Bump @vercel/ncc in /sources in the npm-dependencies group

Bumps the npm-dependencies group in /sources with 1 update: [@vercel/ncc](https://github.com/vercel/ncc). Updates `@vercel/ncc` from 0.38.2 to 0.38.3 - [Release notes](https://github.com/vercel/ncc/releases) - [Commits](https://github.com/vercel/ncc/compare/0.38.2...0.38.3) --- updated-dependencies: - dependency-name: "@vercel/ncc" dependency-type: direct:development update-type: version-update:semver-patch dependency-group: npm-dependencies ... Signed-off-by: dependabot[bot] <support@github.com>
Bump the github-actions group with 3 updates
2025-11-26 17:09:10 +08:00 · 2024-11-18 10:36:18 -07:00 · 2024-11-18 10:35:58 -07:00 · 2024-11-17 07:26:28 -07:00 · 2024-11-16 20:53:42 +00:00 · 2024-11-16 13:52:38 -07:00
82 changed files with 17891 additions and 20871 deletions
--- a/.github/actions/build-dist/action.yml
+++ b/.github/actions/build-dist/action.yml
@@ -3,7 +3,7 @@ name: 'Build and upload distribution'
 runs:
  using: "composite"
  steps: 
-    - uses: actions/setup-node@v4
+    - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
      with:
        node-version: 20
        cache: npm
@@ -23,7 +23,7 @@ runs:
        cp -r sources/dist .

    - name: Upload distribution
-      uses: actions/upload-artifact@v4
+      uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
      with:
        name: dist
        path: dist/
--- a/.github/actions/init-integ-test/action.yml
+++ b/.github/actions/init-integ-test/action.yml
@@ -4,7 +4,7 @@ runs:
  using: "composite"
  steps: 
    - name: Setup Java
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@8df1039502a15bceb9433410b1a100fbe190c53b # v4.5.0
      with:
        distribution: 'temurin'
        java-version: 11
@@ -17,7 +17,7 @@ runs:
    # Downloads a 'dist' directory artifact that was uploaded in an earlier 'build-dist' step
    - name: Download dist
      if: ${{ env.SKIP_DIST != 'true' && !env.ACT }}
-      uses: actions/download-artifact@v4
+      uses: actions/download-artifact@fa0a91b85d4f404e444e00e005971372dc801d16 # v4.1.8
      with:
        name: dist
        path: dist/
--- a/.github/workflow-samples/gradle-plugin/gradle/wrapper/gradle-wrapper.properties
+++ b/.github/workflow-samples/gradle-plugin/gradle/wrapper/gradle-wrapper.properties
@@ -1,7 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=5b9c5eb3f9fc2c94abaea57d90bd78747ca117ddbbf96c859d3741181a12bf2a
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.10-bin.zip
+distributionSha256Sum=57dafb5c2622c6cc08b993c85b7c06956a2f53536432a30ead46166dbca0f1e9
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.11-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
--- a/.github/workflow-samples/groovy-dsl/gradle/wrapper/gradle-wrapper.properties
+++ b/.github/workflow-samples/groovy-dsl/gradle/wrapper/gradle-wrapper.properties
@@ -1,7 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=5b9c5eb3f9fc2c94abaea57d90bd78747ca117ddbbf96c859d3741181a12bf2a
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.10-bin.zip
+distributionSha256Sum=57dafb5c2622c6cc08b993c85b7c06956a2f53536432a30ead46166dbca0f1e9
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.11-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
--- a/.github/workflow-samples/groovy-dsl/settings.gradle
+++ b/.github/workflow-samples/groovy-dsl/settings.gradle
@@ -1,6 +1,6 @@
 plugins {
-    id "com.gradle.develocity" version "3.18.1"
-    id "com.gradle.common-custom-user-data-gradle-plugin" version "2.0.1"
+    id "com.gradle.develocity" version "3.18.2"
+    id "com.gradle.common-custom-user-data-gradle-plugin" version "2.0.2"
 }

 develocity {
--- a/.github/workflow-samples/java-toolchain/gradle/wrapper/gradle-wrapper.properties
+++ b/.github/workflow-samples/java-toolchain/gradle/wrapper/gradle-wrapper.properties
@@ -1,7 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=5b9c5eb3f9fc2c94abaea57d90bd78747ca117ddbbf96c859d3741181a12bf2a
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.10-bin.zip
+distributionSha256Sum=57dafb5c2622c6cc08b993c85b7c06956a2f53536432a30ead46166dbca0f1e9
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.11-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
--- a/.github/workflow-samples/kotlin-dsl/build.gradle.kts
+++ b/.github/workflow-samples/kotlin-dsl/build.gradle.kts
@@ -8,9 +8,9 @@ repositories {

 dependencies {
    api("org.apache.commons:commons-math3:3.6.1")
-    implementation("com.google.guava:guava:33.3.0-jre")
+    implementation("com.google.guava:guava:33.3.1-jre")

-    testImplementation("org.junit.jupiter:junit-jupiter:5.11.0")
+    testImplementation("org.junit.jupiter:junit-jupiter:5.11.3")
 }

 tasks.test {
--- a/.github/workflow-samples/kotlin-dsl/gradle/wrapper/gradle-wrapper.properties
+++ b/.github/workflow-samples/kotlin-dsl/gradle/wrapper/gradle-wrapper.properties
@@ -1,7 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=5b9c5eb3f9fc2c94abaea57d90bd78747ca117ddbbf96c859d3741181a12bf2a
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.10-bin.zip
+distributionSha256Sum=57dafb5c2622c6cc08b993c85b7c06956a2f53536432a30ead46166dbca0f1e9
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.11-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
--- a/.github/workflow-samples/kotlin-dsl/settings.gradle.kts
+++ b/.github/workflow-samples/kotlin-dsl/settings.gradle.kts
@@ -1,6 +1,6 @@
 plugins {
-    id("com.gradle.develocity") version "3.18.1"
-    id("com.gradle.common-custom-user-data-gradle-plugin") version "2.0.1"
+    id("com.gradle.develocity") version "3.18.2"
+    id("com.gradle.common-custom-user-data-gradle-plugin") version "2.0.2"
 }

 develocity {
--- a/.github/workflow-samples/no-wrapper-gradle-5/build.gradle
+++ b/.github/workflow-samples/no-wrapper-gradle-5/build.gradle
@@ -1,5 +1,5 @@
 plugins {
-    id "com.gradle.develocity" version "3.18.1" 
+    id "com.gradle.develocity" version "3.18.2" 
 }

 develocity {
--- a/.github/workflow-samples/no-wrapper/settings.gradle
+++ b/.github/workflow-samples/no-wrapper/settings.gradle
@@ -1,5 +1,5 @@
 plugins {
-    id "com.gradle.develocity" version "3.18.1"
+    id "com.gradle.develocity" version "3.18.2"
 }

 develocity {
--- a/.github/workflow-samples/non-executable-wrapper/gradle/wrapper/gradle-wrapper.properties
+++ b/.github/workflow-samples/non-executable-wrapper/gradle/wrapper/gradle-wrapper.properties
@@ -1,7 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=5b9c5eb3f9fc2c94abaea57d90bd78747ca117ddbbf96c859d3741181a12bf2a
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.10-bin.zip
+distributionSha256Sum=57dafb5c2622c6cc08b993c85b7c06956a2f53536432a30ead46166dbca0f1e9
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.11-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
--- a/.github/workflow-samples/non-executable-wrapper/settings.gradle
+++ b/.github/workflow-samples/non-executable-wrapper/settings.gradle
@@ -1,5 +1,5 @@
 plugins {
-    id "com.gradle.develocity" version "3.18.1"
+    id "com.gradle.develocity" version "3.18.2"
 }

 develocity {
--- a/.github/workflows/ci-check-and-unit-test.yml
+++ b/.github/workflows/ci-check-and-unit-test.yml
@@ -17,16 +17,23 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
-    - uses: actions/setup-node@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+    - uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
      with:
        node-version: 20
        cache: npm
        cache-dependency-path: sources/package-lock.json
+    - name: Setup Gradle
+      # Use a released version to avoid breakages
+      uses: gradle/actions/setup-gradle@473878a77f1b98e2b5ac4af93489d1656a80a5ed # v4.2.0
+      env:
+        ALLOWED_GRADLE_WRAPPER_CHECKSUMS: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 # Invalid wrapper jar used for testing
+      with:
+        gradle-version: "8.11"

    - name: Check formatting and compile
      run: |
-        npm install
+        npm clean-install
        npm run check
        npm run compile
      working-directory: sources
--- a/.github/workflows/ci-check-no-dist-update.yml
+++ b/.github/workflows/ci-check-no-dist-update.yml
@@ -15,13 +15,13 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        fetch-depth: 0

