name: Setup Gradle
-      uses: ./
+      uses: ./setup-gradle
       with:
         cache-read-only: true
+        cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+        gradle-version: 8.6-rc-1
     - name: Groovy build with configuration-cache enabled
       id: execute
       working-directory: .github/workflow-samples/groovy-dsl
-      run: ./gradlew test --configuration-cache
+      run: gradle test --configuration-cache
     - name: Check that configuration-cache was used
-      uses: actions/github-script@v6
+      uses: actions/github-script@v7
       with:
         script: |
           const fs = require('fs')
@@ -79,18 +96,25 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
+    - name: Setup Java to ensure consistency
+      uses: actions/setup-java@v4
+      with:
+        distribution: 'liberica'
+        java-version: '21'
     - name: Setup Gradle with no extracted cache entries restored
-      uses: ./
+      uses: ./setup-gradle
       env: 
         GRADLE_BUILD_ACTION_SKIP_RESTORE: "generated-gradle-jars|wrapper-zips|java-toolchains|instrumented-jars|dependencies|kotlin-dsl"
       with:
         cache-read-only: true
+        cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+        gradle-version: 8.6-rc-1
     - name: Check execute Gradle build with configuration cache enabled (but not restored)
       working-directory: .github/workflow-samples/groovy-dsl
-      run: ./gradlew test --configuration-cache
+      run: gradle test --configuration-cache
 
   seed-build-kotlin:
     env:
@@ -101,16 +125,23 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
+    - name: Setup Java to ensure consistency
+      uses: actions/setup-java@v4
+      with:
+        distribution: 'liberica'
+        java-version: '21'
     - name: Setup Gradle
-      uses: ./
+      uses: ./setup-gradle
       with:
         cache-read-only: false # For testing, allow writing cache entries on non-default branches
+        cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+        gradle-version: 8.6-rc-1
     - name: Execute 'help' with configuration-cache enabled
       working-directory: .github/workflow-samples/kotlin-dsl
-      run: ./gradlew help --configuration-cache
+      run: gradle help --configuration-cache
 
   modify-build-kotlin:
     env:
@@ -122,16 +153,23 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
+    - name: Setup Java to ensure consistency
+      uses: actions/setup-java@v4
+      with:
+        distribution: 'liberica'
+        java-version: '21'
     - name: Setup Gradle
-      uses: ./
+      uses: ./setup-gradle
       with:
         cache-read-only: false # For testing, allow writing cache entries on non-default branches
+        cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+        gradle-version: 8.6-rc-1
     - name: Execute 'test' with configuration-cache enabled
       working-directory: .github/workflow-samples/kotlin-dsl
-      run: ./gradlew test --configuration-cache
+      run: gradle test --configuration-cache
 
   # Test restore configuration-cache from the third build invocation
   verify-build-kotlin:
@@ -144,19 +182,26 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
+    - name: Setup Java to ensure consistency
+      uses: actions/setup-java@v4
+      with:
+        distribution: 'liberica'
+        java-version: '21'
     - name: Setup Gradle
-      uses: ./
+      uses: ./setup-gradle
       with:
         cache-read-only: true
+        cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+        gradle-version: 8.6-rc-1
     - name: Execute 'test' again with configuration-cache enabled
       id: execute
       working-directory: .github/workflow-samples/kotlin-dsl
-      run: ./gradlew test --configuration-cache
+      run: gradle test --configuration-cache
     - name: Check that configuration-cache was used
-      uses: actions/github-script@v6
+      uses: actions/github-script@v7
       with:
         script: |
           const fs = require('fs')

.github/workflows/integ-test-restore-containerized-gradle-home.yml

@@ -20,16 +20,16 @@ jobs:
     container: fedora:latest
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Java
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@v4
       with:
         java-version: 11
         distribution: temurin
     - name: Setup Gradle
-      uses: ./
+      uses: ./setup-gradle
       with:
         cache-read-only: false # For testing, allow writing cache entries on non-default branches
     - name: Build using Gradle wrapper
@@ -43,16 +43,16 @@ jobs:
     container: fedora:latest
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Java
-      uses: actions/setup-java@v3
+      uses: actions/setup-java@v4
       with:
         java-version: 11
         distribution: temurin
     - name: Setup Gradle
-      uses: ./
+      uses: ./setup-gradle
       with:
         cache-read-only: true
     - name: Execute Gradle build with --offline

.github/workflows/integ-test-restore-custom-gradle-home.yml

@@ -23,11 +23,11 @@ jobs:
         mkdir -p $GITHUB_WORKSPACE/gradle-user-home
         echo "GRADLE_USER_HOME=$GITHUB_WORKSPACE/gradle-user-home" >> $GITHUB_ENV
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
-      uses: ./
+      uses: ./setup-gradle
       with:
         cache-read-only: false # For testing, allow writing cache entries on non-default branches
     - name: Build using Gradle wrapper
@@ -44,11 +44,11 @@ jobs:
         mkdir -p $GITHUB_WORKSPACE/gradle-user-home
         echo "GRADLE_USER_HOME=$GITHUB_WORKSPACE/gradle-user-home" >> $GITHUB_ENV
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
-      uses: ./
+      uses: ./setup-gradle
       with:
         cache-read-only: true
     - name: Execute Gradle build with --offline
@@ -65,11 +65,11 @@ jobs:
         mkdir -p $GITHUB_WORKSPACE/gradle-user-home
         echo "GRADLE_USER_HOME=$GITHUB_WORKSPACE/gradle-user-home" >> $GITHUB_ENV
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
-      uses: ./
+      uses: ./setup-gradle
       with:
         cache-read-only: true
     - name: Execute Gradle build and verify tasks from cache

.github/workflows/integ-test-restore-gradle-home.yml

@@ -26,11 +26,11 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
-      uses: ./
+      uses: ./setup-gradle
       with:
         cache-read-only: false # For testing, allow writing cache entries on non-default branches
     - name: Build using Gradle wrapper
@@ -46,11 +46,11 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
-      uses: ./
+      uses: ./setup-gradle
       with:
         cache-read-only: true
     - name: Execute Gradle build with --offline
@@ -66,11 +66,11 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
-      uses: ./
+      uses: ./setup-gradle
       with:
         cache-read-only: true
     - name: Execute Gradle build and verify tasks from cache
@@ -86,11 +86,11 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle with no extracted cache entries restored
-      uses: ./
+      uses: ./setup-gradle
       env: 
         GRADLE_BUILD_ACTION_SKIP_RESTORE: "generated-gradle-jars|wrapper-zips|java-toolchains|instrumented-jars|dependencies|kotlin-dsl"
       with:
@@ -99,3 +99,40 @@ jobs:
       working-directory: .github/workflow-samples/groovy-dsl
       run: ./gradlew test
 
+  # Test that a pre-existing gradle-user-home can be overwritten by the restored cache
+  pre-existing-gradle-home:
+    needs: seed-build
+    strategy:
+      matrix:
+        os: ${{fromJSON(inputs.runner-os)}}
+    runs-on: ${{ matrix.os }}
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Download distribution if required
+      uses: ./.github/actions/download-dist
+    - name: Pre-create Gradle User Home
+      shell: bash
+      run: |
+        mkdir -p ~/.gradle/caches
+        touch ~/.gradle/gradle.properties
+        touch ~/.gradle/caches/dummy.txt
+    - name: Setup Gradle
+      uses: ./setup-gradle
+      with:
+        cache-read-only: true
+        cache-overwrite-existing: true
+    - name: Check that pre-existing content still exists
+      shell: bash
+      run: |
+        if [ ! -e ~/.gradle/caches/dummy.txt ]; then
+          echo "::error ::Should find dummy.txt after cache restore"
+          exit 1
+        fi
+        if [ ! -e ~/.gradle/gradle.properties ]; then
+          echo "::error ::Should find gradle.properties after cache restore"
+          exit 1
+        fi
+    - name: Execute Gradle build with --offline
+      working-directory: .github/workflow-samples/groovy-dsl
+      run: ./gradlew test --offline

.github/workflows/integ-test-restore-java-toolchain.yml

@@ -25,11 +25,11 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
-      uses: ./
+      uses: ./setup-gradle
       with:
         cache-read-only: false # For testing, allow writing cache entries on non-default branches
     - name: Build using Gradle wrapper
@@ -45,11 +45,11 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
-      uses: ./
+      uses: ./setup-gradle
       with:
         cache-read-only: true
     - name: Execute Gradle build with --offline

.github/workflows/integ-test-sample-gradle-plugin.yml

@@ -25,11 +25,11 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
-      uses: ./
+      uses: ./setup-gradle
       with:
         cache-read-only: false # For testing, allow writing cache entries on non-default branches
     - name: Build gradle-plugin project
@@ -44,11 +44,11 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
-      uses: ./
+      uses: ./setup-gradle
       with:
         cache-read-only: true
     - name: Build gradle-plugin project

.github/workflows/integ-test-sample-kotlin-dsl.yml

@@ -25,11 +25,11 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
-      uses: ./
+      uses: ./setup-gradle
       with:
         cache-read-only: false # For testing, allow writing cache entries on non-default branches
     - name: Build kotlin-dsl project
@@ -44,11 +44,11 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
-      uses: ./
+      uses: ./setup-gradle
       with:
         cache-read-only: true
     - name: Build kotlin-dsl project

.github/workflows/setup-gradle.yml

@@ -0,0 +1,20 @@
+name: Test setup-gradle
+
+on:
+  workflow_dispatch:
+  push:
+
+env:
+  GRADLE_BUILD_ACTION_CACHE_DEBUG_ENABLED: true
+
+jobs:
+  test-setup-gradle:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Setup Gradle
+      uses: ./setup-gradle
+    - name: Build groovy-dsl project
+      working-directory: .github/workflow-samples/groovy-dsl
+      run: ./gradlew assemble

CONTRIBUTING.md

@@ -1,14 +1,14 @@
 ### How to merge a Dependabot PR
 
 The "distribution" for a GitHub Action is checked into the repository itself. 
-In the case of the `gradle-build-action`, the transpiled sources are committed to the `dist` directory. 
+In the case of these actions, the transpiled sources are committed to the `dist` directory. 
 Any production dependencies are inlined into the distribution. 
 So if a Dependabot PR updates a production dependency (or a dev dependency that changes the distribution, like the Typescript compiler), 
 then a manual step is required to rebuild the dist and commit.
 
 The simplest process to follow is:
 1. Checkout the dependabot branch locally eg: `git checkout dependabot/npm_and_yarn/actions/github-5.1.0`
-2. Run `npm install` to download and the new dependencies and install locally
-3. Run `npm run build` to regenerate the distribution
+2. In the `sources` directory, run `npm install` to download NPM dependencies
+3. In the `sources` directory, run `npm run build` to regenerate the distribution
 4. Push the changes to the dependabot branch
 5. If/when the checks pass, you can merge the dependabot PR

README.md

@@ -1,530 +1,57 @@
-# Execute Gradle builds in GitHub Actions workflows
+# GitHub Actions for Gradle builds
 
-This GitHub Action can be used to configure Gradle and optionally execute a Gradle build on any platform supported by GitHub Actions.
+This repository contains a set of GitHub Actions that are useful for building Gradle projects on GitHub.
 
-## Use the action to setup Gradle
+## The `setup-gradle` action
 
-If you have an existing workflow invoking Gradle, you can add an initial "Setup Gradle" Step to benefit from caching, 
-build-scan capture and other features of the gradle-build-action.
+This replaces the previous `gradle/gradle-build-action`, which now delegates to this implementation.
 
-All subsequent Gradle invocations will benefit from this initial setup, via `init` scripts added to the Gradle User Home.
+### Example usage
 
 ```yaml
-name: Run Gradle on PRs
-on: pull_request
+name: Build
+
+on: [ push ]
+
 jobs:
-  gradle:
-    strategy:
-      matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
-    runs-on: ${{ matrix.os }}
+  build:
+    runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
-    - uses: actions/setup-java@v3
-      with:
-        distribution: temurin
-        java-version: 11
-        
+    - name: Checkout sources
+      uses: actions/checkout@v4
     - name: Setup Gradle
-      uses: gradle/gradle-build-action@v2
-    
-    - name: Execute Gradle build
+      uses: gradle/actions/setup-gradle@v3-beta
+    - name: Build with Gradle
       run: ./gradlew build
 ```
 
-## Why use the `gradle-build-action`?
+See the [full action documentation](setup-gradle/README.md) for more advanced usage scenarios.
 
-It is possible to directly invoke Gradle in your workflow, and the `actions/setup-java@v3` action provides a simple way to cache Gradle dependencies. 
+## The `dependency-submission` action
 
-However, the `gradle-build-action` offers a number of advantages over this approach:
+Generates and submits a dependency graph for a Gradle project, allowing GitHub to alert about reported vulnerabilities in your project dependencies.
 
-- Easily [run the build with different versions of Gradle](#use-a-specific-gradle-version) using the `gradle-version` parameter. Gradle distributions are automatically downloaded and cached. 
-- More sophisticated and more efficient caching of Gradle User Home between invocations, compared to `setup-java` and most custom configurations using `actions/cache`. [More details below](#caching).
-- Detailed reporting of cache usage and cache configuration options allow you to [optimize the use of the GitHub actions cache](#optimizing-cache-effectiveness).
-- [Automatic capture of build scan links](#build-scans) from the build, making these easier to locate for workflow run.
+The following workflow will generate a dependency graph for a Gradle project and submit it immediately to the repository via the
+Dependency Submission API. For most projects, this default configuration should be all that you need.
 
-The `gradle-build-action` is designed to provide these benefits with minimal configuration. 
-These features work both when Gradle is executed via the `gradle-build-action` and for any Gradle execution in subsequent steps.
-
-When using `gradle-build-action` we recommend that you _not_ use `actions/cache` or `actions/setup-java@v3` to explicitly cache the Gradle User Home. Doing so may interfere with the caching provided by this action.
-
-## Use a specific Gradle version
-
-The `gradle-build-action` can download and install a specified Gradle version, adding this installed version to the PATH.
-Downloaded Gradle versions are stored in the GitHub Actions cache, to avoid requiring downloading again later.
+Simply add this as a new workflow file to your repository (eg `.github/workflows/dependency-submission.yml`).
 
 ```yaml
- - uses: gradle/gradle-build-action@v2
-   with:
-     gradle-version: 6.5
-```
+name: Dependency Submission
 
-The `gradle-version` parameter can be set to any valid Gradle version.
+on: [ push ]
 
-Moreover, you can use the following aliases:
-
-| Alias | Selects |
-| --- |---|
-| `wrapper`           | The Gradle wrapper's version (default, useful for matrix builds) |
-| `current`           | The current [stable release](https://gradle.org/install/) |
-| `release-candidate` | The current [release candidate](https://gradle.org/release-candidate/) if any, otherwise fallback to `current` |
-| `nightly`           | The latest [nightly](https://gradle.org/nightly/), fails if none. |
-| `release-nightly`   | The latest [release nightly](https://gradle.org/release-nightly/), fails if none.      |
-
-This can be handy to automatically verify your build works with the latest release candidate of Gradle:
-
-```yaml
-name: Test latest Gradle RC
-on:
-  schedule:
-    - cron: 0 0 * * * # daily
-jobs:
-  gradle-rc:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v3
-    - uses: actions/setup-java@v3
-      with:
-        distribution: temurin
-        java-version: 11
-    - uses: gradle/gradle-build-action@v2
-      with:
-        gradle-version: release-candidate
-    - run: gradle build --dry-run # just test build configuration
-```
-
-## Gradle Execution
-
-If the action is configured with an `arguments` input, then Gradle will execute a Gradle build with the arguments provided.
-
-If no `arguments` are provided, the action will not execute Gradle, but will still cache Gradle state and configure build-scan capture for all subsequent Gradle executions.
-
-```yaml
-name: Run Gradle on PRs
-on: pull_request
-jobs:
-  gradle:
-    strategy:
-      matrix:
-        os: [ubuntu-latest, macos-latest, windows-latest]
-    runs-on: ${{ matrix.os }}
-    steps:
-    - uses: actions/checkout@v3
-    - uses: actions/setup-java@v3
-      with:
-        distribution: temurin
-        java-version: 11
-    
-    - name: Setup and execute Gradle 'test' task
-      uses: gradle/gradle-build-action@v2
-      with:
-        arguments: test
-```
-
-### Multiple Gradle executions in the same Job
-
-It is possible to configure multiple Gradle executions to run sequentially in the same job. 
-The initial Action step will perform the Gradle setup.
-
-```yaml
-- uses: gradle/gradle-build-action@v2
-  with:
-    arguments: assemble
-- uses: gradle/gradle-build-action@v2
-  with:
-    arguments: check
-```
-
-### Gradle command-line arguments
-
-The `arguments` input can be used to pass arbitrary arguments to the `gradle` command line.
-Arguments can be supplied in a single line, or as a multi-line input.
-
-Here are some valid examples:
-```yaml
-arguments: build
-arguments: check --scan
-arguments: some arbitrary tasks
-arguments: build -PgradleProperty=foo
-arguments: |
-    build
-    --scan
-    -PgradleProperty=foo
-    -DsystemProperty=bar
-```
-
-If you need to pass environment variables, use the GitHub Actions workflow syntax:
-
-```yaml
-- uses: gradle/gradle-build-action@v2
-  env:
-    CI: true
-  with:
-    arguments: build
-```
-
-### Gradle build located in a subdirectory
-
-By default, the action will execute Gradle in the root directory of your project. 
-Use the `build-root-directory` input to target a Gradle build in a subdirectory.
-
-```yaml
-- uses: gradle/gradle-build-action@v2
-  with:
-    arguments: build
-    build-root-directory: some/subdirectory
-```
-
-### Using a specific Gradle executable
-
-The action will first look for a Gradle wrapper script in the root directory of your project. 
-If not found, `gradle` will be executed from the PATH.
-Use the `gradle-executable` input to execute using a specific Gradle installation.
-
-```yaml
- - uses: gradle/gradle-build-action@v2
-   with:
-     arguments: build
-     gradle-executable: /path/to/installed/gradle
-```
-
-This mechanism can also be used to target a Gradle wrapper script that is located in a non-default location.
-
-## Caching
-
-By default, this action aims to cache any and all reusable state that may be speed up a subsequent build invocation. 
-
-The state that is cached includes:
-- Any distributions downloaded to satisfy a `gradle-version` parameter ;
-- A subset of the Gradle User Home directory, including downloaded dependencies, wrapper distributions, and the local build cache ;
-
-To reduce the space required for caching, this action makes a best effort to reduce duplication in cache entries.
-
-Caching is enabled by default. You can disable caching for the action as follows:
-```yaml
-cache-disabled: true
-```
-### Cache keys
-
-Distributions downloaded to satisfy a `gradle-version` parameter are stored outside of Gradle User Home and cached separately. The cache key is unique to the downloaded distribution and will not change over time.
-
-The state of the Gradle User Home is highly dependent on the Gradle execution, so the cache key is composed of the current commit hash and the GitHub actions job id.
-As such, the cache key is likely to change on each subsequent run of GitHub actions. 
-This allows the most recent state to always be available in the GitHub actions cache.
-
-To reduce duplication between cache entries, certain artifacts are cached independently based on their identity.
-Artifacts that are cached independently include downloaded dependencies, downloaded wrapper distributions and generated Gradle API jars.
-For example, this means that all jobs executing a particular version of the Gradle wrapper will share common entries for wrapper distributions and for generated Gradle API jars.
-
-### Using the caches read-only
-
-By default, the `gradle-build-action` will only write to the cache from Jobs on the default (`main`/`master`) branch.
-Jobs on other branches will read entries from the cache but will not write updated entries. 
-See [Optimizing cache effectiveness](#optimizing-cache-effectiveness) for a more detailed explanation.
-
-In some circumstances it makes sense to change this default, and to configure a workflow Job to read existing cache entries but not to write changes back.
-
-You can configure read-only caching for the `gradle-build-action` as follows:
-
-```yaml
-# Only write to the cache for builds on the 'main' and 'release' branches. (Default is 'main' only.)
-# Builds on other branches will only read existing entries from the cache.
-cache-read-only: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/release' }}
-```
-
-### Stopping the Gradle daemon
-
-By default, the action will stop all running Gradle daemons in the post-action step, prior to saving the Gradle User Home state. 
-This allows for any Gradle User Home cleanup to occur, and avoid file-locking issues on Windows.
-
-If caching is unavailable or the cache is in read-only mode, the daemon will not be stopped and will continue running after the job is completed.
-
-### Gradle User Home cache tuning
-
-As well as any wrapper distributions, the action will attempt to save and restore the `caches` and `notifications` directories from Gradle User Home.
-
-The contents to be cached can be fine tuned by including and excluding certain paths with Gradle User Home.
-
-```yaml
-# Cache downloaded JDKs in addition to the default directories.
-gradle-home-cache-includes: |
-    caches
-    notifications
-    jdks
-# Exclude the local build-cache and keyrings from the directories cached.
-gradle-home-cache-excludes: |
-    caches/build-cache-1
-    caches/keyrings
-```
-
-You can specify any number of fixed paths or patterns to include or exclude. 
-File pattern support is documented at https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#patterns-to-match-file-paths.
-
-### Cache debugging and analysis
-
-Gradle User Home state will be restored from the cache during the first `gradle-build-action` step for any workflow job. 
-This state will be saved back to the cache at the end of the job, after all Gradle executions have completed.
-A report of all cache entries restored and saved is printed to the Job Summary when saving the cache entries. 
-This report can provide valuable insignt into how much cache space is being used.
-
-It is possible to enable additional debug logging for cache operations. You do via the `GRADLE_BUILD_ACTION_CACHE_DEBUG_ENABLED` environment variable:
-
-```yaml
-env:
-  GRADLE_BUILD_ACTION_CACHE_DEBUG_ENABLED: true
-```
-
-Note that this setting will also prevent certain cache operations from running in parallel, further assisting with debugging.
-
-### Optimizing cache effectiveness
-
-Cache storage space for GitHub actions is limited, and writing new cache entries can trigger the deletion of existing entries.
-Eviction of shared cache entries can reduce cache effectiveness, slowing down your `gradle-build-action` steps.
-
-There are a number of actions you can take if your cache use is less effective due to entry eviction.
-
-#### Select branches that should write to the cache
-
-GitHub cache entries are not shared between builds on different branches. 
-This means that each PR branch will have it's own Gradle User Home cache, and will not benefit from cache entries written by other PR branches.
-An exception to this is that cache entries written in parent and upstream branches are visible to child branches, and cache entries for the default (`master`/`main`) branch can be read by actions invoked for any other branch.
-
-By default, the `gradle-build-action` will only _write_ to the cache for builds run on the default (`master`/`main`) branch. 
-Jobs run on other branches will only read from the cache. In most cases, this is the desired behaviour, 
-because Jobs run against other branches will benefit from the cache Gradle User Home from `main`, 
-without writing private cache entries that could lead to evicting shared entries.
-
-If you have other long-lived development branches that would benefit from writing to the cache, 
-you can configure these by overriding the `cache-read-only` action parameter. 
-See [Using the caches read-only](#using-the-caches-read-only) for more details.
-
-Similarly, you could use `cache-read-only` for certain jobs in the workflow, and instead have these jobs reuse the cache content from upstream jobs.
-
-#### Exclude content from Gradle User Home cache
-
-Each build is different, and some builds produce more Gradle User Home content than others.
-[Cache debugging ](#cache-debugging-and-analysis) can provide insight into which cache entries are the largest,
-and you can selectively [exclude content using `gradle-home-cache-exclude`](#gradle-user-home-cache-tuning).
-
-#### Removing unused files from Gradle User Home before saving to cache
-
-The Gradle User Home directory has a tendency to grow over time. When you switch to a new Gradle wrapper version or upgrade a dependency version
-the old files are not automatically and immediately removed. While this can make sense in a local environment, in a GitHub Actions environment
-it can lead to ever-larger Gradle User Home cache entries being saved and restored.
-
-In order to avoid this situation, the `gradle-build-action` supports the `gradle-home-cache-cleanup` parameter. 
-When enabled, this feature will attempt to delete any files in the Gradle User Home that were not used by Gradle during the GitHub Actions workflow, 
-prior to saving the Gradle User Home to the GitHub Actions cache.
-
-Gradle Home cache cleanup is disabled by default.  You can enable this feature for the action as follows:
-```yaml
-gradle-home-cache-cleanup: true
-```
-
-## Build reporting
-
-The `gradle-build-action` collects information about any Gradle executions that occur in a workflow, and reports these via
-a Job Summary, visible in the GitHub Actions UI. For each Gradle execution, details about the invocation are listed, together with
-a link to any Build Scan® published.
-
-Generation of a Job Summary is enabled by default. If this is not desired, it can be disable as follows:
-```yaml
-generate-job-summary: false
-```
-
-Note that the action collects information about Gradle invocations via an [Initialization Script](https://docs.gradle.org/current/userguide/init_scripts.html#sec:using_an_init_script)
-located at `USER_HOME/.gradle/init.d/build-result-capture.init.gradle`.
-If you are using init scripts for the [Gradle Enterprise Gradle Plugin](https://plugins.gradle.org/plugin/com.gradle.enterprise) like
-[`scans-init.gradle` or `gradle-enterprise-init.gradle`](https://docs.gradle.com/enterprise/gradle-plugin/#scans_gradle_com),
-you'll need to ensure these files are applied prior to `build-result-capture.init.gradle`.
-Since Gradle applies init scripts in alphabetical order, one way to ensure this is via file naming.
-
-### Build scan link as Step output
-
-As well as reporting the [Build Scan](https://gradle.com/build-scans/) link in the Job Summary,
-the `gradle-build-action` action makes this link available as a Step output named `build-scan-url`.
-
-You can then use that link in subsequent actions of your workflow. For example:
-
-```yaml
-# .github/workflows/gradle-build-pr.yml
-name: Run Gradle on PRs
-on: pull_request
-jobs:
-  gradle:
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout project sources
-      uses: actions/checkout@v3
-    - name: Setup Gradle
-      uses: gradle/gradle-build-action@v2
-    - name: Run build with Gradle wrapper
-      id: gradle
-      run: ./gradlew build --scan
-    - name: "Add build scan URL as PR comment"
-      uses: actions/github-script@v5
-      if: github.event_name == 'pull_request' && failure()
-      with:
-        github-token: ${{secrets.GITHUB_TOKEN}}
-        script: |
-          github.rest.issues.createComment({
-            issue_number: context.issue.number,
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            body: '❌ ${{ github.workflow }} failed: ${{ steps.gradle.outputs.build-scan-url }}'
-          })
-```
-
-### Saving build outputs
-
-By default, a GitHub Actions workflow using `gradle-build-action` will record the log output and any Build Scan links for your build,
-but any output files generated by the build will not be saved.
-
-To save selected files from your build execution, you can use the core [Upload-Artifact](https://github.com/actions/upload-artifact) action.
-For example:
-
-```yaml
-jobs:   
-  gradle:
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout project sources
-      uses: actions/checkout@v3
-    - name: Setup Gradle
-      uses: gradle/gradle-build-action@v2
-    - name: Run build with Gradle wrapper
-      run: ./gradlew build --scan
-    - name: Upload build reports
-      uses: actions/upload-artifact@v3
-      with:
-        name: build-reports
-        path: build/reports/
-```
-
-## Support for GitHub Enterprise Server (GHES)
-
-You can use the `gradle-build-action` on GitHub Enterprise Server, and benefit from the improved integration with Gradle. Depending on the version of GHES you are running, certain features may be limited:
-- Build scan links are captured and displayed in the GitHub Actions UI
-- Easily run your build with different versions of Gradle
-- Save/restore of Gradle User Home (requires GHES v3.5+ : GitHub Actions cache was introduced in GHES 3.5)
-- Support for GitHub Actions Job Summary (requires GHES 3.6+ : GitHub Actions Job Summary support was introduced in GHES 3.6). In earlier versions of GHES the build-results summary and caching report will be written to the workflow log, as part of the post-action step.
-
-# GitHub Dependency Graph support
-**EXPERIMENTAL**
-
-The `gradle-build-action` has experimental support for submitting a [GitHub Dependency Graph](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph) snapshot via the [GitHub Dependency Submission API](https://docs.github.com/en/rest/dependency-graph/dependency-submission?apiVersion=2022-11-28).
-
-The dependency graph snapshot is generated via integration with the [GitHub Dependency Graph Gradle Plugin](https://plugins.gradle.org/plugin/org.gradle.github-dependency-graph-gradle-plugin), and saved as a workflow artifact. The generated snapshot files can be submitted either in the same job, or in a subsequent job (in the same or a dependent workflow).
-
-The generated dependency graph snapshot reports all of the dependencies that were resolved during a bulid execution, and is used by GitHub to generate [Dependabot Alerts](https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts) for vulnerable dependencies, as well as to populate the [Dependency Graph insights view](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository#viewing-the-dependency-graph).
- 
-You enable GitHub Dependency Graph support by setting the `dependency-graph` action parameter. Valid values are:
-
-|<div style="width:290px">Option</div> | Behaviour |
-| --- |---|
-| `disabled`           | Do not generate a dependency graph for any build invocations.<p>This is the default. |
-| `generate`           | Generate a dependency graph snapshot for each build invocation, saving as a workflow artifact. |
-| `generate-and-submit` | As per `generate`, but any generated dependency graph snapshots will be submitted at the end of the job. |
-| `download-and-submit` | Download any previously saved dependency graph snapshots, submitting them via the Dependency Submission API. This can be useful to collect all snapshots in a matrix of builds and submit them in one step. |
-
-- 'disabled': Do not generate a dependency graph for any build invocations. This is the default.
-- 'generate': Generate a dependency graph snapshot for each build invocation, saving as a workflow artifact.
-- 'generate-and-submit': As per 'generate', but any generated dependency graph snapshots will be submitted at the end of the job.
-- 'download-and-submit': Download any previously saved dependency graph snapshots, submitting them via the Dependency Submission API. This can be useful to collect all snapshots in a matrix of builds and submit them in one step.
-
-Dependency Graph _submission_ (but not generation) requires the `contents: write` permission, which may need to be explicitly enabled in the workflow file.
-
-Example of a simple workflow that generates and submits a dependency graph:
-```yaml
-name: Submit dependency graph
-on:
-  push:
-  
 permissions:
   contents: write
 
 jobs:
-  build:
+  dependency-submission:
     runs-on: ubuntu-latest
     steps:
-    - uses: actions/checkout@v3
-    - name: Setup Gradle to generate and submit dependency graphs
-      uses: gradle/gradle-build-action@dependency-graph
-      with:
-        dependency-graph: generate-and-submit
-    - name: Run a build, generating the dependency graph snapshot which will be submitted
-      run: ./gradlew build
-```
-
-### Running multiple builds in a single Job
-
-GitHub tracks dependency snapshots based on the `job.correlator` value that is embedded in the snapshot. When a newer snapshot for an existing correlator is submitted, the previous snapshot is replaced. Snapshots with different `job.correlator` values are additive to the overall dependency graph for the repository.
-
-The `gradle-build-action` will generate a `job.correlator` value based on the workflow name, job id and matrix values. However, if your job steps contains multiple Gradle invocations, then a unique correlator value must be assigned to each. You assign a correlator by setting the `GITHUB_DEPENDENCY_GRAPH_JOB_CORRELATOR` environment variable.
-
-```yaml
-name: dependency-graph
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v3
-    - name: Setup Gradle to generate and submit dependency graphs
-      uses: gradle/gradle-build-action@dependency-graph
-      with:
-        dependency-graph: generate-and-submit
-    - name: Run first build using the default job correlator 'dependency-graph-build'
-      run: ./gradlew build
-    - name: Run second build providing a unique job correlator
-      run: ./gradlew test
-      env:
-         GITHUB_DEPENDENCY_GRAPH_JOB_CORRELATOR: dependency-graph-test
-      
-```
-
-### Dependency snapshots generated for pull requests
-
-This `contents: write` permission is not available for any workflow that is triggered by a pull request submitted from a forked repository, since it would permit a malicious pull request to make repository changes. 
-
-Because of this restriction, it is not possible to `generate-and-submit` a dependency graph generated for a pull-request that comes from a repository fork. In order to do so, 2 workflows will be required:
-1. The first workflow runs directly against the pull request sources and will generate the dependency graph snapshot.
-2. The second workflow is triggered on `workflow_run` of the first workflow, and will submit the previously saved dependency snapshots.
-
-Note: when `download-and-submit` is used in a workflow triggered via [workflow_run](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflow_run), the action will download snapshots saved in the triggering workflow.
-
-***Main workflow file***
-```yaml
-name: run-build-and-generate-dependency-snapshot
-
-jobs:
-  build:
-    runs-on: ubuntu-latest
-    steps:
-    - uses: actions/checkout@v3
-    - name: Setup Gradle to generate and submit dependency graphs
-      uses: gradle/gradle-build-action@v2
-      with:
-        dependency-graph: generate # Only generate in this job
-    - name: Run a build, generating the dependency graph snapshot which will be submitted
-      run: ./gradlew build
-```
-
-***Dependent workflow file***
-```yaml
-name: submit-dependency-snapshot
-
-on:
-  workflow_run:
-    workflows: ['run-build-and-generate-dependency-snapshot']
-    types: [completed]
-
-jobs:
-  submit-snapshots:
-    runs-on: ubuntu-latest
-    steps:
-      - name: Retrieve dependency graph artifact and submit
-        uses: gradle/gradle-build-action@v2
-      with:
-        dependency-graph: download-and-submit
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Generate and submit dependency graph
+      uses: gradle/actions/dependency-submission@v3-beta
 ```
 
+See the [full action documentation](dependency-submission/README.md) for more advanced usage scenarios.

action.yml

@@ -1,98 +1,13 @@
-name: "Gradle Build Action"
-description: 'Configures Gradle for use in GitHub actions, caching useful state in the GitHub actions cache'
-
-# https://help.github.com/en/articles/metadata-syntax-for-github-actions
-
-inputs:
-  gradle-version:
-    description: Gradle version to use. If specified, this Gradle version will be downloaded, added to the PATH and used for invoking Gradle.
-    required: false
-
-  gradle-executable:
-    description: Path to the Gradle executable. If specified, this executable will be added to the PATH and used for invoking Gradle.
-    required: false
-
-  build-root-directory:
-    description: Path to the root directory of the build. Default is the root of the GitHub workspace.
-    required: false
-
-  cache-disabled:
-    description: When 'true', all caching is disabled. No entries will be written to or read from the cache.
-    required: false
-    default: false
-
-  cache-read-only:
-    description: |
-      When 'true', existing entries will be read from the cache but no entries will be written.
-      By default this value is 'false' for workflows on the GitHub default branch and 'true' for workflows on other branches.
-    required: false
-    default: ${{ github.event.repository != null && github.ref_name != github.event.repository.default_branch }}
-
-  cache-write-only:
-    description: |
-      When 'true', entries will not be restored from the cache but will be saved at the end of the Job. 
-      Setting this to 'true' implies cache-read-only will be 'false'.
-    required: false
-    default: false
-
-  gradle-home-cache-includes:
-    description: Paths within Gradle User Home to cache.
-    required: false
-    default: |
-        caches
-        notifications
-
-  gradle-home-cache-excludes:
-    description: Paths within Gradle User Home to exclude from cache.
-    required: false
-  # e.g. Use the following setting to prevent the local build cache from being saved/restored
-  #      gradle-home-cache-excludes: |
-  #           caches/build-cache-1
-
-  arguments:
-    description: Gradle command line arguments (supports multi-line input)
-    required: false
-
-  generate-job-summary:
-    description: When 'false', no Job Summary will be generated for the Job.
-    required: false
-    default: true
-
-  dependency-graph:
-    description: Specifies if a GitHub dependency snapshot should be generated for each Gradle build, and if so, how. Valid values are 'disabled' (default), 'generate', 'generate-and-submit' and 'download-and-submit'.
-    required: false
-    default: 'disabled'
-
-  # EXPERIMENTAL & INTERNAL ACTION INPUTS
-  # The following action properties allow fine-grained tweaking of the action caching behaviour.
-  # These properties are experimental and not (yet) designed for production use, and may change without notice in a subsequent release of `gradle-build-action`.
-  # Use at your own risk!
-  gradle-home-cache-strict-match:
-    description: When 'true', the action will not attempt to restore the Gradle User Home entries from other Jobs.
-    required: false
-    default: false
-  workflow-job-context:
-    description: Used to uniquely identify the current job invocation. Defaults to the matrix values for this job; this should not be overridden by users (INTERNAL).
-    required: false
-    default: ${{ toJSON(matrix) }}
-  gradle-home-cache-cleanup:
-    description: When 'true', the action will attempt to remove any stale/unused entries from the Gradle User Home prior to saving to the GitHub Actions cache.
-    required: false
-    default: false
-
-  github-token:
-    description: The GitHub token used to authenticate when submitting via the Dependency Submission API.
-    default: ${{ github.token }}
-    required: false
-
-outputs:
-  build-scan-url:
-    description: Link to the build scan if any
+name: Build with Gradle
+description: A collection of actions for building Gradle projects, as well as generating a dependency graph via Dependency Submission.
 