    - name: Get changed files
      id: changed-files
-      uses: tj-actions/changed-files@v45
+      uses: tj-actions/changed-files@4edd678ac3f81e2dc578756871e4d00c19191daf # v45.0.4
      with:
        files: |
          dist/**
--- a/.github/workflows/ci-codeql.yml
+++ b/.github/workflows/ci-codeql.yml
@@ -6,16 +6,15 @@ on:
    - 'main'
    - 'release/**'
    - 'dev/**' # Allow running Code QL on dev branches without a PR
-    paths-ignore:
-    - 'dist/**'
  pull_request:
    branches:
    - 'main'
-    paths-ignore:
-    - 'dist/**'
  schedule:
    - cron: '25 23 * * 2'

+permissions:
+  contents: read
+
 jobs:
  analyze:
    name: Analyze
@@ -32,11 +31,11 @@ jobs:

    steps:
    - name: Checkout repository
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

    # Initializes the CodeQL tools for scanning.
    - name: Initialize CodeQL
-      uses: github/codeql-action/init@v3
+      uses: github/codeql-action/init@ea9e4e37992a54ee68a9622e985e60c8e8f12d9f # v3.27.4
      with:
        languages: ${{ matrix.language }}
        config: |
@@ -44,4 +43,4 @@ jobs:
          - sources/src

    - name: Perform CodeQL Analysis
-      uses: github/codeql-action/analyze@v3
+      uses: github/codeql-action/analyze@ea9e4e37992a54ee68a9622e985e60c8e8f12d9f # v3.27.4
--- a/.github/workflows/ci-init-script-check.yml
+++ b/.github/workflows/ci-init-script-check.yml
@@ -14,19 +14,23 @@ on:
      - 'sources/test/init-scripts/**'
  workflow_dispatch:

+permissions:
+  contents: read
+
 jobs:
  test-init-scripts:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Setup Java
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@8df1039502a15bceb9433410b1a100fbe190c53b # v4.5.0
      with:
        distribution: temurin
        java-version: 11
    - name: Setup Gradle
-      uses: gradle/actions/setup-gradle@v4 # Use a released version to avoid breakages
+      # Use a released version to avoid breakages
+      uses: gradle/actions/setup-gradle@473878a77f1b98e2b5ac4af93489d1656a80a5ed # v4.2.0
      env:
        ALLOWED_GRADLE_WRAPPER_CHECKSUMS: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855 # Invalid wrapper jar used for testing
    - name: Run integration tests
--- a/.github/workflows/ci-integ-test-full.yml
+++ b/.github/workflows/ci-integ-test-full.yml
@@ -6,13 +6,13 @@ on:
    paths:
    - 'dist/**'

-permissions:
-  contents: write
-
 concurrency:
  group: integ-test
  cancel-in-progress: false

+permissions:
+  contents: read
+
 jobs:
  caching-integ-tests:
    uses: ./.github/workflows/suite-integ-test-caching.yml
@@ -25,6 +25,8 @@ jobs:
    secrets: inherit

  other-integ-tests:
+    permissions:
+      contents: write
    uses: ./.github/workflows/suite-integ-test-other.yml
    concurrency:
      group: CI-integ-test-full
--- a/.github/workflows/ci-integ-test.yml
+++ b/.github/workflows/ci-integ-test.yml
@@ -11,19 +11,19 @@ on:
    paths-ignore:
    - 'dist/**'

-permissions:
-  contents: write
-
 concurrency:
  group: integ-test
  cancel-in-progress: false

+permissions:
+  contents: read
+
 jobs:
  build-distribution:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Build and upload distribution
      if: ${{ needs.determine-suite.outputs.suite != 'full' }}
      uses: ./.github/actions/build-dist
@@ -36,6 +36,8 @@ jobs:
    secrets: inherit

  other-integ-tests:
+    permissions:
+      contents: write
    needs: build-distribution
    uses: ./.github/workflows/suite-integ-test-other.yml
    with:
--- a/.github/workflows/ci-ossf-scorecard.yml
+++ b/.github/workflows/ci-ossf-scorecard.yml
@@ -0,0 +1,57 @@
+name: CI-ossf-scorecard
+on:
+  schedule:
+    - cron: '0 5 * * 1'
+  push:
+    branches:
+      - main
+
+permissions:
+  contents: read
+
+jobs:
+  analysis:
+    name: Scorecard analysis
+    runs-on: ubuntu-latest
+    permissions:
+      # Needed to upload the results to code-scanning dashboard.
+      security-events: write
+      # Needed to publish results and get a badge (see publish_results below).
+      id-token: write
+
+    steps:
+      - name: 'Checkout code'
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+        with:
+          persist-credentials: false
+          show-progress: false
+
+      - name: 'Run analysis'
+        uses: ossf/scorecard-action@62b2cac7ed8198b15735ed49ab1e5cf35480ba46 # v2.4.0
+        with:
+          results_file: results.sarif
+          results_format: sarif
+
+          # Public repositories:
+          #   - Publish results to OpenSSF REST API for easy access by consumers
+          #   - Allows the repository to include the Scorecard badge.
+          #   - See https://github.com/ossf/scorecard-action#publishing-results.
+          # For private repositories:
+          #   - `publish_results` will always be set to `false`, regardless
+          #     of the value entered here.
+          publish_results: true
+
+      # Upload the results as artifacts (optional). Commenting out will disable uploads of run results in SARIF
+      # format to the repository Actions tab.
+      - name: 'Upload artifact'
+        uses: actions/upload-artifact@b4b15b8c7c6ac21ea08fcf65892d2ee8f75cf882 # v4.4.3
+        with:
+          name: SARIF file
+          path: results.sarif
+          retention-days: 5
+
+      # Upload the results to GitHub's code scanning dashboard.
+      - name: 'Upload to code-scanning'
+        uses: github/codeql-action/upload-sarif@ea9e4e37992a54ee68a9622e985e60c8e8f12d9f # v3.27.4
+        with:
+          sarif_file: results.sarif
--- a/.github/workflows/ci-update-dist.yml
+++ b/.github/workflows/ci-update-dist.yml
@@ -10,19 +10,24 @@ on:
    - 'dist/**'

 permissions:
-  contents: write
+  contents: read

 jobs:
  update-dist:
+    # Only run for the Gradle repository; otherwise when users create pull requests from their `main` branch
+    # it would erroneously update `dist` on their branch (and the pull request)
+    if: github.repository == 'gradle/actions'
+    permissions:
+      contents: write
    runs-on: ubuntu-latest

    steps:
-    - uses: actions/checkout@v4
+    - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      with:
        token: ${{ secrets.BOT_GITHUB_TOKEN }}

    - name: Set up Node.js
-      uses: actions/setup-node@v4
+      uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
      with:
        node-version: 20
        cache: npm
@@ -43,10 +48,7 @@ jobs:
    # Important: The push event will not trigger any other workflows, see
    # https://github.com/stefanzweifel/git-auto-commit-action?tab=readme-ov-file#commits-made-by-this-action-do-not-trigger-new-workflow-runs
    - name: Commit & push changes
-      # Only run for the Gradle repository; otherwise when users create pull requests from their `main` branch
-      # it would erroneously update `dist` on their branch (and the pull request)
-      if: github.repository == 'gradle/actions'
-      uses: stefanzweifel/git-auto-commit-action@v5
+      uses: stefanzweifel/git-auto-commit-action@8621497c8c39c72f3e2a999a26b4ca1b5058a842 # v5.0.1
      with:
        commit_message: '[bot] Update dist directory'
        file_pattern: dist
--- a/.github/workflows/ci-validate-wrappers.yml
+++ b/.github/workflows/ci-validate-wrappers.yml
@@ -0,0 +1,17 @@
+name: CI-validate-wrappers
+
+on:
+  push:
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  validation:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
+      - uses: gradle/actions/wrapper-validation@473878a77f1b98e2b5ac4af93489d1656a80a5ed # v4.2.0
+        with:
+          allow-checksums: e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
--- a/.github/workflows/demo-job-summary.yml
+++ b/.github/workflows/demo-job-summary.yml
@@ -3,12 +3,15 @@ name: Demo Job Summary, for Gradle builds
 on:
  workflow_dispatch:

+permissions:
+  contents: read
+
 jobs:
  build-distribution:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Build and upload distribution
      uses: ./.github/actions/build-dist

@@ -17,7 +20,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -59,7 +62,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -79,7 +82,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -100,7 +103,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

--- a/.github/workflows/demo-pr-build-scan-comment.yml
+++ b/.github/workflows/demo-pr-build-scan-comment.yml
@@ -4,23 +4,25 @@ on:
    types: [assigned, review_requested]

 permissions:
-  pull-requests: write
+  contents: read

 jobs:
  build-distribution:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Build and upload distribution
      uses: ./.github/actions/build-dist

  successful-build-with-always-comment:
+    permissions:
+      pull-requests: write
    needs: build-distribution
    runs-on: ubuntu-latest
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -34,11 +36,13 @@ jobs:
      run: ./gradlew build --scan

  successful-build-with-comment-on-failure:
+    permissions:
+      pull-requests: write
    needs: build-distribution
    runs-on: ubuntu-latest
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -52,11 +56,13 @@ jobs:
      run: ./gradlew build --scan

  failing-build-with-comment-on-failure:
+    permissions:
+      pull-requests: write
    needs: build-distribution
    runs-on: ubuntu-latest
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