 runs:
-  using: 'node16'
-  main: 'dist/main/index.js'
-  post: 'dist/post/index.js'
+  using: "composite"
+  steps:
+  - run: |
+      echo "::error::The path 'gradle/actions' is not a valid action. Please use 'gradle/actions/setup-gradle' or 'gradle/actions/dependency-submission'."
+      exit 1
+    shell: bash
 
 branding:
   icon: 'box'

actions/clear-dependency-graph/action.yml

@@ -1,24 +0,0 @@
-name: 'Clear dependency graph for a correlator'
-
-inputs:
-  job-correlator:
-    required: true
-
-runs:
-  using: "composite"
-  steps:
-  - name: Set current timestamp as env variable
-    shell: bash
-    run: echo "NOW=$(date -Iseconds)" >> $GITHUB_ENV
-  - name: Submit empty dependency graph
-    shell: bash
-    run: |
-      curl -L \
-      -X POST \
-      -H "Accept: application/vnd.github+json" \
-      -H "Authorization: Bearer ${{ github.token }}" \
-      -H "X-GitHub-Api-Version: 2022-11-28" \
-      https://api.github.com/repos/${{ github.repository }}/dependency-graph/snapshots \
-      -d '{ "version" : 0, "job" : { "id" : "${{ github.run_id }}", "correlator" : "${{ inputs.job-correlator }} " }, "sha" : "${{ github.sha }}", "ref" : "${{ github.ref }}",  "detector" : { "name" : "GitHub Dependency Graph Gradle Plugin", "version" : "0.0.3", "url" : "https://github.com/gradle/github-dependency-graph-gradle-plugin" }, "manifests" : {}, "scanned" : "${{ env.NOW }}" }'
-  - run: echo "::notice ::Cleared dependency graph for job correlator '${{ inputs.job-correlator }}'"
-    shell: bash

dependency-submission/README.md

@@ -0,0 +1,190 @@
+# The `dependency-submission` action
+
+Generates and submits a dependency graph for a Gradle project. This action is designed to be used in a standalone workflow.
+The intention is to provide a simple, standardised way to enable Dependency Graph support for Gradle repositories,
+with a long-term goal of having this functionality enabled by default for Gradle projects on GitHub.
+
+## General usage
+
+The following workflow will generate a dependency graph for a Gradle project and submit it immediately to the repository via the
+Dependency Submission API. For most projects, this default configuration should be all that you need.
+
+Simply add this as a new workflow file to your repository (eg `.github/workflows/dependency-submission.yml`).
+
+```yaml
+name: Dependency Submission
+
+on: [ push ]
+
+permissions:
+  contents: write
+
+jobs:
+  dependency-submission:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Generate and submit dependency graph
+      uses: gradle/actions/dependency-submission@v3-beta
+```
+
+### Configuration parameters
+
+In some cases, the default action configuration will not be sufficient, and additional action parameters will need to be specified.
+
+See the example below for a summary, and the [Action Metadata file](../dependency-submission/action.yml) for a more detailed description of each input parameter.
+
+```yaml
+name: Dependency Submission with advanced config
+
+on: [ push ]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-submission:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Generate and save dependency graph
+      uses: gradle/actions/dependency-submission@v3-beta
+      with:
+        # Use a particular Gradle version instead of the configured wrapper.
+        gradle-version: 8.6-rc-2
+
+        # The gradle project is not in the root of the repository.
+        build-root-directory: my-gradle-project
+
+        # Enable configuration-cache reuse for this build.
+        cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+
+        # Do not attempt to submit the dependency-graph. Save it as a workflow artifact.
+        dependency-graph-action: generate-and-save
+```
+
+## Integrating the `dependency-review-action`
+
+The GitHub [dependency-review-action](https://github.com/actions/dependency-review-action) helps you 
+understand dependency changes (and the security impact of these changes) for a pull request,
+by comparing the dependency graph for the pull-request with that of the HEAD commit.
+
+Example of a pull request workflow that executes a build for a pull request and runs the `dependency-review-action`:
+
+```yaml
+name: Dependency review for pull requests
+
+on: [ pull_request ]
+
+permissions:
+  contents: write
+
+jobs:
+  dependency-submission:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Generate and submit dependency graph
+      uses: gradle/actions/dependency-submission@v3-beta
+  
+  dependency-review:
+    needs: dependency-submission
+    runs-on: ubuntu-latest
+    steps:
+    - name: Perform dependency review
+      uses: actions/dependency-review-action@v3
+```
+
+Note that the `dependency-submission` action submits the dependency graph at the completion of the workflow Job.
+For this reason, the `dependency-review-action` must be executed in a dependent job, and not as a subsequent step in the job that generates the dependency graph.
+
+## Usage with pull requests from public forked repositories
+
+This `contents: write` permission is [not available for any workflow that is triggered by a pull request submitted from a public forked repository](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token).
+This limitation is designed to prevent a malicious pull request from effecting repository changes.
+
+Because of this restriction, we require 2 separate workflows in order to generate and submit a dependency graph:
+1. The first workflow runs directly against the pull request sources and will `generate-and-save` the dependency graph.
+2. The second workflow is triggered on `workflow_run` of the first workflow, and will `retrieve-and-submit` the previously saved dependency graph.
+
+***Main workflow file***
+```yaml
+name: Generate and save dependency graph
+
+on: [ pull_request ]
+
+permissions:
+  contents: read # 'write' permission is not available
+
+jobs:
+  dependency-submission:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Generate and submit dependency graph
+      uses: gradle/actions/dependency-submission@v3-beta
+      with:
+        dependency-graph-action: generate-and-save
+```
+
+***Dependent workflow file***
+```yaml
+name: Retrieve and submit dependency graph
+
+on:
+  workflow_run:
+    workflows: ['Generate and save dependency graph']
+    types: [completed]
+
+permissions:
+  contents: write
+
+jobs:
+  submit-dependency-graph:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Retrieve and submit dependency graph
+      uses: gradle/actions/dependency-submission@v3-beta
+      with:
+        dependency-graph-action: retrieve-and-submit # Download saved dependency-graph and submit
+```
+
+### Integrating `dependency-review-action` for pull requests from public forked repositories
+
+To integrate the `dependency-review-action` into the pull request workflows above, a third workflow file is required.
+This workflow will be triggered directly on `pull_request`, but will wait until the dependency graph results are
+submitted before the dependency review can complete. The period to wait is controlled by the `retry-on-snapshot-warnings` input parameters.
+
+Here's an example of a separate "Dependency Review" workflow that will wait for 10 minutes for the above PR check workflow to complete.
+
+```yaml
+name: dependency-review
+
+on: [ pull_request ]
+
+permissions:
+  contents: read
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+    - name: 'Dependency Review'
+      uses: actions/dependency-review-action@v3
+      with:
+        retry-on-snapshot-warnings: true
+        retry-on-snapshot-warnings-timeout: 600
+```
+
+The `retry-on-snapshot-warnings-timeout` (in seconds) needs to be long enough to allow the entire `Generate and save dependency graph` and `Retrieve and submit dependency graph` workflows (above) to complete.
+
+## Gradle version compatibility
+
+Dependency-graph generation is compatible with most versions of Gradle >= `5.2`, and is tested regularly against 
+Gradle versions `5.2.1`, `5.6.4`, `6.0.1`, `6.9.4`, `7.1.1` and `7.6.3`, as well as all patched versions of Gradle 8.x.
+
+A known exception to this is that Gradle `7.0`, `7.0.1` and `7.0.2` are not supported.

dependency-submission/action.yml

@@ -0,0 +1,70 @@
+name: Gradle Dependency Submission
+description: Generates a dependency graph for a Gradle project and submits it via the Dependency Submission API
+
+inputs:
+  gradle-version:
+    description: |
+      Gradle version to use. If specified, this Gradle version will be downloaded, added to the PATH and used for invoking Gradle.
+      If not provided, it is assumed that the project uses the Gradle Wrapper.
+    required: false
+  build-root-directory:
+    description: Path to the root directory of the build. Default is the root of the GitHub workspace.
+    required: false
+  cache-encryption-key:
+    description: |
+      A base64 encoded AES key used to encrypt the configuration-cache data. The key is exported as 'GRADLE_ENCRYPTION_KEY' for later steps. 
+      A suitable key can be generated with `openssl rand -base64 16`.
+      Configuration-cache data will not be saved/restored without an encryption key being provided.
+    required: false
+  dependency-graph-action:
+    description: |
+      Specifies how the dependency-graph should be handled by this action. By default a dependency-graph will be generated and submitted.
+      Valid values are:
+        'generate-and-submit' (default): Generates a dependency graph for the project and submits it in the same Job.
+        'generate-and-save': Generates a dependency graph for the project and saves it as a workflow artifact.
+        'retrieve-and-submit': Retrieves a previously saved dependency-graph and submits it to the repository.
+
+      The `generate-and-upload` and `download-and-submit` options are designed to be used in an untrusted workflow scenario,
+      where the workflow generating the dependency-graph cannot (or should not) be given the `contents: write` permissions
+      required to submit via the Dependency Submission API.
+    required: false
+    default: 'generate-and-submit'
+
+runs:
+  using: "composite"
+  steps:
+    - name: Generate and submit dependency graph
+      if: ${{ inputs.dependency-graph-action == 'generate-and-submit' }}
+      uses: gradle/actions/setup-gradle@v3-beta
+      with:
+        dependency-graph: 'generate-and-submit'
+        dependency-graph-continue-on-failure: false
+        gradle-version: ${{ inputs.gradle-version }}
+        build-root-directory: ${{ inputs.build-root-directory }}
+        cache-encryption-key: ${{ inputs.cache-encryption-key }}
+        arguments: |
+          --no-configure-on-demand
+          --dependency-verification=off
+          --stacktrace
+          :ForceDependencyResolutionPlugin_resolveAllDependencies
+    - name: Generate and save dependency graph
+      if: ${{ inputs.dependency-graph-action == 'generate-and-save' }}
+      uses: gradle/actions/setup-gradle@v3-beta
+      with:
+        dependency-graph: generate-and-upload
+        dependency-graph-continue-on-failure: false
+        gradle-version: ${{ inputs.gradle-version }}
+        build-root-directory: ${{ inputs.build-root-directory }}
+        cache-encryption-key: ${{ inputs.cache-encryption-key }}
+        arguments: |
+          --no-configure-on-demand
+          --dependency-verification=off
+          --stacktrace
+          :ForceDependencyResolutionPlugin_resolveAllDependencies
+    - name: Download and submit dependency graph
+      if: ${{ inputs.dependency-graph-action == 'retrieve-and-submit' }}
+      uses: gradle/actions/setup-gradle@v3-beta
+      with:
+        dependency-graph: download-and-submit
+        dependency-graph-continue-on-failure: false
+        cache-disabled: true

package.json

@@ -1,60 +0,0 @@
-{
-  "name": "gradle-build-action",
-  "version": "1.0.0",
-  "private": true,
-  "description": "Execute Gradle Build",
-  "scripts": {
-    "postinstall": "patch-package",
-    "format": "prettier --write **/*.ts",
-    "format-check": "prettier --check **/*.ts",
-    "lint": "eslint src/**/*.ts",
-
-    "compile-main": "ncc build src/main.ts --out dist/main --source-map --no-source-map-register",
-    "compile-post": "ncc build src/post.ts --out dist/post --source-map --no-source-map-register",
-    "compile": "npm run compile-main && npm run compile-post",
-
-    "test": "jest",
-    "check": "npm run format && npm run lint",
-    "build": "npm run check && npm run compile",
-    "all": "npm run build && npm test"
-  },
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/gradle/gradle-build-action.git"
-  },
-  "keywords": [
-    "github",
-    "actions",
-    "github-actions",
-    "gradle"
-  ],
-  "license": "MIT",
-  "dependencies": {
-    "@actions/artifact": "1.1.1",
-    "@actions/cache": "3.2.1",
-    "@actions/core": "1.10.0",
-    "@actions/exec": "1.1.1",
-    "@actions/github": "5.1.1",
-    "@actions/glob": "0.4.0",
-    "@actions/http-client": "2.1.0",
-    "@actions/tool-cache": "2.0.1",
-    "@octokit/rest": "19.0.13",
-    "string-argv": "0.3.2"
-  },
-  "devDependencies": {
-    "@types/node": "16.11.21",
-    "@types/jest": "29.5.2",
-    "@types/unzipper": "0.10.6",
-    "@typescript-eslint/parser": "5.61.0",
-    "@vercel/ncc": "0.36.1",
-    "eslint": "8.44.0",
-    "eslint-plugin-github": "4.8.0",
-    "eslint-plugin-jest": "27.2.2",
-    "jest": "29.6.1",
-    "js-yaml": "4.1.0", 
-    "patch-package": "7.0.0",
-    "prettier": "3.0.0",
-    "ts-jest": "29.1.1",
-    "typescript": "5.1.6"
-  }
-}

setup-gradle/README.md

@@ -0,0 +1,884 @@
+# Configure Gradle for GitHub Actions workflows
+
+This GitHub Action can be used to configure Gradle for optimal execution on any platform supported by GitHub Actions.
+
+## Why use the `setup-gradle` action?
+
+It is possible to directly invoke Gradle in your workflow, and the `actions/setup-java@v4` action provides a simple way to cache Gradle dependencies. 
+
+However, the `setup-gradle` action offers a number of advantages over this approach:
+
+- Easily [configure your workflow to use a specific version of Gradle](#choose-a-specific-gradle-version) using the `gradle-version` parameter. Gradle distributions are automatically downloaded and cached. 
+- More sophisticated and more efficient caching of Gradle User Home between invocations, compared to `setup-java` and most custom configurations using `actions/cache`. [More details below](#caching-build-state-between-jobs).
+- Detailed reporting of cache usage and cache configuration options allow you to [optimize the use of the GitHub actions cache](#optimizing-cache-effectiveness).
+- [Generate and Submit a GitHub Dependency Graph](#github-dependency-graph-support) for your project, enabling Dependabot security alerts.
+- [Automatic capture of Build Scan® links](#build-reporting) from the build, making these easier to locate for workflow run.
+
+The `setup-gradle` action is designed to provide these benefits with minimal configuration. 
+These features work both when Gradle is executed via `setup-gradle` and for any Gradle execution in subsequent steps.
+
+## General usage
+
+The `setup-gradle` action works by configuring environment variables and by adding a set of Gradle init-scripts to the Gradle User Home. These will apply to all Gradle executions on the runner, no matter how Gradle is invoked. 
+This means that if you have an existing workflow that executes Gradle with a `run` step, you can add an initial "Setup Gradle" Step to benefit from caching, build-scan capture and other features of this action.
+
+
+```yaml
+name: Run Gradle on every push
+on: push
+jobs:
+  gradle:
+    strategy:
+      matrix:
+        os: [ubuntu-latest, macos-latest, windows-latest]
+    runs-on: ${{ matrix.os }}
+    steps:
+    - uses: actions/checkout@v4
+    - uses: actions/setup-java@v4
+      with:
+        distribution: temurin
+        java-version: 11
+        
+    - name: Setup Gradle
+      uses: gradle/actions/setup-gradle@v3-beta
+    
+    - name: Execute Gradle build
+      run: ./gradlew build
+```
+
+## Choose a specific Gradle version
+
+The `setup-gradle` action can download and install a specified Gradle version, adding this installed version to the PATH.
+Downloaded Gradle versions are stored in the GitHub Actions cache, to avoid requiring downloading again later.
+
+```yaml
+ - uses: gradle/actions/setup-gradle@v3-beta
+   with:
+     gradle-version: 6.5
+```
+
+The `gradle-version` parameter can be set to any valid Gradle version.
+
+Moreover, you can use the following aliases:
+
+| Alias | Selects |
+| --- |---|
+| `wrapper`           | The Gradle wrapper's version (default, useful for matrix builds) |
+| `current`           | The current [stable release](https://gradle.org/install/) |
+| `release-candidate` | The current [release candidate](https://gradle.org/release-candidate/) if any, otherwise fallback to `current` |
+| `nightly`           | The latest [nightly](https://gradle.org/nightly/), fails if none. |
+| `release-nightly`   | The latest [release nightly](https://gradle.org/release-nightly/), fails if none.      |
+
+This can be handy to automatically verify your build works with the latest release candidate of Gradle:
+
+The actual Gradle version used is available as an action output: `gradle-version`.
+
+```yaml
+name: Test latest Gradle RC
+on:
+  schedule:
+    - cron: 0 0 * * * # daily
+jobs:
+  gradle-rc:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - uses: actions/setup-java@v4
+      with:
+        distribution: temurin
+        java-version: 11
+    - uses: gradle/actions/setup-gradle@v3-beta
+      id: setup-gradle
+      with:
+        gradle-version: release-candidate
+    - run: gradle build --dry-run # just test build configuration
+    - run: echo "The release-candidate version was ${{ steps.setup-gradle.outputs.gradle-version }}"
+```
+
+## Caching build state between Jobs
+
+The `setup-gradle` action will use the GitHub Actions cache to save and restore reusable state that may be speed up a subsequent build invocation. This includes most content that is downloaded from the internet as part of a build, as well as expensive to create content like compiled build scripts, transformed Jar files, etc.
+
+The state that is cached includes:
+- Any distributions downloaded to satisfy a `gradle-version` parameter ;
+- A subset of the Gradle User Home directory, including downloaded dependencies, wrapper distributions, and the local build cache ;
+
+To reduce the space required for caching, this action makes a best effort to reduce duplication in cache entries.
+
+State will be restored from the cache during the first `setup-gradle` step for any workflow job, and cache entries will be written back to the cache at the end of the job, after all Gradle executions have completed.
+
+### Disabling caching
+
+Caching is enabled by default. You can disable caching for the action as follows:
+```yaml
+cache-disabled: true
+```
+
+### Using the cache read-only
+
+By default, The `setup-gradle` action will only write to the cache from Jobs on the default (`main`/`master`) branch.
+Jobs on other branches will read entries from the cache but will not write updated entries. 
+See [Optimizing cache effectiveness](#select-which-branches-should-write-to-the-cache) for a more detailed explanation.
+
+In some circumstances it makes sense to change this default, and to configure a workflow Job to read existing cache entries but not to write changes back.
+
+You can configure read-only caching for `setup-gradle` as follows:
+
+```yaml
+cache-read-only: true
+```
+
+You can also configure read-only caching only for certain branches:
+
+```yaml
+# Only write to the cache for builds on the 'main' and 'release' branches. (Default is 'main' only.)
+# Builds on other branches will only read existing entries from the cache.
+cache-read-only: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/release' }}
+```
+
+### Using the cache write-only
+
+In certain circumstances it may be desirable to start with a clean Gradle User Home state, but to save that state at the end of a workflow Job:
+
+```yaml
+cache-write-only: true
+```
+
+### Overwriting an existing Gradle User Home
+
+When the action detects that the Gradle User Home caches directory already exists (`~/.gradle/caches`), then by default it will not overwrite the existing content of this directory.
+This can occur when a prior action initializes this directory, or when using a self-hosted runner that retains this directory between uses.
+
+In this case the Job Summary will display a message like: 
+> Caching for Gradle actions was disabled due to pre-existing Gradle User Home
+
+If you want override the default and have The `setup-gradle` action caches overwrite existing content in the Gradle User Home, you can set the `cache-overwrite-existing` parameter to 'true':
+
+```yaml
+cache-overwrite-existing: true
+```
+
+### Saving configuration-cache data
+
+When Gradle is executed with the [configuration-cache](https://docs.gradle.org/current/userguide/configuration_cache.html) enabled, the configuration-cache data is stored
+in the project directory, at `<project-dir>/.gradle/configuration-cache`. Due to the way the configuration-cache works, [this file may contain stored credentials and other
+secrets](https://docs.gradle.org/release-nightly/userguide/configuration_cache.html#config_cache:secrets), and this data needs to be encrypted in order to be safely stored in the GitHub Actions cache.
+
+In order to benefit from configuration caching in your GitHub Actions workflow, you must:
+- Execute your build with Gradle 8.6 or newer. This can be achieved directly, or via the Gradle Wrapper.
+- Enable the configuration cache for your build.
+- Generate a [valid Gradle encryption key](https://docs.gradle.org/8.6-rc-1/userguide/configuration_cache.html#config_cache:secrets:configuring_encryption_key) and save it as a [GitHub Actions secret](https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions).
+- Provide the secret key via the `cache-encryption-key` action parameter.
+
+```yaml
+jobs:
+  gradle-with-configuration-cache:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - uses: gradle/actions/setup-gradle@v3-beta
+      with:
+        gradle-version: 8.6-rc-1
+        cache-encryption-key: ${{ secrets.GradleEncryptionKey }}
+    - run: gradle build --configuration-cache
+```
+
+### Incompatibility with other caching mechanisms
+
+When using `setup-gradle` we recommend that you avoid using other mechanisms to save and restore the Gradle User Home. 
+
+Specifically:
+- Avoid using `actions/cache` configured to cache the Gradle User Home, [as described in this example](https://github.com/actions/cache/blob/main/examples.md#java---gradle).
+- Avoid using `actions/setup-java` with the `cache: gradle` option, [as described here](https://github.com/actions/setup-java#caching-gradle-dependencies).
+
+Using either of these mechanisms may interfere with the caching provided by this action. If you choose to use a different mechanism to save and restore the Gradle User Home, you should disable the caching provided by this action, as described above.
+
+### Cache debugging and analysis
+
+A report of all cache entries restored and saved is printed to the Job Summary when saving the cache entries. 
+This report can provide valuable insight into how much cache space is being used.
+
+It is possible to enable additional debug logging for cache operations. You do via the `GRADLE_BUILD_ACTION_CACHE_DEBUG_ENABLED` environment variable:
+
+```yaml
+env:
+  GRADLE_BUILD_ACTION_CACHE_DEBUG_ENABLED: true
+```
+
+Note that this setting will also prevent certain cache operations from running in parallel, further assisting with debugging.
+
+## How Gradle User Home caching works
+
+### Properties of the GitHub Actions cache
+
+The GitHub Actions cache has some properties that present problems for efficient caching of the Gradle User Home.
+- Immutable entries: once a cache entry is written for a key, it cannot be overwritten or changed.
+- Branch scope: cache entries written for a Git branch are not visible from actions running against different branches. Entries written for the default branch are visible to all. https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#restrictions-for-accessing-a-cache
+- Restore keys: if no exact match is found, a set of partial keys can be provided that will match by cache key prefix. https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#matching-a-cache-key
+
+Each of these properties has influenced the design and implementation of the caching in `setup-gradle`, as described below.
+
+### Which content is cached
+
+Using experiments and observations, we have attempted to identify which Gradle User Home content is worth saving and restoring between build invocations. We considered both the respective size of the content and the impact this content has on build times. As well as the obvious candidates like downloaded dependencies, we saw that compiled build scripts, transformed Jar files and other content can also have a significant impact.
+
+In the end, we opted to save and restore as much content as is practical, including:
+- `caches/<version>/generated-gradle-jars`: These files are generated on first use of a particular Gradle version, and are expensive to recreate
+- `caches/<version>/kotlin-dsl` and `caches/<version>/scripts`: These are the compiled build scripts. The Kotlin ones in particular can benefit from caching.
+- `caches/modules-2`: The downloaded dependencies
+- `caches/transforms-3`: The results of artifact transforms
+- `caches/jars-9`: Jar files that have been processed/instrumented by Gradle
+- `caches/build-cache-1`: The local build cache
+
+In certain cases a particular section of Gradle User Home will be too large to make caching effective. In these cases, particular subdirectories can be excluded from caching. See [Exclude content from Gradle User Home cache](#exclude-content-from-gradle-user-home-cache).
+
+### Cache keys
+
+The actual content of the Gradle User Home after a build is the result of many factors, including:
+- Core Gradle build files (`settings.gradle[.kts]`, `build.gradle[.kts]`, `gradle.properties`)
+- Associated Gradle configuration files (`gradle-wrapper.properties`, `dependencies.toml`, etc)
+- The entire content of `buildSrc` or any included builds that provide plugins.
+- The entire content of the repository, in the case of the local build cache.
+- The actual build command that was invoked, including system properties and environment variables.
+
+For this reason, it's very difficult to create a cache key that will deterministically map to a saved Gradle User Home state. So instead of trying to reliably hash all of these inputs to generate a cache key, the Gradle User Home cache key is based on the currently executing Job and the current commit hash for the repository.
+
+The Gradle User Home cache key is composed of:
+- The current operating system (`RUNNER_OS`)
+- The Job id
+- A hash of the Job matrix parameters and the workflow name
+- The git SHA for the latest commit
+
+Specifically, the cache key is: `${cache-protocol}-gradle|${runner-os}|${job-id}[${hash-of-job-matrix-and-workflow-name}]-${git-sha}`
+
+As such, the cache key is likely to change on each subsequent run of GitHub actions. 
+This allows the most recent state to always be available in the GitHub actions cache.
+
+### Finding a matching cache entry
+
+In most cases, no exact match will exist for the cache key. Instead, the Gradle User Home will be restored for the closest matching cache entry, using a set of "restore keys". The entries will be matched with the following precedence:
+- An exact match on OS, job id, workflow name, matrix and Git SHA
+- The most recent entry saved for the same OS, job id, workflow name and matrix values
+- The most recent entry saved for the same OS and job id
+- The most recent entry saved for the same OS
+
+Due to branch scoping of cache entries, the above match will be first performed for entries from the same branch, and then for the default ('main') branch.
+
+After the Job is complete, the current Gradle User Home state will be collected and written as a new cache entry with the complete cache key. Old entries will be expunged from the GitHub Actions cache on a least-recently-used basis.
+
+Note that while effective, this mechanism is not inherently efficient. It requires the entire Gradle User Home directory to be stored separately for each branch, for every OS+Job+Matrix combination. In addition, a new cache entry to be written on every GitHub Actions run. 
+
+This inefficiency is effectively mitigated by [Deduplication of Gradle User Home cache entries](#deduplication-of-gradle-user-home-cache-entries), and can be further optimized for a workflow using the techniques described in [Optimizing cache effectiveness](#optimizing-cache-effectiveness).
+
+### Deduplication of Gradle User Home cache entries
+
+To reduce duplication between cache entries, certain artifacts in Gradle User Home are extracted and cached independently based on their identity. This allows each Gradle User Home cache entry to be relatively small, sharing common elements between them without duplication.
+
+Artifacts that are cached independently include:
+- Downloaded dependencies
+- Downloaded wrapper distributions
+- Generated Gradle API jars
+- Downloaded Java Toolchains
+
+For example, this means that all jobs executing a particular version of the Gradle wrapper will share a single common entry for this wrapper distribution and one for each of the generated Gradle API jars.
+
+### Stopping the Gradle daemon
+
+By default, the action will stop all running Gradle daemons in the post-action step, prior to saving the Gradle User Home state. 
+This allows for any Gradle User Home cleanup to occur, and avoid file-locking issues on Windows.
+
+If caching is disabled or the cache is in read-only mode, the daemon will not be stopped and will continue running after the job is completed.
+
+## Optimizing cache effectiveness
+
+Cache storage space for GitHub actions is limited, and writing new cache entries can trigger the deletion of existing entries.
+Eviction of shared cache entries can reduce cache effectiveness, slowing down your `setup-gradle` steps.
+
+There are a number of actions you can take if your cache use is less effective due to entry eviction.
+
+At the end of a Job, The `setup-gradle` action will write a summary of the Gradle builds executed, together with a detailed report of the cache entries that were read and written during the Job. This report can provide valuable insights that may help to determine the right way to optimize the cache usage for your workflow.
+
+### Select which jobs should write to the cache
+
+Consider a workflow that first runs a Job "compile-and-unit-test" to compile the code and run some basic unit tests, which is followed by a matrix of parallel "integration-test" jobs that each run a set of integration tests for the repository. Each "integration test" Job requires all of the dependencies required by "compile-and-unit-test", and possibly one or 2 additional dependencies.
+
+By default, a new cache entry will be written on completion of each integration test job. If no additional dependencies were downloaded then this cache entry will share the "dependencies" entry with the "compile-and-unit-test" job, but if a single dependency was downloaded then an entire new "dependencies" entry would be written. (The `setup-gradle` action does not _yet_ support a layered cache that could do this more efficiently). If each of these "integration-test" entries with their different "dependencies" entries is too large, then it could result in other important entries being evicted from the GitHub Actions cache.
+
+There are some techniques that can be used to avoid/mitigate this issue:
+- Configure the "integration-test" jobs with `cache-read-only: true`, meaning that the Job will use the entry written by the "compile-and-unit-test" job. This will avoid the overhead of cache entries for each of these jobs, at the expense of re-downloading any additional dependencies required by "integration-test".
+- Add an additional step to the "compile-and-unit-test" job which downloads all dependencies required by the integration-test jobs but does not execute the tests. This will allow the "dependencies" entry for "compile-and-unit-test" to be shared among all cache entries for "integration-test". The resulting "integration-test" entries should be much smaller, reducing the potential for eviction.
+- Combine the above 2 techniques, so that no cache entry is written by "integration-test" jobs, but all required dependencies are already present from the restored "compile-and-unit-test" entry.
+
+### Select which branches should write to the cache
+
+GitHub cache entries are not shared between builds on different branches. 
+Workflow runs can restore caches created in either the current branch or the default branch (usually main).
+This means that each branch will have it's own Gradle User Home cache scope, and will not benefit from cache entries written for other (non-default) branches.
+
+By default, The `setup-gradle` action will only _write_ to the cache for builds run on the default (`master`/`main`) branch. 
+Jobs run on other branches will only read from the cache. In most cases, this is the desired behavior. 
+This is because Jobs run on other branches will benefit from the cache Gradle User Home from `main`, 
+without writing private cache entries that which could lead to evicting these shared entries.
+
+If you have other long-lived development branches that would benefit from writing to the cache, 
+you can configure this by disabling the `cache-read-only` action parameter for these branches. 
+See [Using the cache read-only](#using-the-cache-read-only) for more details.
+
+Note there are some cases where writing cache entries is typically unhelpful (these are disabled by default):
+- For `pull_request` triggered runs, the cache scope is limited to the merge ref (`refs/pull/.../merge`) and can only be restored by re-runs of the same pull request.
+- For `merge_group` triggered runs, the cache scope is limited to a temporary branch with a special prefix created to validate pull request changes, and won't be available on subsequent Merge Queue executions.
+
+  
+### Exclude content from Gradle User Home cache
+
+As well as any wrapper distributions, the action will attempt to save and restore the `caches` and `notifications` directories from Gradle User Home.
+
+Each build is different, and some builds produce more Gradle User Home content than others.
+[Cache debugging ](#cache-debugging-and-analysis) can provide insight into which cache entries are the largest,
+and the contents to be cached can be fine tuned by including and excluding certain paths within Gradle User Home.
+
+```yaml
+# Cache downloaded JDKs in addition to the default directories.
+gradle-home-cache-includes: |
+    caches
+    notifications
+    jdks
+# Exclude the local build-cache and keyrings from the directories cached.
+gradle-home-cache-excludes: |
+    caches/build-cache-1
+    caches/keyrings
+```
+
+You can specify any number of fixed paths or patterns to include or exclude. 
+File pattern support is documented at https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#patterns-to-match-file-paths.
+
+### Remove unused files from Gradle User Home before saving to cache
+
+The Gradle User Home directory has a tendency to grow over time. When you switch to a new Gradle wrapper version or upgrade a dependency version
+the old files are not automatically and immediately removed. While this can make sense in a local environment, in a GitHub Actions environment
+it can lead to ever-larger Gradle User Home cache entries being saved and restored.
+
+In order to avoid this situation, The `setup-gradle` action supports the `gradle-home-cache-cleanup` parameter. 
+When enabled, this feature will attempt to delete any files in the Gradle User Home that were not used by Gradle during the GitHub Actions workflow, 
+prior to saving the Gradle User Home to the GitHub Actions cache.
+
+Gradle Home cache cleanup is considered experimental and is disabled by default.  You can enable this feature for the action as follows:
+```yaml
+gradle-home-cache-cleanup: true
+```
+
+## Build reporting
+
+The `setup-gradle` action collects information about any Gradle executions that occur in a workflow, including the root project,
+requested tasks, build outcome and any Build Scan link generated. Details of cache entries read and written are also collected.
+These details are compiled into a Job Summary, which is visible in the GitHub Actions UI.
+
+Generation of a Job Summary is enabled by default for all Jobs using The `setup-gradle` action. This feature can be configured
+so that a Job Summary is never generated, or so that a Job Summary is only generated on build failure:
+```yaml
+add-job-summary: 'on-failure' # Valid values are 'always' (default), 'never', and 'on-failure'
+```
+
+### Adding Job Summary as a Pull Request comment
+
+It is sometimes more convenient to view the results of a GitHub Actions Job directly from the Pull Request that triggered
+the Job. For this purpose you can configure the action so that Job Summary data is added as a Pull Request comment.
+
+
+```yaml
+name: CI
+on:
+  pull_request:
+
+permissions:
+  pull-requests: write
+
+jobs:
+  run-gradle-build:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout project sources
+      uses: actions/checkout@v4
+    - name: Setup Gradle
+      uses: gradle/actions/setup-gradle@v3-beta
+      with:
+        add-job-summary-as-pr-comment: on-failure # Valid values are 'never' (default), 'always', and 'on-failure'
+    - run: ./gradlew build --scan
+```
+
+Note that in order to add a Pull Request comment, the workflow must be configured with the `pull-requests: write` permission.
+
+
+### Build Scan® link as Step output
+
+As well as reporting all [Build Scan](https://gradle.com/build-scans/) links in the Job Summary,
+The `setup-gradle` action action makes this link available an an output of any Step that executes Gradle.
+
+The output name is `build-scan-url`. You can then use the build scan link in subsequent actions of your workflow. 
+
+### Saving arbitrary build outputs
+
+By default, a GitHub Actions workflow using `setup-gradle` will record the log output and any Build Scan 
+links for your build, but any output files generated by the build will not be saved.
+
+To save selected files from your build execution, you can use the core [Upload-Artifact](https://github.com/actions/upload-artifact) action.
+For example:
+
+```yaml
+jobs:   
+  gradle:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout project sources
+      uses: actions/checkout@v4
+    - name: Setup Gradle
+      uses: gradle/actions/setup-gradle@v3-beta
+    - name: Run build with Gradle wrapper
+      run: ./gradlew build --scan
+    - name: Upload build reports
+      uses: actions/upload-artifact@v3
+      if: always()
+      with:
+        name: build-reports
+        path: build/reports/
+```
+
+### Use of custom init-scripts in Gradle User Home
+
+Note that the action collects information about Gradle invocations via an [Initialization Script](https://docs.gradle.org/current/userguide/init_scripts.html#sec:using_an_init_script)
+located at `USER_HOME/.gradle/init.d/gradle-actions.build-result-capture.init.gradle`.
+
+If you are adding any custom init scripts to the `USER_HOME/.gradle/init.d` directory, it may be necessary to ensure these files are applied prior to `gradle-actions.build-result-capture.init.gradle`.
+Since Gradle applies init scripts in alphabetical order, one way to ensure this is via file naming.
+
+## Support for GitHub Enterprise Server (GHES)
+
+You can use The `setup-gradle` action on GitHub Enterprise Server, and benefit from the improved integration with Gradle. Depending on the version of GHES you are running, certain features may be limited:
+- Build Scan links are captured and displayed in the GitHub Actions UI
+- Easily run your build with different versions of Gradle
+- Save/restore of Gradle User Home (requires GHES v3.5+ : GitHub Actions cache was introduced in GHES 3.5)
+- Support for GitHub Actions Job Summary (requires GHES 3.6+ : GitHub Actions Job Summary support was introduced in GHES 3.6). In earlier versions of GHES the build-results summary and caching report will be written to the workflow log, as part of the post-action step.
+
+# GitHub Dependency Graph support
+
+The `setup-gradle` action has support for submitting a [GitHub Dependency Graph](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph) snapshot via the [GitHub Dependency Submission API](https://docs.github.com/en/rest/dependency-graph/dependency-submission?apiVersion=2022-11-28).
+
+The dependency graph snapshot is generated via integration with the [GitHub Dependency Graph Gradle Plugin](https://plugins.gradle.org/plugin/org.gradle.github-dependency-graph-gradle-plugin), and saved as a workflow artifact. The generated snapshot files can be submitted either in the same job, or in a subsequent job (in the same or a dependent workflow).
+
+The generated dependency graph snapshot reports all of the dependencies that were resolved during a build execution, and is used by GitHub to generate [Dependabot Alerts](https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts) for vulnerable dependencies, as well as to populate the [Dependency Graph insights view](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository#viewing-the-dependency-graph).
+
+## Enable Dependency Graph generation for a workflow
+ 
+You enable GitHub Dependency Graph support by setting the `dependency-graph` action parameter. Valid values are:
+
+| Option | Behaviour |
+| --- | --- |
+| `disabled`            | Do not generate a dependency graph for any build invocations.<p>This is the default. |
+| `generate`            | Generate a dependency graph snapshot for each build invocation. |
+| `generate-and-submit` | Generate a dependency graph snapshot for each build invocation, and submit these via the Dependency Submission API on completion of the job. |
+| `generate-and-upload` | Generate a dependency graph snapshot for each build invocation, saving as a workflow artifact. |
+| `download-and-submit` | Download any previously saved dependency graph snapshots, and submit them via the Dependency Submission API. This can be useful to submit [dependency graphs for pull requests submitted from a repository forks](#dependency-graphs-for-pull-request-workflows). |
+
+Example of a CI workflow that generates and submits a dependency graph:
+```yaml
+name: CI build
+on:
+  push:
+  
+permissions:
+  contents: write
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - name: Setup Gradle to generate and submit dependency graphs
+      uses: gradle/actions/setup-gradle@v3-beta
+      with:
+        dependency-graph: generate-and-submit
+    - name: Run the usual CI build (dependency-graph will be generated and submitted post-job)
+      run: ./gradlew build
+```
+
+The `contents: write` permission is required in order to submit (but not generate) the dependency graph file. 
+Depending on [repository settings](https://docs.github.com/en/actions/security-guides/automatic-token-authentication#permissions-for-the-github_token), this permission may be available by default or may need to be explicitly enabled in the workflow file (as above).
+
+> [!IMPORTANT]
+> The above configuration will work for workflows that run as a result of commits to a repository branch, 
+> but not when a workflow is triggered by a PR from a repository fork.
+> This is because the `contents: write` permission is not available when executing a workflow 
+> for a PR submitted from a forked repository.
+> For a configuration that supports this setup, see [Dependency Graphs for pull request workflows](#dependency-graphs-for-pull-request-workflows).
+
+### Making dependency graph failures cause Job failures
+
+By default, if a failure is encountered when generating or submitting the dependency graph, the action will log the failure as a warning and continue.
+This allows your workflow to be resilient to dependency graph failures, in case dependency graph production is a side-effect rather than the primary purpose of a workflow.
+
+If instead you have a workflow that has a primary purpose to generate and submit a dependency graph, then it makes sense for this workflow to fail if the dependency
+graph cannot be generated or submitted. You can enable this behaviour with the `dependency-graph-continue-on-failure` parameter, which defaults to `true`.
+
+```yaml
+# Ensure that the workflow Job will fail if the dependency graph cannot be submitted
+- uses: gradle/actions/setup-gradle@v3-beta
+  with:
+    dependency-graph: generate-and-submit
+    dependency-graph-continue-on-failure: false
+```
+
+### Using a custom plugin repository
+
+By default, the action downloads the `github-dependency-graph-gradle-plugin` from the Gradle Plugin Portal (https://plugins.gradle.org). If your GitHub Actions environment does not have access to this URL, you can specify a custom plugin repository to use. 
+Do so by setting the `GRADLE_PLUGIN_REPOSITORY_URL` environment variable with your Gradle invocation.
+
+```yaml
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - name: Setup Gradle to generate and submit dependency graphs
+      uses: gradle/actions/setup-gradle@v3-beta
+      with:
+        dependency-graph: generate-and-submit
+    - name: Run a build, resolving the 'dependency-graph' plugin from the plugin portal proxy
+      run: ./gradlew build
+      env:
+        GRADLE_PLUGIN_REPOSITORY_URL: "https://gradle-plugins-proxy.mycorp.com"
+```
+
+### Integrating the `dependency-review-action`
+
+The GitHub [dependency-review-action](https://github.com/actions/dependency-review-action) helps you 
+understand dependency changes (and the security impact of these changes) for a pull request.
+For the `dependency-review-action` to succeed, it must run _after_ the dependency graph has been submitted for a PR.
+
+When using `generate-and-submit`, dependency graph files are submitted at the end of the job, after all steps have been
+executed. For this reason, the `dependency-review-action` must be executed in a dependent job,
+and not as a subsequent step in the job that generates the dependency graph.
+
+Example of a pull request workflow that executes a build for a pull request and runs the `dependency-review-action`:
+
+```yaml
+name: PR check
+
+on:
+  pull_request:
+  
+permissions:
+  contents: write
+  # Note that this permission will not be available if the PR is from a forked repository
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - name: Setup Gradle to generate and submit dependency graphs
+      uses: gradle/actions/setup-gradle@v3-beta
+      with:
+        dependency-graph: generate-and-submit
+    - name: Run a build and generate the dependency graph which will be submitted post-job
+      run: ./gradlew build
+
+  dependency-review:
+    needs: build
+    runs-on: ubuntu-latest
+    - name: Perform dependency review
+      uses: actions/dependency-review-action@v4
+```
+
+See [Dependency Graphs for pull request workflows](#dependency-graphs-for-pull-request-workflows) for a more complex
+(and less functional) example that will work for pull requests submitted from forked repositories.
+
+## Limiting the scope of the dependency graph
+
+At times it is helpful to limit the dependencies reported to GitHub, in order to security alerts for dependencies that don't form a critical part of your product.
+For example, a vulnerability in the tool you use to generate documentation is unlikely to be as important as a vulnerability in one of your runtime dependencies.
+
+There are a number of techniques you can employ to limit the scope of the generated dependency graph:
+- [Don't generate a dependency graph for all Gradle executions](#choosing-which-gradle-invocations-will-generate-a-dependency-graph)
+- [For a Gradle execution, filter which Gradle projects and configurations will contribute dependencies](#filtering-which-gradle-configurations-contribute-to-the-dependency-graph)
+- [Use a separate workflow that only resolves the required dependencies](#use-a-dedicated-workflow-for-dependency-graph-generation)
+
+> [!NOTE]
+> Ideally, all dependencies involved in building and testing a project will be extracted and reported in a dependency graph. 
+> These dependencies would be assigned to different scopes (eg development, runtime, testing) and the GitHub UI would make it easy to opt-in to security alerts for different dependency scopes.
+> However, this functionality does not yet exist.
+
+### Choosing which Gradle invocations will generate a dependency graph
+
+Once you enable the dependency graph support for a workflow job (via the `dependency-graph` parameter), dependencies will be collected and reported for all subsequent Gradle invocations.
+If you have a Gradle build step that you want to exclude from dependency graph generation, you can set the `GITHUB_DEPENDENCY_GRAPH_ENABLED` environment variable to `false`.
+
+```yaml
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - name: Setup Gradle to generate and submit dependency graphs
+      uses: gradle/actions/setup-gradle@v3-beta
+      with:
+        dependency-graph: generate-and-submit
+    - name: Build the app, generating a graph of dependencies required
+      run: ./gradlew :my-app:assemble
+    - name: Run all checks, disabling dependency graph generation
+      run: ./gradlew check
+      env:
+        GITHUB_DEPENDENCY_GRAPH_ENABLED: false
+```
+
+### Filtering which Gradle Configurations contribute to the dependency graph
+
+If you do not want the dependency graph to include every dependency configuration in every project in your build, you can limit the
+dependency extraction to a subset of these.
+
+To restrict which Gradle subprojects contribute to the report, specify which projects to include via a regular expression.
+You can provide this value via the `DEPENDENCY_GRAPH_INCLUDE_PROJECTS` environment variable or system property.
+
+To restrict which Gradle configurations contribute to the report, you can filter configurations by name using a regular expression.
+You can provide this value via the `DEPENDENCY_GRAPH_INCLUDE_CONFIGURATIONS` environment variable or system property.
+
+For example, if you want to exclude dependencies in the `buildSrc` project, and only report on dependencies from the `runtimeClasspath` configuration,
+you would use the following configuration:
+
+```yaml
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - name: Setup Gradle to generate and submit dependency graphs
+      uses: gradle/actions/setup-gradle@v3-beta
+      with:
+        dependency-graph: generate-and-submit
+    - name: Run a build, generating the dependency graph from any resolved 'runtimeClasspath' configurations
+      run: ./gradlew build
+      env:
+        DEPENDENCY_GRAPH_INCLUDE_PROJECTS: "^:(?!buildSrc).*"
+        DEPENDENCY_GRAPH_INCLUDE_CONFIGURATIONS: runtimeClasspath
+```
+
+### Use a dedicated workflow for dependency graph generation
+
+Instead of generating a dependency graph from your existing CI workflow, it's possible to create a separate dedicated workflow (or Job) that is intended for generating a dependency graph.
+Such a workflow will still need to execute Gradle, but can do so in a way that is targeted at resolving the specific dependencies required.
+
+For example, the following workflow will report those dependencies that are resolved in order to build the `distributionZip` for the `my-app` project. Test dependencies and other dependencies not required by the `distributionZip` will not be included.
+
+```yaml
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - name: Setup Gradle to generate and submit dependency graphs
+      uses: gradle/actions/setup-gradle@v3-beta
+      with:
+        dependency-graph: generate-and-submit
+    - name: Build the distribution Zip for `my-app`
+      run: ./gradlew :my-app:distributionZip
+```
+
+Note that the above example will also include any `buildSrc` dependencies, dependencies resolved when configuring your Gradle build or dependencies resolved while applying plugin. All of these dependencies are resolved in the process of running the `distributionZip` task, and thus will form part of the generated dependency graph.
+
+If this isn't desirable, you will still need to use the filtering mechanism described above.
+
+## Dependency Graphs for pull request workflows
+
+This `contents: write` permission is not available for any workflow that is triggered by a pull request submitted from a forked repository, since it would permit a malicious pull request to make repository changes. 
+
+Because of this restriction, it is not possible to `generate-and-submit` a dependency graph generated for a pull-request that comes from a repository fork. In order to do so, 2 workflows will be required:
+1. The first workflow runs directly against the pull request sources and will generate the dependency graph snapshot.
+2. The second workflow is triggered on `workflow_run` of the first workflow, and will submit the previously saved dependency snapshots.
+
+Note: when `download-and-submit` is used in a workflow triggered via [workflow_run](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflow_run), the action will download snapshots saved in the triggering workflow.
+
+***Main workflow file***
+```yaml
+name: run-build-and-generate-dependency-snapshot
+
+on:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - name: Setup Gradle to generate and submit dependency graphs
+      uses: gradle/actions/setup-gradle@v3-beta
+      with:
+        dependency-graph: generate-and-upload # Generate graphs and save as workflow artifacts
+    - name: Run a build, generating the dependency graph snapshot which will be submitted
+      run: ./gradlew build
+```
+
+***Dependent workflow file***
+```yaml
+name: submit-dependency-snapshot
+
+on:
+  workflow_run:
+    workflows: ['run-build-and-generate-dependency-snapshot']
+    types: [completed]
+
+permissions:
+  contents: write
+
+jobs:
+  submit-dependency-graph:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Retrieve dependency graph artifact and submit
+      uses: gradle/actions/setup-gradle@v3-beta
+      with:
+        dependency-graph: download-and-submit # Download saved workflow artifacts and submit
+```
+
+### Integrating `dependency-review-action` for pull request workflows
+
+The GitHub [dependency-review-action](https://github.com/actions/dependency-review-action) helps you 
+understand dependency changes (and the security impact of these changes) for a pull request.
+
+To integrate the `dependency-review-action` into the pull request workflows above, a separate workflow should be added.
+This workflow will be triggered directly on `pull_request`, but will need to wait until the dependency graph results are
+submitted before the dependency review can complete. How long to wait is controlled by the `retry-on-snapshot-warnings` input parameters.
+
+Here's an example of a separate "Dependency Review" workflow that will wait for 10 minutes for the PR check workflow to complete.
+
+```yaml
+name: dependency-review
+on:
+  pull_request:
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+    - name: 'Dependency Review'
+      uses: actions/dependency-review-action@v4
+      with:
+        retry-on-snapshot-warnings: true
+        retry-on-snapshot-warnings-timeout: 600
+```
+
+The `retry-on-snapshot-warnings-timeout` (in seconds) needs to be long enough to allow the entire `run-build-and-generate-dependency-snapshot` and `submit-dependency-snapshot` workflows (above) to complete.
+
+## Gradle version compatibility
+
+The GitHub Dependency Graph plugin should be compatible with all versions of Gradle >= 5.0, and has been tested against 
+Gradle versions "5.6.4", "6.9.4", "7.0.2", "7.6.2", "8.0.2" and the current Gradle release.
+
+The plugin is compatible with running Gradle with the configuration-cache enabled. However, this support is
+limited to Gradle "8.1.0" and later:
+- With Gradle "8.0", the build should run successfully, but an empty dependency graph will be generated.
+- With Gradle <= "7.6.4", the plugin will cause the build to fail with configuration-cache enabled.
+
+To use this plugin with versions of Gradle older than "8.1.0", you'll need to invoke Gradle with the
+configuration-cache disabled.
+
+## Reducing storage costs for saved dependency graph artifacts
+
+When `generate` or `generate-and-submit` is used with the action, the dependency graph that is generated is stored as a workflow artifact. 
+By default, these artifacts are retained for a period of 30 days (or as configured for the repository).
+To reduce storage costs for these artifacts, you can set the `artifact-retention-days` value to a lower number.
+
+```yaml
+    steps:
+    - name: Generate dependency graph, but only retain artifact for one day
+      uses: gradle/actions/setup-gradle@v3-beta
+      with:
+        dependency-graph: generate
+        artifact-retention-days: 1
+```
+
+
+
+# Develocity plugin injection
+
+The `setup-gradle` action provides support for injecting and configuring the Develocity Gradle plugin into any Gradle build, without any modification to the project sources.
+This is achieved via an init-script installed into Gradle User Home, which is enabled and parameterized via environment variables.
+
+The same auto-injection behavior is available for the Common Custom User Data Gradle plugin, which enriches any build scans published with additional useful information.
+
+## Enabling Develocity injection
+
+In order to enable Develocity injection for your build, you must provide the required configuration via environment variables. 
+
+Here's a minimal example:
+
+```yaml
+name: Run build with Develocity injection
+  
+env:
+  DEVELOCITY_INJECTION_ENABLED: true
+  DEVELOCITY_URL: https://develocity.your-server.com
+  DEVELOCITY_PLUGIN_VERSION: 3.16.1
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - name: Setup Gradle
+      uses: gradle/actions/setup-gradle@v3-beta
+    - name: Run a Gradle build with Develocity injection enabled
+      run: ./gradlew build
+```
+
+This configuration will automatically apply `v3.16.1` of the [Develocity Gradle plugin](https://docs.gradle.com/enterprise/gradle-plugin/), and publish build scans to https://develocity.your-server.com.
+
+This example assumes that the `develocity.your-server.com` server allows anonymous publishing of build scans.
+In the likely scenario that your Develocity server requires authentication, you will also need to configure an addition environment variable
+with a valid [Develocity access key](https://docs.gradle.com/enterprise/gradle-plugin/#via_environment_variable).
+
+## Configuring Develocity injection
+
+The `init-script` supports a number of additional configuration parameters that you may fine useful. All configuration options (required and optional) are detailed below:
+
+| Variable                          | Required | Description |
+|-----------------------------------| --- | --- |
+| DEVELOCITY_INJECTION_ENABLED      | :white_check_mark: | enables Develocity injection |
+| DEVELOCITY_URL                    | :white_check_mark: | the URL of the Develocity server |
+| DEVELOCITY_ALLOW_UNTRUSTED_SERVER | | allow communication with an untrusted server; set to _true_ if your Develocity instance is using a self-signed certificate |
+| DEVELOCITY_ENFORCE_URL            | | enforce the configured Develocity URL over a URL configured in the project's build; set to _true_ to enforce publication of build scans to the configured Develocity URL |
+| DEVELOCITY_PLUGIN_VERSION         | :white_check_mark: | the version of the [Develocity Gradle plugin](https://docs.gradle.com/enterprise/gradle-plugin/) to apply |
+| DEVELOCITY_CCUD_PLUGIN_VERSION    |  | the version of the [Common Custom User Data Gradle plugin](https://github.com/gradle/common-custom-user-data-gradle-plugin) to apply, if any |
+| GRADLE_PLUGIN_REPOSITORY_URL      |  | the URL of the repository to use when resolving the Develocity and CCUD plugins; the Gradle Plugin Portal is used by default |
+
+## Publishing to scans.gradle.com
+
+Develocity injection is designed to enable publishing of build scans to a Develocity instance,
+but is also useful for publishing to the public Build Scans instance (https://scans.gradle.com).
+
+To publish to https://scans.gradle.com, you must specify in your workflow that you accept the [Gradle Terms of Service](https://gradle.com/terms-of-service).
+
+```yaml
+name: Run build and publish Build Scan
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+    - name: Setup Gradle to publish build scans
+      uses: gradle/actions/setup-gradle@v3-beta
+      with:
+        build-scan-publish: true
+        build-scan-terms-of-service-url: "https://gradle.com/terms-of-service"
+        build-scan-terms-of-service-agree: "yes"
+
+    - name: Run a Gradle build - a build scan will be published automatically
+      run: ./gradlew build
+```
+