--- a/.github/workflows/integ-test-build-scan-publish.yml
+++ b/.github/workflows/integ-test-build-scan-publish.yml
@@ -17,6 +17,9 @@ env:
  SKIP_DIST: ${{ inputs.skip-dist }}
  GRADLE_BUILD_ACTION_CACHE_KEY_PREFIX: build-scan-publish-${{ inputs.cache-key-prefix }}

+permissions:
+  contents: read
+
 jobs:
  build-scan-publish:
    strategy:
@@ -27,15 +30,10 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

-    - name: Setup Java
-      uses: actions/setup-java@v4
-      with:
-        distribution: temurin
-        java-version: 11
    - name: Setup Gradle
      id: setup-gradle
      uses: ./setup-gradle
@@ -51,7 +49,7 @@ jobs:
      run: gradle help
    - name: Check Build Scan url
      if: ${{ !steps.gradle.outputs.build-scan-url }}
-      uses: actions/github-script@v7
+      uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
      with:
        script: |
          core.setFailed('No Build Scan detected')   
--- a/.github/workflows/integ-test-cache-cleanup.yml
+++ b/.github/workflows/integ-test-cache-cleanup.yml
@@ -18,6 +18,9 @@ env:
  # Requires a fresh cache entry each run
  GRADLE_BUILD_ACTION_CACHE_KEY_PREFIX: cache-cleanup-${{ inputs.cache-key-prefix }}-${{github.run_number}}

+permissions:
+  contents: read
+
 jobs:
  cache-cleanup-full-build:
    strategy:
@@ -28,7 +31,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -51,7 +54,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -74,7 +77,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

--- a/.github/workflows/integ-test-caching-config.yml
+++ b/.github/workflows/integ-test-caching-config.yml
@@ -17,6 +17,9 @@ env:
  SKIP_DIST: ${{ inputs.skip-dist }}
  GRADLE_BUILD_ACTION_CACHE_KEY_PREFIX: caching-config-${{ inputs.cache-key-prefix }}

+permissions:
+  contents: read
+
 jobs:
  caching-config-seed-build:
    strategy:
@@ -27,7 +30,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -58,7 +61,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -87,7 +90,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -101,7 +104,7 @@ jobs:
      run: ./gradlew help
    - name: Check Build Scan url is captured
      if: ${{ !steps.gradle.outputs.build-scan-url }}
-      uses: actions/github-script@v7
+      uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
      with:
        script: |
          core.setFailed('No Build Scan detected')
@@ -111,7 +114,7 @@ jobs:
    runs-on: ubuntu-latest # This test only runs on Ubuntu
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -125,7 +128,7 @@ jobs:
      run: ./gradlew help
    - name: Check Build Scan url is captured
      if: ${{ !steps.gradle.outputs.build-scan-url }}
-      uses: actions/github-script@v7
+      uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
      with:
        script: |
          core.setFailed('No Build Scan detected')
@@ -142,7 +145,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -166,7 +169,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

--- a/.github/workflows/integ-test-dependency-graph.yml
+++ b/.github/workflows/integ-test-dependency-graph.yml
@@ -13,20 +13,20 @@ on:
        type: boolean
        default: false

-permissions:
-  contents: write
-
 env:
  SKIP_DIST: ${{ inputs.skip-dist }}
  GRADLE_BUILD_ACTION_CACHE_KEY_PREFIX: dependency-graph-${{ inputs.cache-key-prefix }}
  GITHUB_DEPENDENCY_GRAPH_REF: 'refs/tags/v0.0.1' # Use a different ref to avoid updating the real dependency graph for the repository

+permissions:
+  contents: read
+
 jobs:
  dependency-graph-groovy-upload:
    runs-on: "ubuntu-latest"
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -39,11 +39,13 @@ jobs:
      working-directory: .github/workflow-samples/groovy-dsl

  dependency-graph-groovy-submit:
+    permissions:
+      contents: write
    needs: [dependency-graph-groovy-upload]
    runs-on: "ubuntu-latest"
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -55,10 +57,12 @@ jobs:
        DEPENDENCY_GRAPH_DOWNLOAD_ARTIFACT_NAME: groovy-upload

  dependency-graph-kotlin-generate-and-submit:
+    permissions:
+      contents: write
    runs-on: "ubuntu-latest"
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -71,10 +75,12 @@ jobs:
      working-directory: .github/workflow-samples/kotlin-dsl

  dependency-graph-multiple-builds:
+    permissions:
+      contents: write
    runs-on: "ubuntu-latest"
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -112,10 +118,12 @@ jobs:
        fi
        
  dependency-graph-config-cache:
+    permissions:
+      contents: write
    runs-on: ubuntu-latest # Test is not compatible with Windows
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

--- a/.github/workflows/integ-test-dependency-submission-failures.yml
+++ b/.github/workflows/integ-test-dependency-submission-failures.yml
@@ -18,12 +18,15 @@ env:
  GRADLE_BUILD_ACTION_CACHE_KEY_PREFIX: dependency-submission-failures-${{ inputs.cache-key-prefix }}
  GITHUB_DEPENDENCY_GRAPH_REF: 'refs/tags/v0.0.1' # Use a different ref to avoid updating the real dependency graph for the repository

+permissions:
+  contents: read
+
 jobs:
  dependency-submission-failures-failing-build:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -52,7 +55,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -83,7 +86,7 @@ jobs:
      contents: read
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

--- a/.github/workflows/integ-test-dependency-submission.yml
+++ b/.github/workflows/integ-test-dependency-submission.yml
@@ -13,16 +13,18 @@ on:
        type: boolean
        default: false

-permissions:
-  contents: write
-
 env:
  SKIP_DIST: ${{ inputs.skip-dist }}
  GRADLE_BUILD_ACTION_CACHE_KEY_PREFIX: dependency-submission-${{ inputs.cache-key-prefix }}
  GITHUB_DEPENDENCY_GRAPH_REF: 'refs/tags/v0.0.1' # Use a different ref to avoid updating the real dependency graph for the repository

+permissions:
+  contents: read
+
 jobs:
  dependency-submission-groovy-generate-and-upload:
+    permissions:
+      contents: write
    strategy:
      max-parallel: 1
      fail-fast: false
@@ -31,7 +33,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -45,6 +47,8 @@ jobs:
        GRADLE_BUILD_ACTION_CACHE_KEY_JOB: groovy-dependency-submission

  dependency-submission-groovy-restore-cache:
+    permissions:
+      contents: write
    needs: [dependency-submission-groovy-generate-and-upload]
    strategy:
      max-parallel: 1
@@ -54,7 +58,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -67,6 +71,8 @@ jobs:
        GRADLE_BUILD_ACTION_CACHE_KEY_JOB: groovy-dependency-submission

  dependency-submission-groovy-download-and-submit:
+    permissions:
+      contents: write
    needs: [dependency-submission-groovy-generate-and-upload]
    strategy:
      max-parallel: 1
@@ -76,7 +82,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -88,6 +94,8 @@ jobs:
        DEPENDENCY_GRAPH_DOWNLOAD_ARTIFACT_NAME: groovy-generate-and-upload-${{ matrix.os }}

  dependency-submission-kotlin-generate-and-submit:
+    permissions:
+      contents: write
    strategy:
      max-parallel: 1
      fail-fast: false
@@ -96,7 +104,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -106,6 +114,8 @@ jobs:
        build-root-directory: .github/workflow-samples/kotlin-dsl

  dependency-submission-multiple-builds:
+    permissions:
+      contents: write
    strategy:
      max-parallel: 1
      fail-fast: false
@@ -114,7 +124,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -152,6 +162,8 @@ jobs:
        fi

  dependency-submission-multiple-builds-upload:
+    permissions:
+      contents: write
    strategy:
      max-parallel: 1
      fail-fast: false
@@ -160,7 +172,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -176,10 +188,12 @@ jobs:
        build-root-directory: .github/workflow-samples/groovy-dsl

  dependency-submission-config-cache:
+    permissions:
+      contents: write
    runs-on: ubuntu-latest # Test is not compatible with Windows
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -211,6 +225,8 @@ jobs:
        fi

  dependency-submission-gradle-versions:
+    permissions:
+      contents: write
    strategy:
      fail-fast: false
      matrix:
@@ -224,7 +240,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -235,10 +251,12 @@ jobs:
        build-root-directory: .github/workflow-samples/no-wrapper${{ matrix.build-root-suffix }}

  dependency-submission-with-setup-gradle:
+    permissions:
+      contents: write
    runs-on: ubuntu-latest # Test is not compatible with Windows
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -270,10 +288,12 @@ jobs:
        fi

  dependency-submission-with-includes-and-excludes:
+    permissions:
+      contents: write
    runs-on: ubuntu-latest # Test is not compatible with Windows
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -304,6 +324,8 @@ jobs:


  dependency-submission-custom-report-dir-submit:
+    permissions:
+      contents: write
    strategy:
      max-parallel: 1
      fail-fast: false
@@ -312,7 +334,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -339,10 +361,12 @@ jobs:
        fi

  dependency-submission-custom-report-dir-upload:
+    permissions:
+      contents: write
    runs-on: ubuntu-latest
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -355,11 +379,13 @@ jobs:
        build-root-directory: .github/workflow-samples/groovy-dsl

  custom-report-dir-download-and-submit:
+    permissions:
+      contents: write
    needs: [dependency-submission-custom-report-dir-upload]
    runs-on: ubuntu-latest
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

--- a/.github/workflows/integ-test-detect-toolchains.yml
+++ b/.github/workflows/integ-test-detect-toolchains.yml
@@ -17,6 +17,9 @@ env:
  SKIP_DIST: ${{ inputs.skip-dist }}
  GRADLE_BUILD_ACTION_CACHE_KEY_PREFIX: detect-java-toolchain-${{ inputs.cache-key-prefix }}

+permissions:
+  contents: read
+
 jobs:
  # Test that pre-installed runner JDKs are detected
  detect-toolchains-pre-installed-jdks:
@@ -27,7 +30,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -57,17 +60,17 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

    - name: Setup Java 20
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@8df1039502a15bceb9433410b1a100fbe190c53b # v4.5.0
      with:
        distribution: 'temurin'
        java-version: 20
    - name: Setup Java 16
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@8df1039502a15bceb9433410b1a100fbe190c53b # v4.5.0
      with:
        distribution: 'temurin'
        java-version: 16
--- a/.github/workflows/integ-test-inject-develocity.yml
+++ b/.github/workflows/integ-test-inject-develocity.yml
@@ -20,38 +20,36 @@ env:
  SKIP_DIST: ${{ inputs.skip-dist }}
  GRADLE_BUILD_ACTION_CACHE_KEY_PREFIX: inject-develocity-${{ inputs.cache-key-prefix }}

+permissions:
+  contents: read
+
 jobs:
  inject-develocity:
    env:
      DEVELOCITY_INJECTION_ENABLED: true
      DEVELOCITY_URL: https://ge.solutions-team.gradle.com
      DEVELOCITY_PLUGIN_VERSION: ${{ matrix.plugin-version }}
-      DEVELOCITY_CCUD_PLUGIN_VERSION: '2.0'
+      DEVELOCITY_CCUD_PLUGIN_VERSION: '2.0.2'
      ${{matrix.accessKeyEnv}}: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
    strategy:
      fail-fast: false
      matrix:
        gradle: [current, 7.6.2, 6.9.4, 5.6.4]
        os: ${{fromJSON(inputs.runner-os)}}
-        plugin-version: [3.16.2, 3.18.1]
+        plugin-version: [3.16.2, 3.18.2]
        include:
        - plugin-version: 3.16.2
          accessKeyEnv: GRADLE_ENTERPRISE_ACCESS_KEY
-        - plugin-version: 3.18.1
+        - plugin-version: 3.18.2
          accessKeyEnv: DEVELOCITY_ACCESS_KEY

    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

-    - name: Setup Java
-      uses: actions/setup-java@v4
-      with:
-        distribution: temurin
-        java-version: 11
    - name: Setup Gradle
      id: setup-gradle
      uses: ./setup-gradle
@@ -64,7 +62,7 @@ jobs:
      run: gradle help
    - name: Check Build Scan url
      if: ${{ !steps.gradle.outputs.build-scan-url }}
-      uses: actions/github-script@v7
+      uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
      with:
        script: |
          core.setFailed('No Build Scan detected')
@@ -78,24 +76,19 @@ jobs:
      DEVELOCITY_INJECTION_ENABLED: true
      DEVELOCITY_URL: 'https://ge.solutions-team.gradle.com'
      DEVELOCITY_PLUGIN_VERSION: ${{ matrix.plugin-version }}
-      DEVELOCITY_CCUD_PLUGIN_VERSION: '2.0'
+      DEVELOCITY_CCUD_PLUGIN_VERSION: '2.0.2'
    strategy:
      fail-fast: false
      matrix:
        gradle: [current, 7.6.2, 6.9.4, 5.6.4]
        os: ${{fromJSON(inputs.runner-os)}}
-        plugin-version: [3.16.2, 3.18.1]
+        plugin-version: [3.16.2, 3.18.2]
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Initialize integ-test
        uses: ./.github/actions/init-integ-test
-      - name: Setup Java
-        uses: actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: 8
      - name: Setup Gradle
        id: setup-gradle
        uses: ./setup-gradle
@@ -114,7 +107,7 @@ jobs:
        run: "[ ${#GRADLE_ENTERPRISE_ACCESS_KEY} -gt 500 ] || (echo 'GRADLE_ENTERPRISE_ACCESS_KEY does not look like a short lived token'; exit 1)"
      - name: Check Build Scan url
        if: ${{ !steps.gradle.outputs.build-scan-url }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          script: |
            core.setFailed('No Build Scan detected')
@@ -124,7 +117,7 @@ jobs:
      DEVELOCITY_INJECTION_ENABLED: true
      DEVELOCITY_URL: 'https://localhost:3333/'
      DEVELOCITY_PLUGIN_VERSION: ${{ matrix.plugin-version }}
-      DEVELOCITY_CCUD_PLUGIN_VERSION: '2.0'
+      DEVELOCITY_CCUD_PLUGIN_VERSION: '2.0.2'
      # Access key also set as an env var, we want to check it does not leak
      GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
      DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
@@ -133,19 +126,14 @@ jobs:
      matrix:
        gradle: [ current, 7.6.2, 6.9.4, 5.6.4 ]
        os: ${{fromJSON(inputs.runner-os)}}
-        plugin-version: [ 3.16.2, 3.18.1 ]
+        plugin-version: [ 3.16.2, 3.18.2 ]
    runs-on: ubuntu-latest
    steps:
      - name: Checkout sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Initialize integ-test
        uses: ./.github/actions/init-integ-test

-      - name: Setup Java
-        uses: actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: 8
      - name: Setup Gradle
        id: setup-gradle
        uses: ./setup-gradle
@@ -169,18 +157,13 @@ jobs:
      matrix:
        gradle: [ current, 7.6.2, 6.9.4, 5.6.4 ]
        os: ${{fromJSON(inputs.runner-os)}}
-        plugin-version: [ 3.16.2, 3.18.1 ]
+        plugin-version: [ 3.16.2, 3.18.2 ]
    runs-on: ${{ matrix.os }}
    steps:
      - name: Checkout sources
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
      - name: Initialize integ-test
        uses: ./.github/actions/init-integ-test
-      - name: Setup Java
-        uses: actions/setup-java@v4
-        with:
-          distribution: temurin
-          java-version: 8
      - name: Setup Gradle
        id: setup-gradle
        uses: ./setup-gradle
@@ -196,7 +179,7 @@ jobs:
        run: gradle help
      - name: Check Build Scan url
        if: ${{ !steps.gradle.outputs.build-scan-url }}
-        uses: actions/github-script@v7
+        uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
        with:
          script: |
            core.setFailed('No Build Scan detected')
--- a/.github/workflows/integ-test-provision-gradle-versions.yml
+++ b/.github/workflows/integ-test-provision-gradle-versions.yml
@@ -18,6 +18,9 @@ env:
  GRADLE_BUILD_ACTION_CACHE_KEY_PREFIX: provision-gradle-versions-${{ inputs.cache-key-prefix }}
  GRADLE_BUILD_ACTION_CACHE_DEBUG_ENABLED: true

+permissions:
+  contents: read
+
 jobs:   
  # Tests for executing with different Gradle versions. 
  # Each build verifies that it is executed with the expected Gradle version.
@@ -30,7 +33,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -66,7 +69,7 @@ jobs:
      run: gradle help
    - name: Check current version output parameter
      if: ${{ !startsWith(steps.gradle-current.outputs.gradle-version , '8.') }}
-      uses: actions/github-script@v7
+      uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
      with:
        script: |
          core.setFailed('Gradle version parameter not set correctly: value was "${{ steps.gradle-current.outputs.gradle-version }}"')    
@@ -75,7 +78,7 @@ jobs:
    strategy:
      fail-fast: false
      matrix:
-        gradle: ["8.10", 8.9, 8.1, 7.6.4, 6.9.4, 5.6.4, 4.10.3, 3.5.1]
+        gradle: ["8.11", 8.9, 8.1, 7.6.4, 6.9.4, 5.6.4, 4.10.3, 3.5.1]
        os: ${{fromJSON(inputs.runner-os)}}
        include:
          - java-version: 11
@@ -92,12 +95,12 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