setup-gradle/action.yml

@@ -0,0 +1,151 @@
+name: "Gradle Build Action"
+description: 'Configures Gradle for GitHub actions, caching state and generating a dependency graph via Dependency Submission.'
+
+# https://help.github.com/en/articles/metadata-syntax-for-github-actions
+
+inputs:
+  gradle-version:
+    description: Gradle version to use. If specified, this Gradle version will be downloaded, added to the PATH and used for invoking Gradle.
+    required: false
+
+  cache-disabled:
+    description: When 'true', all caching is disabled. No entries will be written to or read from the cache.
+    required: false
+    default: false
+
+  cache-read-only:
+    description: |
+      When 'true', existing entries will be read from the cache but no entries will be written.
+      By default this value is 'false' for workflows on the GitHub default branch and 'true' for workflows on other branches.
+    required: false
+    default: ${{ github.event.repository != null && github.ref_name != github.event.repository.default_branch }}
+
+  cache-write-only:
+    description: |
+      When 'true', entries will not be restored from the cache but will be saved at the end of the Job. 
+      Setting this to 'true' implies cache-read-only will be 'false'.
+    required: false
+    default: false
+
+  cache-overwrite-existing:
+    description: When 'true', a pre-existing Gradle User Home will not prevent the cache from being restored.
+    required: false
+    default: false
+
+  cache-encryption-key:
+    description: |
+      A base64 encoded AES key used to encrypt the configuration-cache data. The key is exported as 'GRADLE_ENCRYPTION_KEY' for later steps. 
+      A suitable key can be generated with `openssl rand -base64 16`.
+      Configuration-cache data will not be saved/restored without an encryption key being provided.
+    required: false
+
+  gradle-home-cache-includes:
+    description: Paths within Gradle User Home to cache.
+    required: false
+    default: |
+        caches
+        notifications
+
+  gradle-home-cache-excludes:
+    description: Paths within Gradle User Home to exclude from cache.
+    required: false
+  # e.g. Use the following setting to prevent the local build cache from being saved/restored
+  #      gradle-home-cache-excludes: |
+  #           caches/build-cache-1
+
+  gradle-home-cache-cleanup:
+    description: When 'true', the action will attempt to remove any stale/unused entries from the Gradle User Home prior to saving to the GitHub Actions cache.
+    required: false
+    default: false
+
+  add-job-summary:
+    description: Specifies when a Job Summary should be inluded in the action results. Valid values are 'never', 'always' (default), and 'on-failure'.
+    required: false
+    default: 'always'
+
+  add-job-summary-as-pr-comment:
+    description: Specifies when each Job Summary should be added as a PR comment. Valid values are 'never' (default), 'always', and 'on-failure'. No action will be taken if the workflow was not triggered from a pull request.
+    required: false
+    default: 'never'
+
+  dependency-graph:
+    description: Specifies if a GitHub dependency snapshot should be generated for each Gradle build, and if so, how. Valid values are 'disabled' (default), 'generate', 'generate-and-submit', 'generate-and-upload', 'download-and-submit' and 'clear'.
+    required: false
+    default: 'disabled'
+
+  dependency-graph-continue-on-failure:
+    description: When 'false' a failure to generate or submit a dependency graph will fail the Step or Job. When 'true' a warning will be emitted but no failure will result.
+    required: false
+    default: true
+
+  artifact-retention-days:
+    description: Specifies the number of days to retain any artifacts generated by the action. If not set, the default retention settings for the repository will apply.
+    required: false
+
+  build-scan-publish:
+    description: |
+      Set to 'true' to automatically publish build results as a Build Scan on scans.gradle.com.
+      For publication to succeed without user input, you must also provide values for `build-scan-terms-of-service-url` and 'build-scan-terms-of-service-agree'.
+    required: false
+    default: false
+
+  build-scan-terms-of-service-url:
+    description: The URL to the Build Scan® terms of service. This input must be set to 'https://gradle.com/terms-of-service'.
+    required: false
+  
+  build-scan-terms-of-service-agree:
+    description: Indicate that you agree to the Build Scan® terms of service. This input value must be "yes".
+    required: false
+
+  # DEPRECATED ACTION INPUTS
+  arguments:
+    description: Gradle command line arguments (supports multi-line input)
+    required: false
+    deprecation-message: Using the action to execute Gradle directly is deprecated in favor of using the action to setup Gradle, and executing Gradle in a subsequent Step.
+
+  build-root-directory:
+    description: Path to the root directory of the build. Default is the root of the GitHub workspace.
+    required: false
+    deprecation-message: Using the action to execute Gradle directly is deprecated in favor of using the action to setup Gradle, and executing Gradle in a subsequent Step.
+
+  generate-job-summary:
+    description: When 'false', no Job Summary will be generated for the Job.
+    required: false
+    default: true
+    deprecation-message: Superceded by the new 'add-job-summary' and 'add-job-summary-as-pr-comment' parameters.
+
+  # EXPERIMENTAL & INTERNAL ACTION INPUTS
+  # The following action properties allow fine-grained tweaking of the action caching behaviour.
+  # These properties are experimental and not (yet) designed for production use, and may change without notice in a subsequent release of `setup-gradle`.
+  # Use at your own risk!
+  gradle-home-cache-strict-match:
+    description: When 'true', the action will not attempt to restore the Gradle User Home entries from other Jobs.
+    required: false
+    default: false
+    
+  workflow-job-context:
+    description: Used to uniquely identify the current job invocation. Defaults to the matrix values for this job; this should not be overridden by users (INTERNAL).
+    required: false
+    default: ${{ toJSON(matrix) }}
+
+  github-token:
+    description: The GitHub token used to authenticate when submitting via the Dependency Submission API.
+    default: ${{ github.token }}
+    required: false
+
+outputs:
+  build-scan-url:
+    description: Link to the Build Scan® generated by a Gradle build. Note that this output applies to a Step executing Gradle, not to the `setup-gradle` Step itself.
+  dependency-graph-file:
+    description: Path to the GitHub Dependency Graph snapshot file generated by a Gradle build. Note that this output applies to a Step executing Gradle, not to the `setup-gradle` Step itself.
+  gradle-version:
+    description: Version of Gradle that was setup by the action
+
+runs:
+  using: 'node20'
+  main: '../dist/main/index.js'
+  post: '../dist/post/index.js'
+
+branding:
+  icon: 'box'
+  color: 'gray-dark'

sources/.tool-versions

@@ -1,3 +1,3 @@
 # Configuration file for asdf version manager
-nodejs 16.18.1
-gradle 8.2
+nodejs 20.10.0
+gradle 8.5

sources/package.json

@@ -0,0 +1,62 @@
+{
+  "name": "gradle-actions",
+  "version": "1.0.0",
+  "private": true,
+  "description": "Execute Gradle Build",
+  "scripts": {
+    "postinstall": "patch-package",
+    "format": "prettier --write **/*.ts",
+    "format-check": "prettier --check **/*.ts",
+    "lint": "eslint src/**/*.ts",
+    "compile-main": "ncc build src/main.ts --out ../dist/main --source-map --no-source-map-register",
+    "compile-post": "ncc build src/post.ts --out ../dist/post --source-map --no-source-map-register",
+    "compile": "npm-run-all --parallel compile-*",
+    "check": "npm-run-all --parallel format lint",
+    "test": "jest",
+    "build": "npm run check && npm run compile",
+    "all": "npm run build && npm test"
+  },
+  "repository": {
+    "type": "git",
+    "url": "git+https://github.com/gradle/actions.git"
+  },
+  "keywords": [
+    "github",
+    "actions",
+    "github-actions",
+    "gradle"
+  ],
+  "license": "MIT",
+  "dependencies": {
+    "@actions/artifact": "2.1.0",
+    "@actions/cache": "3.2.3",
+    "@actions/core": "1.10.1",
+    "@actions/exec": "1.1.1",
+    "@actions/github": "6.0.0",
+    "@actions/glob": "0.4.0",
+    "@actions/http-client": "2.2.0",
+    "@actions/tool-cache": "2.0.1",
+    "@octokit/rest": "19.0.13",
+    "@octokit/webhooks-types": "7.3.1",
+    "semver": "7.5.4",
+    "string-argv": "0.3.2"
+  },
+  "devDependencies": {
+    "@types/jest": "29.5.11",
+    "@types/node": "20.10.0",
+    "@types/unzipper": "0.10.9",
+    "@typescript-eslint/parser": "6.19.1",
+    "@vercel/ncc": "0.38.1",
+    "eslint": "8.56.0",
+    "eslint-plugin-github": "4.10.1",
+    "eslint-plugin-jest": "27.6.3",
+    "eslint-plugin-prettier": "5.1.3",
+    "jest": "29.7.0",
+    "js-yaml": "4.1.0",
+    "npm-run-all": "4.1.5",
+    "patch-package": "8.0.0",
+    "prettier": "3.2.4",
+    "ts-jest": "29.1.2",
+    "typescript": "5.3.3"
+  }
+}

sources/src/build-scan.ts

@@ -0,0 +1,33 @@
+import * as core from '@actions/core'
+import {
+    getBuildScanPublishEnabled,
+    getBuildScanTermsOfServiceUrl,
+    getBuildScanTermsOfServiceAgree
+} from './input-params'
+
+export function setup(): void {
+    if (getBuildScanPublishEnabled() && verifyTermsOfServiceAgreement()) {
+        maybeExportVariable('DEVELOCITY_INJECTION_ENABLED', 'true')
+        maybeExportVariable('DEVELOCITY_PLUGIN_VERSION', '3.16.1')
+        maybeExportVariable('DEVELOCITY_CCUD_PLUGIN_VERSION', '1.12.1')
+        maybeExportVariable('BUILD_SCAN_TERMS_OF_SERVICE_URL', getBuildScanTermsOfServiceUrl())
+        maybeExportVariable('BUILD_SCAN_TERMS_OF_SERVICE_AGREE', getBuildScanTermsOfServiceAgree())
+    }
+}
+
+function verifyTermsOfServiceAgreement(): boolean {
+    if (
+        getBuildScanTermsOfServiceUrl() !== 'https://gradle.com/terms-of-service' ||
+        getBuildScanTermsOfServiceAgree() !== 'yes'
+    ) {
+        core.warning(`Terms of service must be agreed in order to publish build scans.`)
+        return false
+    }
+    return true
+}
+
+function maybeExportVariable(variableName: string, value: unknown): void {
+    if (!process.env[variableName]) {
+        core.exportVariable(variableName, value)
+    }
+}

sources/src/cache-base.ts

@@ -1,36 +1,40 @@
 import * as core from '@actions/core'
 import * as exec from '@actions/exec'
+import * as glob from '@actions/glob'
+
 import path from 'path'
 import fs from 'fs'
 import * as params from './input-params'
 import {CacheListener} from './cache-reporting'
 import {saveCache, restoreCache, cacheDebug, isCacheDebuggingEnabled, tryDelete, generateCacheKey} from './cache-utils'
-import {GradleHomeEntryExtractor} from './cache-extract-entries'
+import {GradleHomeEntryExtractor, ConfigurationCacheEntryExtractor} from './cache-extract-entries'
 
 const RESTORED_CACHE_KEY_KEY = 'restored-cache-key'
 
-export const META_FILE_DIR = '.gradle-build-action'
+export const META_FILE_DIR = '.setup-gradle'
 
 export class GradleStateCache {
     private cacheName: string
     private cacheDescription: string
 
+    protected readonly userHome: string
     protected readonly gradleUserHome: string
 
-    constructor(gradleUserHome: string) {
+    constructor(userHome: string, gradleUserHome: string) {
+        this.userHome = userHome
         this.gradleUserHome = gradleUserHome
         this.cacheName = 'gradle'
         this.cacheDescription = 'Gradle User Home'
     }
 
     init(): void {
-        const actionCacheDir = path.resolve(this.gradleUserHome, '.gradle-build-action')
-        fs.mkdirSync(actionCacheDir, {recursive: true})
+        this.initializeGradleUserHome()
 
-        const initScriptsDir = path.resolve(this.gradleUserHome, 'init.d')
-        fs.mkdirSync(initScriptsDir, {recursive: true})
-
-        this.initializeGradleUserHome(this.gradleUserHome, initScriptsDir)
+        // Export the GRADLE_ENCRYPTION_KEY variable if provided
+        const encryptionKey = params.getCacheEncryptionKey()
+        if (encryptionKey) {
+            core.exportVariable('GRADLE_ENCRYPTION_KEY', encryptionKey)
+        }
     }
 
     cacheOutputExists(): boolean {
@@ -79,7 +83,7 @@ export class GradleStateCache {
     async afterRestore(listener: CacheListener): Promise<void> {
         await this.debugReportGradleUserHomeSize('as restored from cache')
         await new GradleHomeEntryExtractor(this.gradleUserHome).restore(listener)
-        // await new ConfigurationCacheEntryExtractor(this.gradleUserHome).restore(listener)
+        await new ConfigurationCacheEntryExtractor(this.gradleUserHome).restore(listener)
         await this.debugReportGradleUserHomeSize('after restoring common artifacts')
     }
 
@@ -127,10 +131,10 @@ export class GradleStateCache {
      */
     async beforeSave(listener: CacheListener): Promise<void> {
         await this.debugReportGradleUserHomeSize('before saving common artifacts')
-        this.deleteExcludedPaths()
+        await this.deleteExcludedPaths()
         await Promise.all([
-            new GradleHomeEntryExtractor(this.gradleUserHome).extract(listener)
-            // new ConfigurationCacheEntryExtractor(this.gradleUserHome).extract(listener)
+            new GradleHomeEntryExtractor(this.gradleUserHome).extract(listener),
+            new ConfigurationCacheEntryExtractor(this.gradleUserHome).extract(listener)
         ])
         await this.debugReportGradleUserHomeSize(
             "after extracting common artifacts (only 'caches' and 'notifications' will be stored)"
@@ -140,13 +144,21 @@ export class GradleStateCache {
     /**
      * Delete any file paths that are excluded by the `gradle-home-cache-excludes` parameter.
      */
-    private deleteExcludedPaths(): void {
+    private async deleteExcludedPaths(): Promise<void> {
         const rawPaths: string[] = params.getCacheExcludes()
+        rawPaths.push('caches/*/cc-keystore')
         const resolvedPaths = rawPaths.map(x => path.resolve(this.gradleUserHome, x))
 
         for (const p of resolvedPaths) {
-            cacheDebug(`Deleting excluded path: ${p}`)
-            tryDelete(p)
+            cacheDebug(`Removing excluded path: ${p}`)
+            const globber = await glob.create(p, {
+                implicitDescendants: false
+            })
+
+            for (const toDelete of await globber.glob()) {
+                cacheDebug(`Removing excluded file: ${toDelete}`)
+                await tryDelete(toDelete)
+            }
         }
     }
 
@@ -171,23 +183,59 @@ export class GradleStateCache {
         return path.resolve(this.gradleUserHome, rawPath)
     }
 
-    private initializeGradleUserHome(gradleUserHome: string, initScriptsDir: string): void {
+    private initializeGradleUserHome(): void {
+        // Create a directory for storing action metadata
+        const actionCacheDir = path.resolve(this.gradleUserHome, META_FILE_DIR)
+        fs.mkdirSync(actionCacheDir, {recursive: true})
+
+        this.copyInitScripts()
+
+        // Copy the default toolchain definitions to `~/.m2/toolchains.xml`
+        this.registerToolchains()
+    }
+
+    private copyInitScripts(): void {
+        // Copy init scripts from src/resources to Gradle UserHome
+        const initScriptsDir = path.resolve(this.gradleUserHome, 'init.d')
+        fs.mkdirSync(initScriptsDir, {recursive: true})
         const initScriptFilenames = [
-            'build-result-capture.init.gradle',
-            'build-result-capture-service.plugin.groovy',
-            'github-dependency-graph.init.gradle',
-            'github-dependency-graph-gradle-plugin-apply.groovy'
+            'gradle-actions.build-result-capture.init.gradle',
+            'gradle-actions.build-result-capture-service.plugin.groovy',
+            'gradle-actions.github-dependency-graph.init.gradle',
+            'gradle-actions.github-dependency-graph-gradle-plugin-apply.groovy',
+            'gradle-actions.inject-develocity.init.gradle'
         ]
         for (const initScriptFilename of initScriptFilenames) {
-            const initScriptContent = this.readInitScriptAsString(initScriptFilename)
+            const initScriptContent = this.readResourceFileAsString('init-scripts', initScriptFilename)
             const initScriptPath = path.resolve(initScriptsDir, initScriptFilename)
             fs.writeFileSync(initScriptPath, initScriptContent)
         }
     }
 
-    private readInitScriptAsString(resource: string): string {
+    private registerToolchains(): void {
+        const preInstalledToolchains = this.readResourceFileAsString('toolchains.xml')
+        const m2dir = path.resolve(this.userHome, '.m2')
+        const toolchainXmlTarget = path.resolve(m2dir, 'toolchains.xml')
+        if (!fs.existsSync(toolchainXmlTarget)) {
+            // Write a new toolchains.xml file if it doesn't exist
+            fs.mkdirSync(m2dir, {recursive: true})
+            fs.writeFileSync(toolchainXmlTarget, preInstalledToolchains)
+
+            core.info(`Wrote default JDK locations to ${toolchainXmlTarget}`)
+        } else {
+            // Merge into an existing toolchains.xml file
+            const existingToolchainContent = fs.readFileSync(toolchainXmlTarget, 'utf8')
+            const appendedContent = preInstalledToolchains.split('<toolchains>').pop()!
+            const mergedContent = existingToolchainContent.replace('</toolchains>', appendedContent)
+
+            fs.writeFileSync(toolchainXmlTarget, mergedContent)
+            core.info(`Merged default JDK locations into ${toolchainXmlTarget}`)
+        }
+    }
+
+    private readResourceFileAsString(...paths: string[]): string {
         // Resolving relative to __dirname will allow node to find the resource at runtime
-        const absolutePath = path.resolve(__dirname, '..', '..', 'src', 'resources', 'init-scripts', resource)
+        const absolutePath = path.resolve(__dirname, '..', '..', 'sources', 'src', 'resources', ...paths)
         return fs.readFileSync(absolutePath, 'utf8')
     }
 

sources/src/cache-cleaner.ts

@@ -42,7 +42,8 @@ export class CacheCleaner {
         )
         fs.writeFileSync(path.resolve(cleanupProjectDir, 'build.gradle'), 'task("noop") {}')
 
-        await exec.exec(`gradle -g ${this.gradleUserHome} --no-daemon --build-cache --no-scan --quiet noop`, [], {
+        const gradleCommand = `gradle -g ${this.gradleUserHome} --no-daemon --build-cache --no-scan --quiet -DGITHUB_DEPENDENCY_GRAPH_ENABLED=false noop`
+        await exec.exec(gradleCommand, [], {
             cwd: cleanupProjectDir
         })
     }

sources/src/cache-extract-entries.ts

@@ -2,13 +2,14 @@ import path from 'path'
 import fs from 'fs'
 import * as core from '@actions/core'
 import * as glob from '@actions/glob'
+import * as semver from 'semver'
 
 import * as params from './input-params'
 
 import {META_FILE_DIR} from './cache-base'
 import {CacheEntryListener, CacheListener} from './cache-reporting'
 import {cacheDebug, getCacheKeyPrefix, hashFileNames, restoreCache, saveCache, tryDelete} from './cache-utils'
-import {loadBuildResults} from './build-results'
+import {BuildResult, loadBuildResults} from './build-results'
 
 const SKIP_RESTORE_VAR = 'GRADLE_BUILD_ACTION_SKIP_RESTORE'
 
@@ -46,6 +47,7 @@ class ExtractedCacheEntryDefinition {
     pattern: string
     bundle: boolean
     uniqueFileNames = true
+    notCacheableReason: string | undefined
 
     constructor(artifactType: string, pattern: string, bundle: boolean) {
         this.artifactType = artifactType
@@ -53,10 +55,24 @@ class ExtractedCacheEntryDefinition {
         this.bundle = bundle
     }
 
+    /**
+     * Indicate that the file names matching the cache entry pattern are NOT sufficient to uniquely identify the contents.
+     * If the file names are sufficient, then we use a hash of the file names to identify the entry.
+     * With non-unique-file-names, we hash the file contents to identify the cache entry.
+     */
     withNonUniqueFileNames(): ExtractedCacheEntryDefinition {
         this.uniqueFileNames = false
         return this
     }
+
+    /**
+     * Specify that the cache entry, should not be saved for some reason, even though the contents exist.
+     * This is used to prevent configuration-cache entries being cached when they were generated by Gradle < 8.6,
+     */
+    notCacheableBecause(reason: string): ExtractedCacheEntryDefinition {
+        this.notCacheableReason = reason
+        return this
+    }
 }
 
 /**
@@ -142,6 +158,11 @@ abstract class AbstractEntryExtractor {
             const artifactType = cacheEntryDefinition.artifactType
             const pattern = cacheEntryDefinition.pattern
 
+            if (cacheEntryDefinition.notCacheableReason) {
+                listener.entry(pattern).markNotSaved(cacheEntryDefinition.notCacheableReason)
+                continue
+            }
+
             // Find all matching files for this cache entry definition
             const globber = await glob.create(pattern, {
                 implicitDescendants: false
@@ -256,7 +277,7 @@ abstract class AbstractEntryExtractor {
         }
 
         const filedata = fs.readFileSync(cacheMetadataFile, 'utf-8')
-        cacheDebug(`Loaded cache metadata: ${filedata}`)
+        cacheDebug(`Loaded cache metadata for ${this.extractorName}: ${filedata}`)
         const extractedCacheEntryMetadata = JSON.parse(filedata) as ExtractedCacheEntryMetadata
         return extractedCacheEntryMetadata.entries
     }
@@ -264,12 +285,12 @@ abstract class AbstractEntryExtractor {
     /**
      * Saves information about the extracted cache entries into the 'cache-metadata.json' file.
      */
-    private saveMetadataForCacheResults(results: ExtractedCacheEntry[]): void {
+    protected saveMetadataForCacheResults(results: ExtractedCacheEntry[]): void {
         const extractedCacheEntryMetadata = new ExtractedCacheEntryMetadata()
         extractedCacheEntryMetadata.entries = results.filter(x => x.cacheKey !== undefined)
 
         const filedata = JSON.stringify(extractedCacheEntryMetadata)
-        cacheDebug(`Saving cache metadata: ${filedata}`)
+        cacheDebug(`Saving cache metadata for ${this.extractorName}: ${filedata}`)
 
         fs.writeFileSync(this.getCacheMetadataFile(), filedata, 'utf-8')
     }
@@ -351,37 +372,96 @@ export class ConfigurationCacheEntryExtractor extends AbstractEntryExtractor {
      * entry is not reusable.
      */
     async restore(listener: CacheListener): Promise<void> {
-        if (listener.fullyRestored) {
-            return super.restore(listener)
+        if (!listener.fullyRestored) {
+            this.markNotRestored(listener, 'Gradle User Home was not fully restored')
+            return
         }
 
-        core.info('Not restoring configuration-cache state, as Gradle User Home was not fully restored')
-        for (const cacheEntry of this.loadExtractedCacheEntries()) {
-            listener.entry(cacheEntry.pattern).markRequested('NOT_RESTORED')
+        if (!params.getCacheEncryptionKey()) {
+            this.markNotRestored(listener, 'Encryption Key was not provided')
+            return
         }
+
+        return await super.restore(listener)
+    }
+
+    private markNotRestored(listener: CacheListener, reason: string): void {
+        const cacheEntries = this.loadExtractedCacheEntries()
+        if (cacheEntries.length > 0) {
+            core.info(`Not restoring configuration-cache state, as ${reason}`)
+            for (const cacheEntry of cacheEntries) {
+                listener.entry(cacheEntry.pattern).markNotRestored(reason)
+            }
+
+            // Update the results file based on no entries restored
+            this.saveMetadataForCacheResults([])
+        }
+    }
+
+    async extract(listener: CacheListener): Promise<void> {
+        if (!params.getCacheEncryptionKey()) {
+            const cacheEntryDefinitions = this.getExtractedCacheEntryDefinitions()
+            if (cacheEntryDefinitions.length > 0) {
+                core.info('Not saving configuration-cache state, as no encryption key was provided')
+                for (const cacheEntry of cacheEntryDefinitions) {
+                    listener.entry(cacheEntry.pattern).markNotSaved('No encryption key provided')
+                }
+            }
+            return
+        }
+
+        await super.extract(listener)
     }
 
     /**
      * Extract cache entries for the configuration cache in each project.
      */
     protected getExtractedCacheEntryDefinitions(): ExtractedCacheEntryDefinition[] {
-        return this.getProjectRoots().map(projectRoot => {
-            const configCachePath = path.resolve(projectRoot, '.gradle/configuration-cache')
-            return new ExtractedCacheEntryDefinition(
+        // Group BuildResult by existing configCacheDir
+        const groupedResults = this.getConfigCacheDirectoriesWithAssociatedBuildResults()
+
+        return Object.entries(groupedResults).map(([configCachePath, pathResults]) => {
+            // Create a entry definition for each unique configuration cache directory
+            const definition = new ExtractedCacheEntryDefinition(
                 'configuration-cache',
                 configCachePath,
                 true
             ).withNonUniqueFileNames()
+
+            // If any associated build result used Gradle < 8.6, then mark it as not cacheable
+            if (
+                pathResults.find(result => {
+                    const gradleVersion = semver.coerce(result.gradleVersion)
+                    return gradleVersion && semver.lt(gradleVersion, '8.6.0')
+                })
+            ) {
+                core.info(
+                    `Not saving config-cache data for ${configCachePath}. Configuration cache data is only saved for Gradle 8.6+`
+                )
+                definition.notCacheableBecause('Configuration cache data only saved for Gradle 8.6+')
+            }
+            return definition
         })
     }
 
-    /**
-     * For every Gradle invocation, we record the project root directory. This method returns the entire
-     * set of project roots, to allow saving of configuration-cache entries for each.
-     */
-    private getProjectRoots(): string[] {
-        const buildResults = loadBuildResults()
-        const projectRootDirs = buildResults.map(x => x.rootProjectDir)
-        return [...new Set(projectRootDirs)] // Remove duplicates
+    private getConfigCacheDirectoriesWithAssociatedBuildResults(): Record<string, BuildResult[]> {
+        return loadBuildResults().reduce(
+            (acc, buildResult) => {
+                // For each build result, find the config-cache dir
+                const configCachePath = path.resolve(buildResult.rootProjectDir, '.gradle/configuration-cache')
+                // Ignore case where config-cache dir doesn't exist
+                if (!fs.existsSync(configCachePath)) {
+                    return acc
+                }
+
+                // Group by unique config cache directories and collect associated build results
+                if (!acc[configCachePath]) {
+                    acc[configCachePath] = []
+                }
+                acc[configCachePath].push(buildResult)
+                return acc
+            },
+            {} as Record<string, BuildResult[]>
+        )
     }
 }

sources/src/cache-reporting.ts

@@ -1,4 +1,3 @@
-import * as core from '@actions/core'
 import * as cache from '@actions/cache'
 
 /**
@@ -10,6 +9,7 @@ export class CacheListener {
     cacheReadOnly = false
     cacheWriteOnly = false
     cacheDisabled = false
+    cacheDisabledReason = 'disabled'
 
     get fullyRestored(): boolean {
         return this.cacheEntries.every(x => !x.wasRequestedButNotRestored())
@@ -17,7 +17,7 @@ export class CacheListener {
 
     get cacheStatus(): string {
         if (!cache.isFeatureAvailable()) return 'not available'
-        if (this.cacheDisabled) return 'disabled'
+        if (this.cacheDisabled) return this.cacheDisabledReason
         if (this.cacheWriteOnly) return 'write-only'
         if (this.cacheReadOnly) return 'read-only'
         return 'enabled'
@@ -111,47 +111,36 @@ export class CacheEntryListener {
     }
 }
 