    - name: Setup Java
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@8df1039502a15bceb9433410b1a100fbe190c53b # v4.5.0
      with:
        distribution: temurin
        java-version: ${{ matrix.java-version }}
@@ -109,7 +112,7 @@ jobs:
        gradle-version: ${{ matrix.gradle }}
    - name: Check output parameter
      if: ${{ steps.setup-gradle.outputs.gradle-version != matrix.gradle }}
-      uses: actions/github-script@v7
+      uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
      with:
        script: |
          core.setFailed('Gradle version parameter not set correctly: value was "${{ steps.setup-gradle.outputs.gradle-version }}"')    
@@ -119,7 +122,7 @@ jobs:
      run: gradle help "-DgradleVersionCheck=${{matrix.gradle}}"
    - name: Check Build Scan url
      if: ${{ !steps.gradle.outputs.build-scan-url }}
-      uses: actions/github-script@v7
+      uses: actions/github-script@60a0d83039c74a4aee543508d2ffcb1c3799cdea # v7.0.1
      with:
        script: |
          core.setFailed('No Build Scan detected')    
--- a/.github/workflows/integ-test-restore-configuration-cache.yml
+++ b/.github/workflows/integ-test-restore-configuration-cache.yml
@@ -20,6 +20,9 @@ env:
  SKIP_DIST: ${{ inputs.skip-dist }}
  GRADLE_BUILD_ACTION_CACHE_KEY_PREFIX: restore-configuration-cache-${{ inputs.cache-key-prefix }}

+permissions:
+  contents: read
+
 jobs:
  restore-cc-seed-build-groovy:
    env:
@@ -32,22 +35,16 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

-    - name: Setup Java to ensure consistency
-      uses: actions/setup-java@v4
-      with:
-        distribution: 'liberica'
-        java-version: 17
    - name: Setup Gradle
      uses: ./setup-gradle
      with:
        cache-read-only: false # For testing, allow writing cache entries on non-default branches
        cache-write-only: true # Ensure we start with a clean cache entry
        cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
-        gradle-version: 8.6
    - name: Groovy build with configuration-cache enabled
      working-directory: .github/workflow-samples/groovy-dsl
      run: gradle test --configuration-cache
@@ -65,22 +62,16 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

-    - name: Setup Java to ensure consistency
-      uses: actions/setup-java@v4
-      with:
-        distribution: 'liberica'
-        java-version: 17
    - name: Setup Gradle
      uses: ./setup-gradle
      with:
        cache-read-only: false
        cache-cleanup: on-success
        cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
-        gradle-version: 8.6
    - name: Groovy build with configuration-cache enabled
      id: execute
      working-directory: .github/workflow-samples/groovy-dsl
@@ -107,21 +98,15 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

-    - name: Setup Java to ensure consistency
-      uses: actions/setup-java@v4
-      with:
-        distribution: 'liberica'
-        java-version: 17
    - name: Setup Gradle
      uses: ./setup-gradle
      with:
        cache-read-only: true
        cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
-        gradle-version: 8.6
    - name: Groovy build with configuration-cache enabled
      id: execute
      working-directory: .github/workflow-samples/groovy-dsl
@@ -148,15 +133,10 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

-    - name: Setup Java to ensure consistency
-      uses: actions/setup-java@v4
-      with:
-        distribution: 'liberica'
-        java-version: 17
    - name: Setup Gradle with no extracted cache entries restored
      uses: ./setup-gradle
      env: 
@@ -164,7 +144,6 @@ jobs:
      with:
        cache-read-only: true
        cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
-        gradle-version: 8.6
    - name: Check execute Gradle build with configuration cache enabled (but not restored)
      working-directory: .github/workflow-samples/groovy-dsl
      run: gradle test --configuration-cache
@@ -180,22 +159,16 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

-    - name: Setup Java to ensure consistency
-      uses: actions/setup-java@v4
-      with:
-        distribution: 'liberica'
-        java-version: 17
    - name: Setup Gradle
      uses: ./setup-gradle
      with:
        cache-read-only: false # For testing, allow writing cache entries on non-default branches
        cache-write-only: true # Ensure we start with a clean cache entry
        cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
-        gradle-version: 8.6
    - name: Execute 'help' with configuration-cache enabled
      working-directory: .github/workflow-samples/kotlin-dsl
      run: gradle help --configuration-cache
@@ -213,21 +186,15 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

-    - name: Setup Java to ensure consistency
-      uses: actions/setup-java@v4
-      with:
-        distribution: 'liberica'
-        java-version: 17
    - name: Setup Gradle
      uses: ./setup-gradle
      with:
        cache-read-only: false # For testing, allow writing cache entries on non-default branches
        cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
-        gradle-version: 8.6
    - name: Execute 'test' with configuration-cache enabled
      working-directory: .github/workflow-samples/kotlin-dsl
      run: gradle test --configuration-cache
@@ -246,21 +213,15 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

-    - name: Setup Java to ensure consistency
-      uses: actions/setup-java@v4
-      with:
-        distribution: 'liberica'
-        java-version: 17
    - name: Setup Gradle
      uses: ./setup-gradle
      with:
        cache-read-only: true
        cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
-        gradle-version: 8.6
    - name: Execute 'test' again with configuration-cache enabled
      id: execute
      working-directory: .github/workflow-samples/kotlin-dsl
--- a/.github/workflows/integ-test-restore-containerized-gradle-home.yml
+++ b/.github/workflows/integ-test-restore-containerized-gradle-home.yml
@@ -14,13 +14,16 @@ env:
  SKIP_DIST: ${{ inputs.skip-dist }}
  GRADLE_BUILD_ACTION_CACHE_KEY_PREFIX: restore-containerized-gradle-home-${{ inputs.cache-key-prefix }}

+permissions:
+  contents: read
+
 jobs:
  restore-containerized-seed-build:
    runs-on: ubuntu-latest
    container: fedora:latest
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -39,7 +42,7 @@ jobs:
    container: fedora:latest
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

--- a/.github/workflows/integ-test-restore-custom-gradle-home.yml
+++ b/.github/workflows/integ-test-restore-custom-gradle-home.yml
@@ -14,12 +14,15 @@ env:
  SKIP_DIST: ${{ inputs.skip-dist }}
  GRADLE_BUILD_ACTION_CACHE_KEY_PREFIX: restore-custom-gradle-home-${{ inputs.cache-key-prefix }}

+permissions:
+  contents: read
+
 jobs:
  restore-custom-gradle-home-seed-build:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -41,7 +44,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -63,7 +66,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

--- a/.github/workflows/integ-test-restore-gradle-home.yml
+++ b/.github/workflows/integ-test-restore-gradle-home.yml
@@ -18,6 +18,9 @@ env:
  GRADLE_BUILD_ACTION_CACHE_KEY_PREFIX: restore-gradle-home-${{ inputs.cache-key-prefix }}
  GRADLE_BUILD_ACTION_CACHE_KEY_JOB: restore-gradle-home

+permissions:
+  contents: read
+
 jobs:
  restore-gradle-home-seed-build:
    strategy:
@@ -28,7 +31,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -51,7 +54,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -74,7 +77,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -97,7 +100,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -122,7 +125,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

--- a/.github/workflows/integ-test-restore-java-toolchain.yml
+++ b/.github/workflows/integ-test-restore-java-toolchain.yml
@@ -17,6 +17,9 @@ env:
  SKIP_DIST: ${{ inputs.skip-dist }}
  GRADLE_BUILD_ACTION_CACHE_KEY_PREFIX: restore-java-toolchain-${{ inputs.cache-key-prefix }}

+permissions:
+  contents: read
+
 jobs:
  restore-java-toolchain-seed-build:
    strategy:
@@ -27,7 +30,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -50,7 +53,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

--- a/.github/workflows/integ-test-sample-gradle-plugin.yml
+++ b/.github/workflows/integ-test-sample-gradle-plugin.yml
@@ -17,6 +17,9 @@ env:
  SKIP_DIST: ${{ inputs.skip-dist }}
  GRADLE_BUILD_ACTION_CACHE_KEY_PREFIX: sample-gradle-plugin-${{ inputs.cache-key-prefix }}

+permissions:
+  contents: read
+
 jobs:
  sample-gradle-plugin-seed-build:
    strategy:
@@ -27,7 +30,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -49,7 +52,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

--- a/.github/workflows/integ-test-sample-kotlin-dsl.yml
+++ b/.github/workflows/integ-test-sample-kotlin-dsl.yml
@@ -17,6 +17,9 @@ env:
  SKIP_DIST: ${{ inputs.skip-dist }}
  GRADLE_BUILD_ACTION_CACHE_KEY_PREFIX: sample-kotlin-dsl-${{ inputs.cache-key-prefix }}

+permissions:
+  contents: read
+
 jobs:
  sample-kotlin-dsl-seed-build:
    strategy:
@@ -27,7 +30,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -49,7 +52,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

--- a/.github/workflows/integ-test-wrapper-validation.yml
+++ b/.github/workflows/integ-test-wrapper-validation.yml
@@ -13,6 +13,9 @@ on:
 env:
  SKIP_DIST: ${{ inputs.skip-dist }}

+permissions:
+  contents: read
+
 jobs:
  wrapper-validation-setup-gradle:
    strategy:
@@ -22,7 +25,7 @@ jobs:
    runs-on: ${{ matrix.os }}
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -45,7 +48,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -74,7 +77,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -107,7 +110,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2
    - name: Initialize integ-test
      uses: ./.github/actions/init-integ-test

@@ -137,7 +140,7 @@ jobs:
    runs-on: ubuntu-latest
    steps:
    - name: Checkout sources
-      uses: actions/checkout@v4 # Checkout the repository with no wrappers
+      uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 # Checkout the repository with no wrappers
      with:
        sparse-checkout: |
          .github/actions
--- a/.github/workflows/suite-integ-test-caching.yml
+++ b/.github/workflows/suite-integ-test-caching.yml
@@ -10,6 +10,9 @@ on:
        type: boolean
        default: false

+permissions:
+  contents: read
+
 jobs:
  cache-cleanup:
    uses: ./.github/workflows/integ-test-cache-cleanup.yml
--- a/.github/workflows/suite-integ-test-other.yml
+++ b/.github/workflows/suite-integ-test-other.yml
@@ -10,6 +10,9 @@ on:
        type: boolean
        default: false

+permissions:
+  contents: read
+
 jobs:
  build-scan-publish:
    uses: ./.github/workflows/integ-test-build-scan-publish.yml
--- a/.github/workflows/update-checksums-file.yml
+++ b/.github/workflows/update-checksums-file.yml
@@ -7,20 +7,22 @@ on:
  workflow_dispatch:

 permissions:
-  contents: write
-  pull-requests: write
+  contents: read

 jobs:
  update-checksums:
+    permissions:
+      contents: write
+      pull-requests: write
    name: Update checksums
    runs-on: ubuntu-latest

    steps:
      - name: Checkout
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2

      - name: Set up Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4.1.0
        with:
          node-version: 20
          cache: npm
@@ -28,7 +30,7 @@ jobs:

      - name: Install dependencies
        run: |
-          npm install typed-rest-client@1.8.11 --no-save
+          npm clean-install typed-rest-client@1.8.11 --no-save
        working-directory: sources

      - name: Update checksums file
@@ -37,7 +39,7 @@ jobs:

      # If there are no changes, this action will not create a pull request
      - name: Create or update pull request
-        uses: peter-evans/create-pull-request@v7
+        uses: peter-evans/create-pull-request@5e914681df9dc83aa4e4905692ca88beb2f9e91f # v7.0.5
        with:
          branch: bot/wrapper-checksums-update
          commit-message: Update known wrapper checksums
--- a/CONTRIBUTING.md
+++ b/CONTRIBUTING.md
@@ -3,8 +3,9 @@
 The `build` script in the project root provides a convenient way to perform many local build tasks:
 1. `./build` will lint and compile typescript sources
 2. `./build all` will lint and compile typescript and run unit tests
-3. `./build init-scripts` will run the init-script integration tests
-4. `./build act <act-commands>` will run `act` after building local changes (see below)
+3. `./build install` will install npm packages followed by lint and compile
+4. `./build init-scripts` will run the init-script integration tests
+5. `./build act <act-commands>` will run `act` after building local changes (see below)

 ## Using `act` to run integ-test workflows locally

--- a/README.md
+++ b/README.md
@@ -1,5 +1,7 @@
 # GitHub Actions for Gradle builds

+[![OpenSSF Scorecard](https://api.scorecard.dev/projects/github.com/gradle/actions/badge)](https://scorecard.dev/viewer/?uri=github.com/gradle/actions)
+
 This repository contains a set of GitHub Actions that are useful for building Gradle projects on GitHub.

 ## The `setup-gradle` action
--- a/17
+++ b/17
@@ -4,12 +4,10 @@ cd sources

 case "$1" in
    all)
-        npm clean-install
        npm run all
        ;;
    act)
        # Build and copy outputs to the dist directory
-        npm install
        npm run build
        cd ..
        cp -r sources/dist .
@@ -18,18 +16,21 @@ case "$1" in
        # Revert the changes to the dist directory
        git checkout -- dist
        ;;
-    init-scripts)
-        cd test/init-scripts
-        ./gradlew check
-        ;;
    dist)
-        npm install
+        npm clean-install
        npm run build
        cd ..
        cp -r sources/dist .
        ;;
+    init-scripts)
+        cd test/init-scripts
+        ./gradlew check
+        ;;
+    install)
+        npm clean-install
+        npm run build
+        ;;
    *)
-        npm install
        npm run build
        ;;
 esac
--- a/dist/dependency-submission/main/index.js
+++ b/dist/dependency-submission/main/index.js
--- a/dist/dependency-submission/main/index.js.map
+++ b/dist/dependency-submission/main/index.js.map
--- a/dist/dependency-submission/post/index.js
+++ b/dist/dependency-submission/post/index.js
--- a/dist/dependency-submission/post/index.js.map
+++ b/dist/dependency-submission/post/index.js.map
--- a/dist/setup-gradle/main/index.js
+++ b/dist/setup-gradle/main/index.js
--- a/dist/setup-gradle/main/index.js.map
+++ b/dist/setup-gradle/main/index.js.map
--- a/dist/setup-gradle/post/index.js
+++ b/dist/setup-gradle/post/index.js
--- a/dist/setup-gradle/post/index.js.map
+++ b/dist/setup-gradle/post/index.js.map
--- a/dist/wrapper-validation/main/index.js
+++ b/dist/wrapper-validation/main/index.js
--- a/dist/wrapper-validation/main/index.js.map
+++ b/dist/wrapper-validation/main/index.js.map
--- a/docs/deprecation-upgrade-guide.md
+++ b/docs/deprecation-upgrade-guide.md
@@ -101,7 +101,7 @@ The exact syntax depends on whether or not your project is configured with the [
 - name: Setup Gradle for a non-wrapper project
  uses: gradle/actions/setup-gradle@v4
  with:
-    gradle-version: "8.10"
+    gradle-version: "8.11"

 - name: Assemble the project
  run: gradle assemble
--- a/docs/setup-gradle.md
+++ b/docs/setup-gradle.md
@@ -196,6 +196,9 @@ When Gradle is executed with the [configuration-cache](https://docs.gradle.org/c
 in the project directory, at `<project-dir>/.gradle/configuration-cache`. Due to the way the configuration-cache works, [this file may contain stored credentials and other
 secrets](https://docs.gradle.org/release-nightly/userguide/configuration_cache.html#config_cache:secrets), and this data needs to be encrypted to be safely stored in the GitHub Actions cache.

+> [!IMPORTANT]
+> To avoid potentially leaking secrets in the configuration-cache entry, the action will only save or restore configuration-cache data if the `cache-encryption-key` parameter is set.
+
 To benefit from configuration caching in your GitHub Actions workflow, you must:
 - Execute your build with Gradle 8.6 or newer. This can be achieved directly or via the Gradle Wrapper.
 - Enable the configuration cache for your build.
@@ -220,7 +223,10 @@ jobs:
    - run: gradle build --configuration-cache
 ```

-> [!IMPORTANT]
+Even with everything correctly configured, you may find that the configuration-cache entry is not reused in your workflow.
+This is often due to a known issue: [Included builds containing build logic prevent configuration-cache reuse](https://github.com/gradle/actions/issues/21). Refer to the issue for more details.
+
+> [!NOTE]
 > The configuration cache cannot be saved or restored in workflows triggered by a pull requests from a repository fork.
 > This is because [GitHub secrets are not passed to workflows triggered by PRs from forks](https://docs.github.com/en/actions/security-guides/using-secrets-in-github-actions#using-secrets-in-a-workflow).
 > This prevents a malicious PR from reading the configuration-cache data, which may encode secrets read by Gradle.
@@ -502,7 +508,7 @@ jobs:
      if: always()
      with:
        name: build-reports
-        path: build/reports/
+        path: **/build/reports/
 ```