-export function writeCachingReport(listener: CacheListener): void {
+export function generateCachingReport(listener: CacheListener): string {
     const entries = listener.cacheEntries
 
-    core.summary.addRaw(
-        `\n<details><summary><h4>Caching for gradle-build-action was ${listener.cacheStatus} - expand for details</h4></summary>\n`
-    )
+    return `
+<details>
+<summary><h4>Caching for Gradle actions was ${listener.cacheStatus} - expand for details</h4></summary>
+${renderEntryTable(entries)}
 
-    core.summary.addTable([
-        [
-            {data: '', header: true},
-            {data: 'Count', header: true},
-            {data: 'Total Size (Mb)', header: true}
-        ],
-        ['Entries Restored', `${getCount(entries, e => e.restoredSize)}`, `${getSize(entries, e => e.restoredSize)}`],
-        ['Entries Saved', `${getCount(entries, e => e.savedSize)}`, `${getSize(entries, e => e.savedSize)}`]
-    ])
-
-    core.summary.addHeading('Cache Entry Details', 5)
-
-    const entryDetails = renderEntryDetails(listener)
-    core.summary.addRaw(`<pre>
-${entryDetails}
+<h5>Cache Entry Details</h5>
+<pre>
+    ${renderEntryDetails(listener)}
 </pre>
 </details>
-`)
+    `
 }
 
-export function logCachingReport(listener: CacheListener): void {
-    const entries = listener.cacheEntries
-
-    core.startGroup(`Caching for gradle-build-action was ${listener.cacheStatus} - expand for details`)
-
-    core.info(
-        `Entries Restored: ${getCount(entries, e => e.restoredSize)} (${getSize(entries, e => e.restoredSize)} Mb)`
-    )
-    core.info(`Entries Saved   : ${getCount(entries, e => e.savedSize)} (${getSize(entries, e => e.savedSize)} Mb)`)
-
-    core.info(`Cache Entry Details`)
-    core.info(renderEntryDetails(listener))
-
-    core.endGroup()
+function renderEntryTable(entries: CacheEntryListener[]): string {
+    return `
+<table>
+    <tr><td></td><th>Count</th><th>Total Size (Mb)</th></tr>
+    <tr><td>Entries Restored</td>
+        <td>${getCount(entries, e => e.restoredSize)}</td>
+        <td>${getSize(entries, e => e.restoredSize)}</td>
+    </tr>
+    <tr><td>Entries Saved</td>
+        <td>${getCount(entries, e => e.savedSize)}</td>
+        <td>${getSize(entries, e => e.savedSize)}</td>
+    </tr>
+</table>
+    `
 }
 
 function renderEntryDetails(listener: CacheListener): string {
@@ -197,6 +186,9 @@ function getSavedMessage(entry: CacheEntryListener, cacheReadOnly: boolean): str
         if (cacheReadOnly) {
             return '(Entry not saved: cache is read-only)'
         }
+        if (entry.notRestored) {
+            return '(Entry not saved: not restored)'
+        }
         return '(Entry not saved: reason unknown)'
     }
     if (entry.savedSize === 0) {

sources/src/cache-utils.ts

@@ -11,7 +11,7 @@ import * as params from './input-params'
 
 import {CacheEntryListener} from './cache-reporting'
 
-const CACHE_PROTOCOL_VERSION = 'v8-'
+const CACHE_PROTOCOL_VERSION = 'v9-'
 
 const CACHE_KEY_PREFIX_VAR = 'GRADLE_BUILD_ACTION_CACHE_KEY_PREFIX'
 const CACHE_KEY_OS_VAR = 'GRADLE_BUILD_ACTION_CACHE_KEY_ENVIRONMENT'
@@ -37,6 +37,10 @@ export function isCacheWriteOnly(): boolean {
     return params.isCacheWriteOnly()
 }
 
+export function isCacheOverwriteExisting(): boolean {
+    return params.isCacheOverwriteExisting()
+}
+
 export function isCacheDebuggingEnabled(): boolean {
     return params.isCacheDebuggingEnabled()
 }
@@ -66,7 +70,7 @@ export class CacheKey {
  * - The cache protocol version
  * - The name of the cache
  * - The runner operating system
- * - The name of the Job being executed
+ * - The name of the workflow and Job being executed
  * - The matrix values for the Job being executed (job context)
  * - The SHA of the commit being executed
  *
@@ -82,10 +86,10 @@ export function generateCacheKey(cacheName: string): CacheKey {
     // At the most general level, share caches for all executions on the same OS
     const cacheKeyForEnvironment = `${cacheKeyBase}|${getCacheKeyEnvironment()}`
 
-    // Prefer caches that run this job
+    // Then prefer caches that run job with the same ID
     const cacheKeyForJob = `${cacheKeyForEnvironment}|${getCacheKeyJob()}`
 
-    // Prefer (even more) jobs that run this job with the same context (matrix)
+    // Prefer (even more) jobs that run this job in the same workflow with the same context (matrix)
     const cacheKeyForJobContext = `${cacheKeyForJob}[${getCacheKeyJobInstance()}]`
 
     // Exact match on Git SHA
@@ -109,12 +113,7 @@ function getCacheKeyEnvironment(): string {
 }
 
 function getCacheKeyJob(): string {
-    return process.env[CACHE_KEY_JOB_VAR] || getCacheKeyForJob(github.context.workflow, github.context.job)
-}
-
-export function getCacheKeyForJob(workflowName: string, jobId: string): string {
-    const sanitizedWorkflow = workflowName.replace(/,/g, '').toLowerCase()
-    return `${sanitizedWorkflow}-${jobId}`
+    return process.env[CACHE_KEY_JOB_VAR] || github.context.job
 }
 
 function getCacheKeyJobInstance(): string {
@@ -123,25 +122,11 @@ function getCacheKeyJobInstance(): string {
         return override
     }
 
-    // By default, we hash the full `matrix` data for the run, to uniquely identify this job invocation
+    // By default, we hash the workflow name and the full `matrix` data for the run, to uniquely identify this job invocation
     // The only way we can obtain the `matrix` data is via the `workflow-job-context` parameter in action.yml.
+    const workflowName = github.context.workflow
     const workflowJobContext = params.getJobMatrix()
-    return hashStrings([workflowJobContext])
-}
-
-export function getUniqueLabelForJobInstance(): string {
-    return getUniqueLabelForJobInstanceValues(github.context.workflow, github.context.job, params.getJobMatrix())
-}
-
-export function getUniqueLabelForJobInstanceValues(workflow: string, jobId: string, matrixJson: string): string {
-    const matrix = JSON.parse(matrixJson)
-    const matrixString = Object.values(matrix).join('-')
-    const label = matrixString ? `${workflow}-${jobId}-${matrixString}` : `${workflow}-${jobId}`
-    return sanitize(label)
-}
-
-function sanitize(value: string): string {
-    return value.replace(/[^a-zA-Z0-9_-]/g, '').toLowerCase()
+    return hashStrings([workflowName, workflowJobContext])
 }
 
 function getCacheKeyJobExecution(): string {

sources/src/caches.ts

@@ -1,5 +1,11 @@
 import * as core from '@actions/core'
-import {isCacheCleanupEnabled, isCacheDisabled, isCacheReadOnly, isCacheWriteOnly} from './cache-utils'
+import {
+    isCacheCleanupEnabled,
+    isCacheDisabled,
+    isCacheReadOnly,
+    isCacheWriteOnly,
+    isCacheOverwriteExisting
+} from './cache-utils'
 import {CacheListener} from './cache-reporting'
 import {DaemonController} from './daemon-controller'
 import {GradleStateCache} from './cache-base'
@@ -7,7 +13,7 @@ import {CacheCleaner} from './cache-cleaner'
 
 const CACHE_RESTORED_VAR = 'GRADLE_BUILD_ACTION_CACHE_RESTORED'
 
-export async function restore(gradleUserHome: string, cacheListener: CacheListener): Promise<void> {
+export async function restore(userHome: string, gradleUserHome: string, cacheListener: CacheListener): Promise<void> {
     // Bypass restore cache on all but first action step in workflow.
     if (process.env[CACHE_RESTORED_VAR]) {
         core.info('Cache only restored on first action step.')
@@ -15,7 +21,7 @@ export async function restore(gradleUserHome: string, cacheListener: CacheListen
     }
     core.exportVariable(CACHE_RESTORED_VAR, true)
 
-    const gradleStateCache = new GradleStateCache(gradleUserHome)
+    const gradleStateCache = new GradleStateCache(userHome, gradleUserHome)
 
     if (isCacheDisabled()) {
         core.info('Cache is disabled: will not restore state from previous builds.')
@@ -26,10 +32,15 @@ export async function restore(gradleUserHome: string, cacheListener: CacheListen
     }
 
     if (gradleStateCache.cacheOutputExists()) {
-        core.info('Gradle User Home already exists: will not restore from cache.')
-        // Initialize pre-existing Gradle User Home.
-        gradleStateCache.init()
-        return
+        if (!isCacheOverwriteExisting()) {
+            core.info('Gradle User Home already exists: will not restore from cache.')
+            // Initialize pre-existing Gradle User Home.
+            gradleStateCache.init()
+            cacheListener.cacheDisabled = true
+            cacheListener.cacheDisabledReason = 'disabled due to pre-existing Gradle User Home'
+            return
+        }
+        core.info('Gradle User Home already exists: will overwrite with cached contents.')
     }
 
     gradleStateCache.init()
@@ -54,6 +65,7 @@ export async function restore(gradleUserHome: string, cacheListener: CacheListen
 }
 
 export async function save(
+    userHome: string,
     gradleUserHome: string,
     cacheListener: CacheListener,
     daemonController: DaemonController
@@ -79,10 +91,14 @@ export async function save(
     if (isCacheCleanupEnabled()) {
         core.info('Forcing cache cleanup.')
         const cacheCleaner = new CacheCleaner(gradleUserHome, process.env['RUNNER_TEMP']!)
-        await cacheCleaner.forceCleanup()
+        try {
+            await cacheCleaner.forceCleanup()
+        } catch (e) {
+            core.warning(`Cache cleanup failed. Will continue. ${String(e)}`)
+        }
     }
 
     await core.group('Caching Gradle state', async () => {
-        return new GradleStateCache(gradleUserHome).save(cacheListener)
+        return new GradleStateCache(userHome, gradleUserHome).save(cacheListener)
     })
 }

sources/src/dependency-graph.ts

@@ -0,0 +1,247 @@
+import * as core from '@actions/core'
+import * as github from '@actions/github'
+import * as glob from '@actions/glob'
+import {DefaultArtifactClient} from '@actions/artifact'
+import {GitHub} from '@actions/github/lib/utils'
+import {RequestError} from '@octokit/request-error'
+import type {PullRequestEvent} from '@octokit/webhooks-types'
+
+import * as path from 'path'
+import fs from 'fs'
+
+import * as layout from './repository-layout'
+import {PostActionJobFailure} from './errors'
+import {
+    DependencyGraphOption,
+    getDependencyGraphContinueOnFailure,
+    getJobMatrix,
+    getArtifactRetentionDays
+} from './input-params'
+
+const DEPENDENCY_GRAPH_PREFIX = 'dependency-graph_'
+
+export async function setup(option: DependencyGraphOption): Promise<void> {
+    if (option === DependencyGraphOption.Disabled) {
+        return
+    }
+    // Download and submit early, for compatability with dependency review.
+    if (option === DependencyGraphOption.DownloadAndSubmit) {
+        await downloadAndSubmitDependencyGraphs()
+        return
+    }
+
+    core.info('Enabling dependency graph generation')
+    maybeExportVariable('GITHUB_DEPENDENCY_GRAPH_ENABLED', 'true')
+    maybeExportVariable('GITHUB_DEPENDENCY_GRAPH_CONTINUE_ON_FAILURE', getDependencyGraphContinueOnFailure())
+    maybeExportVariable('GITHUB_DEPENDENCY_GRAPH_JOB_CORRELATOR', getJobCorrelator())
+    maybeExportVariable('GITHUB_DEPENDENCY_GRAPH_JOB_ID', github.context.runId)
+    maybeExportVariable('GITHUB_DEPENDENCY_GRAPH_REF', github.context.ref)
+    maybeExportVariable('GITHUB_DEPENDENCY_GRAPH_SHA', getShaFromContext())
+    maybeExportVariable('GITHUB_DEPENDENCY_GRAPH_WORKSPACE', layout.workspaceDirectory())
+    maybeExportVariable(
+        'DEPENDENCY_GRAPH_REPORT_DIR',
+        path.resolve(layout.workspaceDirectory(), 'dependency-graph-reports')
+    )
+
+    // To clear the dependency graph, we generate an empty graph by excluding all projects and configurations
+    if (option === DependencyGraphOption.Clear) {
+        core.exportVariable('DEPENDENCY_GRAPH_INCLUDE_PROJECTS', '')
+        core.exportVariable('DEPENDENCY_GRAPH_INCLUDE_CONFIGURATIONS', '')
+    }
+}
+
+function maybeExportVariable(variableName: string, value: unknown): void {
+    if (!process.env[variableName]) {
+        core.exportVariable(variableName, value)
+    }
+}
+
+export async function complete(option: DependencyGraphOption): Promise<void> {
+    try {
+        switch (option) {
+            case DependencyGraphOption.Disabled:
+            case DependencyGraphOption.Generate: // Performed via init-script: nothing to do here
+            case DependencyGraphOption.DownloadAndSubmit: // Performed in setup
+                return
+            case DependencyGraphOption.GenerateAndSubmit:
+            case DependencyGraphOption.Clear: // Submit the empty dependency graph
+                await submitDependencyGraphs(await findGeneratedDependencyGraphFiles())
+                return
+            case DependencyGraphOption.GenerateAndUpload:
+                await uploadDependencyGraphs(await findGeneratedDependencyGraphFiles())
+        }
+    } catch (e) {
+        warnOrFail(option, e)
+    }
+}
+
+async function findGeneratedDependencyGraphFiles(): Promise<string[]> {
+    const workspaceDirectory = layout.workspaceDirectory()
+    return await findDependencyGraphFiles(workspaceDirectory)
+}
+
+async function uploadDependencyGraphs(dependencyGraphFiles: string[]): Promise<void> {
+    const workspaceDirectory = layout.workspaceDirectory()
+
+    const artifactClient = new DefaultArtifactClient()
+    for (const dependencyGraphFile of dependencyGraphFiles) {
+        const relativePath = getRelativePathFromWorkspace(dependencyGraphFile)
+        core.info(`Uploading dependency graph file: ${relativePath}`)
+        const artifactName = `${DEPENDENCY_GRAPH_PREFIX}${path.basename(dependencyGraphFile)}`
+        await artifactClient.uploadArtifact(artifactName, [dependencyGraphFile], workspaceDirectory, {
+            retentionDays: getArtifactRetentionDays()
+        })
+    }
+}
+
+async function downloadAndSubmitDependencyGraphs(): Promise<void> {
+    try {
+        await submitDependencyGraphs(await downloadDependencyGraphs())
+    } catch (e) {
+        warnOrFail(DependencyGraphOption.DownloadAndSubmit, e)
+    }
+}
+
+async function submitDependencyGraphs(dependencyGraphFiles: string[]): Promise<void> {
+    for (const jsonFile of dependencyGraphFiles) {
+        try {
+            await submitDependencyGraphFile(jsonFile)
+        } catch (error) {
+            if (error instanceof RequestError) {
+                throw new Error(translateErrorMessage(jsonFile, error))
+            } else {
+                throw error
+            }
+        }
+    }
+}
+
+function translateErrorMessage(jsonFile: string, error: RequestError): string {
+    const relativeJsonFile = getRelativePathFromWorkspace(jsonFile)
+    const mainWarning = `Dependency submission failed for ${relativeJsonFile}.\n${String(error)}`
+    if (error.message === 'Resource not accessible by integration') {
+        return `${mainWarning}
+Please ensure that the 'contents: write' permission is available for the workflow job.
+Note that this permission is never available for a 'pull_request' trigger from a repository fork.
+        `
+    }
+    return mainWarning
+}
+
+async function submitDependencyGraphFile(jsonFile: string): Promise<void> {
+    const octokit = getOctokit()
+    const jsonContent = fs.readFileSync(jsonFile, 'utf8')
+
+    const jsonObject = JSON.parse(jsonContent)
+    jsonObject.owner = github.context.repo.owner
+    jsonObject.repo = github.context.repo.repo
+    const response = await octokit.request('POST /repos/{owner}/{repo}/dependency-graph/snapshots', jsonObject)
+
+    const relativeJsonFile = getRelativePathFromWorkspace(jsonFile)
+    core.notice(`Submitted ${relativeJsonFile}: ${response.data.message}`)
+}
+
+async function downloadDependencyGraphs(): Promise<string[]> {
+    const workspaceDirectory = layout.workspaceDirectory()
+
+    const findBy = github.context.payload.workflow_run
+        ? {
+              token: getGithubToken(),
+              workflowRunId: github.context.payload.workflow_run.id,
+              repositoryName: github.context.repo.repo,
+              repositoryOwner: github.context.repo.owner
+          }
+        : undefined
+
+    const artifactClient = new DefaultArtifactClient()
+    const downloadPath = path.resolve(workspaceDirectory, 'dependency-graph')
+
+    const dependencyGraphArtifacts = (
+        await artifactClient.listArtifacts({
+            latest: true,
+            findBy
+        })
+    ).artifacts.filter(candidate => candidate.name.startsWith(DEPENDENCY_GRAPH_PREFIX))
+
+    for (const artifact of dependencyGraphArtifacts) {
+        const downloadedArtifact = await artifactClient.downloadArtifact(artifact.id, {
+            path: downloadPath,
+            findBy
+        })
+        core.info(`Downloading dependency-graph artifact ${artifact.name} to ${downloadedArtifact.downloadPath}`)
+    }
+
+    return findDependencyGraphFiles(downloadPath)
+}
+
+async function findDependencyGraphFiles(dir: string): Promise<string[]> {
+    const globber = await glob.create(`${dir}/dependency-graph-reports/*.json`)
+    const graphFiles = globber.glob()
+    return graphFiles
+}
+
+function warnOrFail(option: String, error: unknown): void {
+    if (!getDependencyGraphContinueOnFailure()) {
+        throw new PostActionJobFailure(error)
+    }
+
+    core.warning(`Failed to ${option} dependency graph. Will continue.\n${String(error)}`)
+}
+
+function getOctokit(): InstanceType<typeof GitHub> {
+    return github.getOctokit(getGithubToken())
+}
+
+function getGithubToken(): string {
+    return core.getInput('github-token', {required: true})
+}
+
+function getRelativePathFromWorkspace(file: string): string {
+    const workspaceDirectory = layout.workspaceDirectory()
+    return path.relative(workspaceDirectory, file)
+}
+
+function getShaFromContext(): string {
+    const context = github.context
+    const pullRequestEvents = [
+        'pull_request',
+        'pull_request_comment',
+        'pull_request_review',
+        'pull_request_review_comment'
+        // Note that pull_request_target is omitted here.
+        // That event runs in the context of the base commit of the PR,
+        // so the snapshot should not be associated with the head commit.
+    ]
+    if (pullRequestEvents.includes(context.eventName)) {
+        const pr = (context.payload as PullRequestEvent).pull_request
+        return pr.head.sha
+    } else {
+        return context.sha
+    }
+}
+
+function getJobCorrelator(): string {
+    return constructJobCorrelator(github.context.workflow, github.context.job, getJobMatrix())
+}
+
+export function constructJobCorrelator(workflow: string, jobId: string, matrixJson: string): string {
+    const matrixString = describeMatrix(matrixJson)
+    const label = matrixString ? `${workflow}-${jobId}-${matrixString}` : `${workflow}-${jobId}`
+    return sanitize(label)
+}
+
+function describeMatrix(matrixJson: string): string {
+    core.debug(`Got matrix json: ${matrixJson}`)
+    const matrix = JSON.parse(matrixJson)
+    if (matrix) {
+        return Object.values(matrix).join('-')
+    }
+    return ''
+}
+
+function sanitize(value: string): string {
+    return value
+        .replace(/[^a-zA-Z0-9_-\s]/g, '')
+        .replace(/\s+/g, '_')
+        .toLowerCase()
+}