 ### Use of custom init-scripts in Gradle User Home
@@ -841,7 +847,7 @@ Here's a minimal example:
      run: ./gradlew build
 ```

-This configuration will automatically apply `v3.18.1` of the [Develocity Gradle plugin](https://docs.gradle.com/develocity/gradle-plugin/), and publish build scans to https://develocity.your-server.com.
+This configuration will automatically apply `v3.18.2` of the [Develocity Gradle plugin](https://docs.gradle.com/develocity/gradle-plugin/), and publish build scans to https://develocity.your-server.com.

 This example assumes that the `develocity.your-server.com` server allows anonymous publishing of build scans.
 In the likely scenario that your Develocity server requires authentication, you will also need to pass a valid [Develocity access key](https://docs.gradle.com/develocity/gradle-plugin/#via_environment_variable) taken from a secret:
--- a/sources/.tool-versions
+++ b/sources/.tool-versions
@@ -1,3 +1,3 @@
 # Configuration file for asdf version manager
 nodejs 20.10.0
-gradle 8.10
+gradle 8.11
--- a/sources/package-lock.json
+++ b/sources/package-lock.json
@@ -10,41 +10,41 @@
      "hasInstallScript": true,
      "license": "MIT",
      "dependencies": {
-        "@actions/artifact": "2.1.9",
-        "@actions/cache": "3.2.4",
-        "@actions/core": "1.10.1",
+        "@actions/artifact": "2.1.11",
+        "@actions/cache": "3.3.0",
+        "@actions/core": "1.11.1",
        "@actions/exec": "1.1.1",
        "@actions/github": "6.0.0",
        "@actions/glob": "0.5.0",
        "@actions/http-client": "2.2.3",
        "@actions/tool-cache": "2.0.1",
        "@octokit/rest": "21.0.2",
-        "@octokit/webhooks-types": "7.5.1",
+        "@octokit/webhooks-types": "7.6.1",
        "cheerio": "^1.0.0",
        "semver": "7.6.3",
        "string-argv": "0.3.2",
-        "typed-rest-client": "2.0.2",
+        "typed-rest-client": "2.1.0",
        "unhomoglyph": "1.0.6",
-        "which": "4.0.0"
+        "which": "5.0.0"
      },
      "devDependencies": {
-        "@types/jest": "29.5.13",
-        "@types/node": "20.16.5",
+        "@types/jest": "29.5.14",
+        "@types/node": "20.17.6",
        "@types/unzipper": "0.10.10",
        "@types/which": "3.0.4",
        "@typescript-eslint/parser": "7.18.0",
-        "@vercel/ncc": "0.38.1",
-        "eslint": "8.57.0",
+        "@vercel/ncc": "0.38.3",
+        "eslint": "8.57.1",
        "eslint-plugin-github": "5.0.2",
-        "eslint-plugin-jest": "28.8.3",
+        "eslint-plugin-jest": "28.9.0",
        "jest": "29.7.0",
        "js-yaml": "4.1.0",
-        "nock": "13.5.5",
+        "nock": "13.5.6",
        "npm-run-all": "4.1.5",
        "patch-package": "8.0.0",
        "prettier": "3.3.3",
        "ts-jest": "29.2.5",
-        "typescript": "5.6.2"
+        "typescript": "5.6.3"
      }
    },
    "node_modules/@aashutoshrathi/word-wrap": {
@@ -57,9 +57,9 @@
      }
    },
    "node_modules/@actions/artifact": {
-      "version": "2.1.9",
-      "resolved": "https://registry.npmjs.org/@actions/artifact/-/artifact-2.1.9.tgz",
-      "integrity": "sha512-f9JXC9JrwramDRJHZiIOKJo3PGw/V3riYegLj5kHi8YEJ2k72TNUd1zDW1BG50ILnzJ0cp1faDVJ2pSdolRQfg==",
+      "version": "2.1.11",
+      "resolved": "https://registry.npmjs.org/@actions/artifact/-/artifact-2.1.11.tgz",
+      "integrity": "sha512-V/N/3yM3oLxozq2dpdGqbd/39UbDOR54bF25vYsvn3QZnyZERSzPjTAAwpGzdcwESye9G7vnuhPiKQACEuBQpg==",
      "dependencies": {
        "@actions/core": "^1.10.0",
        "@actions/github": "^5.1.1",
@@ -71,7 +71,6 @@
        "@octokit/request-error": "^5.0.0",
        "@protobuf-ts/plugin": "^2.2.3-alpha.1",
        "archiver": "^7.0.1",
-        "crypto": "^1.0.1",
        "jwt-decode": "^3.1.2",
        "twirp-ts": "^2.5.0",
        "unzip-stream": "^0.3.1"
@@ -200,11 +199,11 @@
      }
    },
    "node_modules/@actions/cache": {
-      "version": "3.2.4",
-      "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-3.2.4.tgz",
-      "integrity": "sha512-RuHnwfcDagtX+37s0ZWy7clbOfnZ7AlDJQ7k/9rzt2W4Gnwde3fa/qjSjVuz4vLcLIpc7fUob27CMrqiWZytYA==",
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-3.3.0.tgz",
+      "integrity": "sha512-+eCsMTIZUEm+QA9GqjollOhCdvRrZ1JV8d9Rp34zVNizBkYITO8dhKczP5Xps1dFzc5n59p7vYVtZrGt18bb5Q==",
      "dependencies": {
-        "@actions/core": "^1.10.0",
+        "@actions/core": "^1.11.1",
        "@actions/exec": "^1.0.1",
        "@actions/glob": "^0.1.0",
        "@actions/http-client": "^2.1.1",
@@ -212,8 +211,7 @@
        "@azure/abort-controller": "^1.1.0",
        "@azure/ms-rest-js": "^2.6.0",
        "@azure/storage-blob": "^12.13.0",
-        "semver": "^6.3.1",
-        "uuid": "^3.3.3"
+        "semver": "^6.3.1"
      }
    },
    "node_modules/@actions/cache/node_modules/@actions/glob": {
@@ -234,20 +232,12 @@
      }
    },
    "node_modules/@actions/core": {
-      "version": "1.10.1",
-      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.10.1.tgz",
-      "integrity": "sha512-3lBR9EDAY+iYIpTnTIXmWcNbX3T2kCkAEQGIQx4NVQ0575nk2k3GRZDTPQG+vVtS2izSLmINlxXf0uLtnrTP+g==",
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.11.1.tgz",
+      "integrity": "sha512-hXJCSrkwfA46Vd9Z3q4cpEpHB1rL5NG04+/rbqW9d3+CSvtB1tYe8UTpAlixa1vj0m/ULglfEK2UKxMGxCxv5A==",
      "dependencies": {
-        "@actions/http-client": "^2.0.1",
-        "uuid": "^8.3.2"
-      }
-    },
-    "node_modules/@actions/core/node_modules/uuid": {
-      "version": "8.3.2",
-      "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
-      "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg==",
-      "bin": {
-        "uuid": "dist/bin/uuid"
+        "@actions/exec": "^1.1.1",
+        "@actions/http-client": "^2.0.1"
      }
    },
    "node_modules/@actions/exec": {
@@ -1231,9 +1221,9 @@
      }
    },
    "node_modules/@eslint/js": {
-      "version": "8.57.0",
-      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-8.57.0.tgz",
-      "integrity": "sha512-Ys+3g2TaW7gADOJzPt83SJtCDhMjndcDMFVQ/Tj9iA1BfJzFKD9mAUXT3OenpuPHbI6P/myECxRJrofUsDx/5g==",
+      "version": "8.57.1",
+      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-8.57.1.tgz",
+      "integrity": "sha512-d9zaMRSTIKDLhctzH12MtXvJKSSUhaHcjV+2Z+GK+EEY7XKpP5yR4x+N3TAcHTcu963nIr+TMcCb4DBCYX1z6Q==",
      "dev": true,
      "engines": {
        "node": "^12.22.0 || ^14.17.0 || >=16.0.0"
@@ -1254,12 +1244,13 @@
      "dev": true
    },
    "node_modules/@humanwhocodes/config-array": {
-      "version": "0.11.14",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/config-array/-/config-array-0.11.14.tgz",
-      "integrity": "sha512-3T8LkOmg45BV5FICb15QQMsyUSWrQ8AygVfC7ZG32zOalnqrilm018ZVCw0eapXux8FtA33q8PSRSstjee3jSg==",
+      "version": "0.13.0",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/config-array/-/config-array-0.13.0.tgz",
+      "integrity": "sha512-DZLEEqFWQFiyK6h5YIeynKx7JlvCYWL0cImfSRXZ9l4Sg2efkFGTuFf6vzXjK1cq6IYkU+Eg/JizXw+TD2vRNw==",
+      "deprecated": "Use @eslint/config-array instead",
      "dev": true,
      "dependencies": {
-        "@humanwhocodes/object-schema": "^2.0.2",
+        "@humanwhocodes/object-schema": "^2.0.3",
        "debug": "^4.3.1",
        "minimatch": "^3.0.5"
      },
@@ -1281,9 +1272,10 @@
      }
    },