sources/src/errors.ts

@@ -0,0 +1,11 @@
+export class PostActionJobFailure extends Error {
+    constructor(error: unknown) {
+        if (error instanceof Error) {
+            super(error.message)
+            this.name = error.name
+            this.stack = error.stack
+        } else {
+            super(String(error))
+        }
+    }
+}

sources/src/execution.ts

@@ -1,12 +1,11 @@
 import * as core from '@actions/core'
 import * as exec from '@actions/exec'
-import fs from 'fs'
 import * as gradlew from './gradlew'
 
 export async function executeGradleBuild(executable: string | undefined, root: string, args: string[]): Promise<void> {
     // Use the provided executable, or look for a Gradle wrapper script to run
-    const toExecute = executable ?? gradlew.locateGradleWrapperScript(root)
-    verifyIsExecutableScript(toExecute)
+    const toExecute = executable ?? gradlew.gradleWrapperScript(root)
+
     const status: number = await exec.exec(toExecute, args, {
         cwd: root,
         ignoreReturnCode: true
@@ -16,11 +15,3 @@ export async function executeGradleBuild(executable: string | undefined, root: s
         core.setFailed(`Gradle build failed: see console output for details`)
     }
 }
-
-function verifyIsExecutableScript(toExecute: string): void {
-    try {
-        fs.accessSync(toExecute, fs.constants.X_OK)
-    } catch (err) {
-        throw new Error(`Gradle script '${toExecute}' is not executable.`)
-    }
-}

sources/src/gradlew.ts

@@ -0,0 +1,42 @@
+import * as path from 'path'
+import fs from 'fs'
+
+const IS_WINDOWS = process.platform === 'win32'
+
+export function wrapperScriptFilename(): string {
+    return IS_WINDOWS ? './gradlew.bat' : './gradlew'
+}
+
+export function installScriptFilename(): string {
+    return IS_WINDOWS ? 'gradle.bat' : 'gradle'
+}
+
+export function gradleWrapperScript(buildRootDirectory: string): string {
+    validateGradleWrapper(buildRootDirectory)
+    return wrapperScriptFilename()
+}
+
+function validateGradleWrapper(buildRootDirectory: string): void {
+    const wrapperScript = path.resolve(buildRootDirectory, wrapperScriptFilename())
+    verifyExists(wrapperScript, 'Gradle Wrapper script')
+    verifyIsExecutableScript(wrapperScript)
+
+    const wrapperProperties = path.resolve(buildRootDirectory, 'gradle/wrapper/gradle-wrapper.properties')
+    verifyExists(wrapperProperties, 'Gradle wrapper properties file')
+}
+
+function verifyExists(file: string, description: string): void {
+    if (!fs.existsSync(file)) {
+        throw new Error(
+            `Cannot locate ${description} at '${file}'. Specify 'gradle-version' for projects without Gradle wrapper configured.`
+        )
+    }
+}
+
+function verifyIsExecutableScript(toExecute: string): void {
+    try {
+        fs.accessSync(toExecute, fs.constants.X_OK)
+    } catch (err) {
+        throw new Error(`Gradle script '${toExecute}' is not executable.`)
+    }
+}

sources/src/input-params.ts

@@ -0,0 +1,171 @@
+import * as core from '@actions/core'
+import {parseArgsStringToArgv} from 'string-argv'
+
+export function isCacheDisabled(): boolean {
+    return getBooleanInput('cache-disabled')
+}
+
+export function isCacheReadOnly(): boolean {
+    return getBooleanInput('cache-read-only')
+}
+
+export function isCacheWriteOnly(): boolean {
+    return getBooleanInput('cache-write-only')
+}
+
+export function isCacheOverwriteExisting(): boolean {
+    return getBooleanInput('cache-overwrite-existing')
+}
+
+export function isCacheStrictMatch(): boolean {
+    return getBooleanInput('gradle-home-cache-strict-match')
+}
+
+export function isCacheDebuggingEnabled(): boolean {
+    return process.env['GRADLE_BUILD_ACTION_CACHE_DEBUG_ENABLED'] ? true : false
+}
+
+export function isCacheCleanupEnabled(): boolean {
+    return getBooleanInput('gradle-home-cache-cleanup')
+}
+
+export function getCacheEncryptionKey(): string {
+    return core.getInput('cache-encryption-key')
+}
+
+export function getCacheIncludes(): string[] {
+    return core.getMultilineInput('gradle-home-cache-includes')
+}
+
+export function getCacheExcludes(): string[] {
+    return core.getMultilineInput('gradle-home-cache-excludes')
+}
+
+export function getBuildRootDirectory(): string {
+    return core.getInput('build-root-directory')
+}
+
+export function getGradleVersion(): string {
+    return core.getInput('gradle-version')
+}
+
+export function getArguments(): string[] {
+    const input = core.getInput('arguments')
+    return parseArgsStringToArgv(input)
+}
+
+// Internal parameters
+export function getJobMatrix(): string {
+    return core.getInput('workflow-job-context')
+}
+
+export function getGithubToken(): string {
+    return core.getInput('github-token', {required: true})
+}
+
+export function isJobSummaryEnabled(): boolean {
+    return getBooleanInput('generate-job-summary', true)
+}
+
+export function getJobSummaryOption(): JobSummaryOption {
+    return parseJobSummaryOption('add-job-summary')
+}
+
+export function getPRCommentOption(): JobSummaryOption {
+    return parseJobSummaryOption('add-job-summary-as-pr-comment')
+}
+
+export function getBuildScanPublishEnabled(): boolean {
+    return getBooleanInput('build-scan-publish')
+}
+
+export function getBuildScanTermsOfServiceUrl(): string {
+    return core.getInput('build-scan-terms-of-service-url')
+}
+
+export function getBuildScanTermsOfServiceAgree(): string {
+    return core.getInput('build-scan-terms-of-service-agree')
+}
+
+function parseJobSummaryOption(paramName: string): JobSummaryOption {
+    const val = core.getInput(paramName)
+    switch (val.toLowerCase().trim()) {
+        case 'never':
+            return JobSummaryOption.Never
+        case 'always':
+            return JobSummaryOption.Always
+        case 'on-failure':
+            return JobSummaryOption.OnFailure
+    }
+    throw TypeError(`The value '${val}' is not valid for ${paramName}. Valid values are: [never, always, on-failure].`)
+}
+
+export function getDependencyGraphOption(): DependencyGraphOption {
+    const val = core.getInput('dependency-graph')
+    switch (val.toLowerCase().trim()) {
+        case 'disabled':
+            return DependencyGraphOption.Disabled
+        case 'generate':
+            return DependencyGraphOption.Generate
+        case 'generate-and-submit':
+            return DependencyGraphOption.GenerateAndSubmit
+        case 'generate-and-upload':
+            return DependencyGraphOption.GenerateAndUpload
+        case 'download-and-submit':
+            return DependencyGraphOption.DownloadAndSubmit
+        case 'clear':
+            return DependencyGraphOption.Clear
+    }
+    throw TypeError(
+        `The value '${val}' is not valid for 'dependency-graph'. Valid values are: [disabled, generate, generate-and-submit, generate-and-upload, download-and-submit, clear]. The default value is 'disabled'.`
+    )
+}
+
+export function getDependencyGraphContinueOnFailure(): boolean {
+    return getBooleanInput('dependency-graph-continue-on-failure', true)
+}
+
+export function getArtifactRetentionDays(): number {
+    const val = core.getInput('artifact-retention-days')
+    return parseNumericInput('artifact-retention-days', val, 0)
+    // Zero indicates that the default repository settings should be used
+}
+
+export function parseNumericInput(paramName: string, paramValue: string, paramDefault: number): number {
+    if (paramValue.length === 0) {
+        return paramDefault
+    }
+    const numericValue = parseInt(paramValue)
+    if (isNaN(numericValue)) {
+        throw TypeError(`The value '${paramValue}' is not a valid numeric value for '${paramName}'.`)
+    }
+    return numericValue
+}
+
+function getBooleanInput(paramName: string, paramDefault = false): boolean {
+    const paramValue = core.getInput(paramName)
+    switch (paramValue.toLowerCase().trim()) {
+        case '':
+            return paramDefault
+        case 'false':
+            return false
+        case 'true':
+            return true
+    }
+    throw TypeError(`The value '${paramValue} is not valid for '${paramName}. Valid values are: [true, false]`)
+}
+
+export enum DependencyGraphOption {
+    Disabled = 'disabled',
+    Generate = 'generate',
+    GenerateAndSubmit = 'generate-and-submit',
+    GenerateAndUpload = 'generate-and-upload',
+    DownloadAndSubmit = 'download-and-submit',
+    Clear = 'clear'
+}
+
+export enum JobSummaryOption {
+    Never = 'never',
+    Always = 'always',
+    OnFailure = 'on-failure'
+}

sources/src/job-summary.ts

@@ -0,0 +1,157 @@
+import * as core from '@actions/core'
+import * as github from '@actions/github'
+import {SUMMARY_ENV_VAR} from '@actions/core/lib/summary'
+import {RequestError} from '@octokit/request-error'
+
+import * as params from './input-params'
+import {BuildResult} from './build-results'
+import {CacheListener, generateCachingReport} from './cache-reporting'
+
+export async function generateJobSummary(buildResults: BuildResult[], cacheListener: CacheListener): Promise<void> {
+    const summaryTable = renderSummaryTable(buildResults)
+    const cachingReport = generateCachingReport(cacheListener)
+
+    if (shouldGenerateJobSummary(buildResults)) {
+        core.info('Generating Job Summary')
+
+        core.summary.addRaw(summaryTable)
+        core.summary.addRaw(cachingReport)
+        await core.summary.write()
+    } else {
+        core.info('============================')
+        core.info(summaryTable)
+        core.info('============================')
+        core.info(cachingReport)
+        core.info('============================')
+    }
+
+    if (shouldAddPRComment(buildResults)) {
+        await addPRComment(summaryTable)
+    }
+}
+
+async function addPRComment(jobSummary: string): Promise<void> {
+    const context = github.context
+    if (context.payload.pull_request == null) {
+        core.info('No pull_request trigger: not adding PR comment')
+        return
+    }
+
+    const pull_request_number = context.payload.pull_request.number
+    core.info(`Adding Job Summary as comment to PR #${pull_request_number}.`)
+
+    const prComment = `<h3>Job Summary for Gradle</h3>
+<h5>${github.context.workflow} :: <em>${github.context.job}</em></h5>
+
+${jobSummary}`
+
+    const github_token = params.getGithubToken()
+    const octokit = github.getOctokit(github_token)
+    try {
+        await octokit.rest.issues.createComment({
+            ...context.repo,
+            issue_number: pull_request_number,
+            body: prComment
+        })
+    } catch (error) {
+        if (error instanceof RequestError) {
+            core.warning(buildWarningMessage(error))
+        } else {
+            throw error
+        }
+    }
+}
+
+function buildWarningMessage(error: RequestError): string {
+    const mainWarning = `Failed to generate PR comment.\n${String(error)}`
+    if (error.message === 'Resource not accessible by integration') {
+        return `${mainWarning}
+Please ensure that the 'pull-requests: write' permission is available for the workflow job.
+Note that this permission is never available for a workflow triggered from a repository fork.
+        `
+    }
+    return mainWarning
+}
+
+function renderSummaryTable(results: BuildResult[]): string {
+    if (results.length === 0) {
+        return 'No Gradle build results detected.'
+    }
+
+    return `
+<table>
+    <tr>
+        <th>Gradle Root Project</th>
+        <th>Requested Tasks</th>
+        <th>Gradle Version</th>
+        <th>Build Outcome</th>
+        <th>Build Scan®</th>
+    </tr>${results.map(result => renderBuildResultRow(result)).join('')}
+</table>
+    `
+}
+
+function renderBuildResultRow(result: BuildResult): string {
+    return `
+    <tr>
+        <td>${result.rootProjectName}</td>
+        <td>${result.requestedTasks}</td>
+        <td align='center'>${result.gradleVersion}</td>
+        <td align='center'>${renderOutcome(result)}</td>
+        <td>${renderBuildScan(result)}</td>
+    </tr>`
+}
+
+function renderOutcome(result: BuildResult): string {
+    return result.buildFailed ? ':x:' : ':white_check_mark:'
+}
+
+function renderBuildScan(result: BuildResult): string {
+    if (result.buildScanFailed) {
+        return renderBuildScanBadge(
+            'PUBLISH_FAILED',
+            'orange',
+            'https://docs.gradle.com/enterprise/gradle-plugin/#troubleshooting'
+        )
+    }
+    if (result.buildScanUri) {
+        return renderBuildScanBadge('PUBLISHED', '06A0CE', result.buildScanUri)
+    }
+    return renderBuildScanBadge('NOT_PUBLISHED', 'lightgrey', 'https://scans.gradle.com')
+}
+
+function renderBuildScanBadge(outcomeText: string, outcomeColor: string, targetUrl: string): string {
+    const badgeUrl = `https://img.shields.io/badge/Build%20Scan%C2%AE-${outcomeText}-${outcomeColor}?logo=Gradle`
+    const badgeHtml = `<img src="${badgeUrl}" alt="Build Scan ${outcomeText}" />`
+    return `<a href="${targetUrl}" rel="nofollow">${badgeHtml}</a>`
+}
+
+function shouldGenerateJobSummary(buildResults: BuildResult[]): boolean {
+    // Check if Job Summary is supported on this platform
+    if (!process.env[SUMMARY_ENV_VAR]) {
+        return false
+    }
+
+    // Check if Job Summary is disabled using the deprecated input
+    if (!params.isJobSummaryEnabled()) {
+        return false
+    }
+
+    return shouldAddJobSummary(params.getJobSummaryOption(), buildResults)
+}
+
+function shouldAddPRComment(buildResults: BuildResult[]): boolean {
+    return shouldAddJobSummary(params.getPRCommentOption(), buildResults)
+}
+
+function shouldAddJobSummary(option: params.JobSummaryOption, buildResults: BuildResult[]): boolean {
+    switch (option) {
+        case params.JobSummaryOption.Always:
+            return true
+        case params.JobSummaryOption.Never:
+            return false
+        case params.JobSummaryOption.OnFailure:
+            core.info(`Got these build results: ${JSON.stringify(buildResults)}`)
+            return buildResults.some(result => result.buildFailed)
+    }
+}

sources/src/main.ts

@@ -29,6 +29,9 @@ export async function run(): Promise<void> {
             core.info(error.stack)
         }
     }
+
+    // Explicit process.exit() to prevent waiting for hanging promises.
+    process.exit()
 }
 
 run()

sources/src/post.ts

@@ -1,5 +1,6 @@
 import * as core from '@actions/core'
 import * as setupGradle from './setup-gradle'
+import {PostActionJobFailure} from './errors'
 
 // Catch and log any unhandled exceptions.  These exceptions can leak out of the uploadChunk method in
 // @actions/toolkit when a failed upload closes the file descriptor causing any in-process reads to
@@ -13,8 +14,15 @@ export async function run(): Promise<void> {
     try {
         await setupGradle.complete()
     } catch (error) {
-        handleFailure(error)
+        if (error instanceof PostActionJobFailure) {
+            core.setFailed(String(error))
+        } else {
+            handleFailure(error)
+        }
     }
+
+    // Explicit process.exit() to prevent waiting for promises left hanging by `@actions/cache` on save.
+    process.exit()
 }
 
 function handleFailure(error: unknown): void {

sources/src/provision.ts

@@ -8,7 +8,6 @@ import * as toolCache from '@actions/tool-cache'
 
 import * as gradlew from './gradlew'
 import * as params from './input-params'
-import * as layout from './repository-layout'
 import {handleCacheFailure, isCacheDisabled, isCacheReadOnly} from './cache-utils'
 
 const gradleVersionsBaseUrl = 'https://services.gradle.org/versions'
@@ -20,13 +19,7 @@ const gradleVersionsBaseUrl = 'https://services.gradle.org/versions'
 export async function provisionGradle(): Promise<string | undefined> {
     const gradleVersion = params.getGradleVersion()
     if (gradleVersion !== '' && gradleVersion !== 'wrapper') {
-        return addToPath(path.resolve(await installGradle(gradleVersion)))
-    }
-
-    const gradleExecutable = params.getGradleExecutable()
-    if (gradleExecutable !== '') {
-        const workspaceDirectory = layout.workspaceDirectory()
-        return addToPath(path.resolve(workspaceDirectory, gradleExecutable))
+        return addToPath(await installGradle(gradleVersion))
     }
 
     return undefined
@@ -38,6 +31,12 @@ async function addToPath(executable: string): Promise<string> {
 }
 
 async function installGradle(version: string): Promise<string> {
+    const versionInfo = await resolveGradleVersion(version)
+    core.setOutput('gradle-version', versionInfo.version)
+    return installGradleVersion(versionInfo)
+}
+
+async function resolveGradleVersion(version: string): Promise<GradleVersionInfo> {
     switch (version) {
         case 'current':
             return gradleCurrent()
@@ -55,36 +54,33 @@ async function installGradle(version: string): Promise<string> {
     }
 }
 
-async function gradleCurrent(): Promise<string> {
-    const versionInfo = await gradleVersionDeclaration(`${gradleVersionsBaseUrl}/current`)
-    return installGradleVersion(versionInfo)
+async function gradleCurrent(): Promise<GradleVersionInfo> {
+    return await gradleVersionDeclaration(`${gradleVersionsBaseUrl}/current`)
 }
 
-async function gradleReleaseCandidate(): Promise<string> {
+async function gradleReleaseCandidate(): Promise<GradleVersionInfo> {
     const versionInfo = await gradleVersionDeclaration(`${gradleVersionsBaseUrl}/release-candidate`)
     if (versionInfo && versionInfo.version && versionInfo.downloadUrl) {
-        return installGradleVersion(versionInfo)
+        return versionInfo
     }
     core.info('No current release-candidate found, will fallback to current')
     return gradleCurrent()
 }
 
-async function gradleNightly(): Promise<string> {
-    const versionInfo = await gradleVersionDeclaration(`${gradleVersionsBaseUrl}/nightly`)
-    return installGradleVersion(versionInfo)
+async function gradleNightly(): Promise<GradleVersionInfo> {
+    return await gradleVersionDeclaration(`${gradleVersionsBaseUrl}/nightly`)
 }
 
-async function gradleReleaseNightly(): Promise<string> {
-    const versionInfo = await gradleVersionDeclaration(`${gradleVersionsBaseUrl}/release-nightly`)
-    return installGradleVersion(versionInfo)
+async function gradleReleaseNightly(): Promise<GradleVersionInfo> {
+    return await gradleVersionDeclaration(`${gradleVersionsBaseUrl}/release-nightly`)
 }
 
-async function gradle(version: string): Promise<string> {
+async function gradle(version: string): Promise<GradleVersionInfo> {
     const versionInfo = await findGradleVersionDeclaration(version)
     if (!versionInfo) {
         throw new Error(`Gradle version ${version} does not exists`)
     }
-    return installGradleVersion(versionInfo)
+    return versionInfo
 }
 
 async function gradleVersionDeclaration(url: string): Promise<GradleVersionInfo> {
@@ -173,7 +169,7 @@ async function httpGetGradleVersions(url: string): Promise<GradleVersionInfo[]>
 }
 
 async function httpGetString(url: string): Promise<string> {
-    const httpClient = new httpm.HttpClient('gradle/gradle-build-action')
+    const httpClient = new httpm.HttpClient('gradle/actions')
     const response = await httpClient.get(url)
     return response.readBody()
 }