    "node_modules/@humanwhocodes/object-schema": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/object-schema/-/object-schema-2.0.2.tgz",
-      "integrity": "sha512-6EwiSjwWYP7pTckG6I5eyFANjPhmPjUX9JRLUSfNPC7FX7zK9gyZAfUEaECL6ALTpGX5AjnBq3C9XmVWPitNpw==",
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/object-schema/-/object-schema-2.0.3.tgz",
+      "integrity": "sha512-93zYdMES/c1D69yZiKDBj0V24vqNzB/koF26KPaagAfd3P/4gUlh3Dys5ogAK+Exi9QyzlD8x/08Zt7wIKcDcA==",
+      "deprecated": "Use @eslint/object-schema instead",
      "dev": true
    },
    "node_modules/@isaacs/cliui": {
@@ -2154,9 +2146,9 @@
      }
    },
    "node_modules/@octokit/webhooks-types": {
-      "version": "7.5.1",
-      "resolved": "https://registry.npmjs.org/@octokit/webhooks-types/-/webhooks-types-7.5.1.tgz",
-      "integrity": "sha512-1dozxWEP8lKGbtEu7HkRbK1F/nIPuJXNfT0gd96y6d3LcHZTtRtlf8xz3nicSJfesADxJyDh+mWBOsdLkqgzYw=="
+      "version": "7.6.1",
+      "resolved": "https://registry.npmjs.org/@octokit/webhooks-types/-/webhooks-types-7.6.1.tgz",
+      "integrity": "sha512-S8u2cJzklBC0FgTwWVLaM8tMrDuDMVE4xiTK4EYXM9GntyvrdbSoxqDQa+Fh57CCNApyIpyeqPhhFEmHPfrXgw=="
    },
    "node_modules/@opentelemetry/api": {
      "version": "1.4.1",
@@ -2356,9 +2348,9 @@
      }
    },
    "node_modules/@types/jest": {
-      "version": "29.5.13",
-      "resolved": "https://registry.npmjs.org/@types/jest/-/jest-29.5.13.tgz",
-      "integrity": "sha512-wd+MVEZCHt23V0/L642O5APvspWply/rGY5BcW4SUETo2UzPU3Z26qr8jC2qxpimI2jjx9h7+2cj2FwIr01bXg==",
+      "version": "29.5.14",
+      "resolved": "https://registry.npmjs.org/@types/jest/-/jest-29.5.14.tgz",
+      "integrity": "sha512-ZN+4sdnLUbo8EVvVc2ao0GFW6oVrQRPn4K2lglySj7APvSrgzxHiNNK99us4WDMi57xxA2yggblIAMNhXOotLQ==",
      "dev": true,
      "dependencies": {
        "expect": "^29.0.0",
@@ -2380,9 +2372,9 @@
      "dev": true
    },
    "node_modules/@types/node": {
-      "version": "20.16.5",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-20.16.5.tgz",
-      "integrity": "sha512-VwYCweNo3ERajwy0IUlqqcyZ8/A7Zwa9ZP3MnENWcB11AejO+tLy3pu850goUW2FC/IJMdZUfKpX/yxL1gymCA==",
+      "version": "20.17.6",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-20.17.6.tgz",
+      "integrity": "sha512-VEI7OdvK2wP7XHnsuXbAJnEpEkF6NjSN45QJlL4VGqZSXsnicpesdTWsg9RISeSdYd3yeRj/y3k5KGjUXYnFwQ==",
      "dependencies": {
        "undici-types": "~6.19.2"
      }
@@ -3058,9 +3050,9 @@
      "dev": true
    },
    "node_modules/@vercel/ncc": {
-      "version": "0.38.1",
-      "resolved": "https://registry.npmjs.org/@vercel/ncc/-/ncc-0.38.1.tgz",
-      "integrity": "sha512-IBBb+iI2NLu4VQn3Vwldyi2QwaXt5+hTyh58ggAMoCGE6DJmPvwL3KPBWcJl1m9LYPChBLE980Jw+CS4Wokqxw==",
+      "version": "0.38.3",
+      "resolved": "https://registry.npmjs.org/@vercel/ncc/-/ncc-0.38.3.tgz",
+      "integrity": "sha512-rnK6hJBS6mwc+Bkab+PGPs9OiS0i/3kdTO+CkI8V0/VrW3vmz7O2Pxjw/owOlmo6PKEIxRSeZKv/kuL9itnpYA==",
      "dev": true,
      "bin": {
        "ncc": "dist/ncc/cli.js"
@@ -4026,12 +4018,6 @@
        "node": ">= 8"
      }
    },
-    "node_modules/crypto": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/crypto/-/crypto-1.0.1.tgz",
-      "integrity": "sha512-VxBKmeNcqQdiUQUW2Tzq0t377b54N2bMtXO/qiLa+6eRRmmC4qT3D4OnTGoT/U6O9aklQ/jTwbOtRMTTY8G0Ig==",
-      "deprecated": "This package is no longer supported. It's now a built-in Node module. If you've depended on crypto, you should switch to the one that's built-in."
-    },
    "node_modules/css-select": {
      "version": "5.1.0",
      "resolved": "https://registry.npmjs.org/css-select/-/css-select-5.1.0.tgz",
@@ -4536,16 +4522,16 @@
      }
    },
    "node_modules/eslint": {
-      "version": "8.57.0",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.57.0.tgz",
-      "integrity": "sha512-dZ6+mexnaTIbSBZWgou51U6OmzIhYM2VcNdtiTtI7qPNZm35Akpr0f6vtw3w1Kmn5PYo+tZVfh13WrhpS6oLqQ==",
+      "version": "8.57.1",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.57.1.tgz",
+      "integrity": "sha512-ypowyDxpVSYpkXr9WPv2PAZCtNip1Mv5KTW0SCurXv/9iOpcrH9PaqUElksqEB6pChqHGDRCFTyrZlGhnLNGiA==",
      "dev": true,
      "dependencies": {
        "@eslint-community/eslint-utils": "^4.2.0",
        "@eslint-community/regexpp": "^4.6.1",
        "@eslint/eslintrc": "^2.1.4",
-        "@eslint/js": "8.57.0",
-        "@humanwhocodes/config-array": "^0.11.14",
+        "@eslint/js": "8.57.1",
+        "@humanwhocodes/config-array": "^0.13.0",
        "@humanwhocodes/module-importer": "^1.0.1",
        "@nodelib/fs.walk": "^1.2.8",
        "@ungap/structured-clone": "^1.2.0",
@@ -4888,9 +4874,9 @@
      }
    },
    "node_modules/eslint-plugin-jest": {
-      "version": "28.8.3",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-jest/-/eslint-plugin-jest-28.8.3.tgz",
-      "integrity": "sha512-HIQ3t9hASLKm2IhIOqnu+ifw7uLZkIlR7RYNv7fMcEi/p0CIiJmfriStQS2LDkgtY4nyLbIZAD+JL347Yc2ETQ==",
+      "version": "28.9.0",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-jest/-/eslint-plugin-jest-28.9.0.tgz",
+      "integrity": "sha512-rLu1s1Wf96TgUUxSw6loVIkNtUjq1Re7A9QdCCHSohnvXEBAjuL420h0T/fMmkQlNsQP2GhQzEUpYHPfxBkvYQ==",
      "dev": true,
      "dependencies": {
        "@typescript-eslint/utils": "^6.0.0 || ^7.0.0 || ^8.0.0"
@@ -7295,12 +7281,12 @@
      }
    },
    "node_modules/micromatch": {
-      "version": "4.0.5",
-      "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.5.tgz",
-      "integrity": "sha512-DMy+ERcEW2q8Z2Po+WNXuw3c5YaUSFjAO5GsJqfEl7UjvtIuFKO6ZrKvcItdy98dwFI2N1tg3zNIdKaQT+aNdA==",
+      "version": "4.0.8",
+      "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.8.tgz",
+      "integrity": "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==",
      "dev": true,
      "dependencies": {
-        "braces": "^3.0.2",
+        "braces": "^3.0.3",
        "picomatch": "^2.3.1"
      },
      "engines": {
@@ -7406,9 +7392,9 @@
      }
    },
    "node_modules/nock": {
-      "version": "13.5.5",
-      "resolved": "https://registry.npmjs.org/nock/-/nock-13.5.5.tgz",
-      "integrity": "sha512-XKYnqUrCwXC8DGG1xX4YH5yNIrlh9c065uaMZZHUoeUUINTOyt+x/G+ezYk0Ft6ExSREVIs+qBJDK503viTfFA==",
+      "version": "13.5.6",
+      "resolved": "https://registry.npmjs.org/nock/-/nock-13.5.6.tgz",
+      "integrity": "sha512-o2zOYiCpzRqSzPj0Zt/dQ/DqZeYoaQ7TUonc/xUPjCGl9WeHpNbxgVvOquXYAaJzI0M9BXV3HTzG0p8IUAbBTQ==",
      "dev": true,
      "dependencies": {
        "debug": "^4.1.0",
@@ -9401,9 +9387,9 @@
      }
    },
    "node_modules/typed-rest-client": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/typed-rest-client/-/typed-rest-client-2.0.2.tgz",
-      "integrity": "sha512-rmAQM2gZw/PQpK5+5aSs+I6ZBv4PFC2BT1o+0ADS1SgSejA+14EmbI2Lt8uXwkX7oeOMkwFmg0pHKwe8D9IT5A==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/typed-rest-client/-/typed-rest-client-2.1.0.tgz",
+      "integrity": "sha512-Nel9aPbgSzRxfs1+4GoSB4wexCF+4Axlk7OSGVQCMa+4fWcyxIsN/YNmkp0xTT2iQzMD98h8yFLav/cNaULmRA==",
      "dependencies": {
        "des.js": "^1.1.0",
        "js-md4": "^0.3.2",
@@ -9416,9 +9402,9 @@
      }
    },
    "node_modules/typescript": {
-      "version": "5.6.2",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.6.2.tgz",
-      "integrity": "sha512-NW8ByodCSNCwZeghjN3o+JX5OFH0Ojg6sadjEKY4huZ52TqbJTJnDo5+Tw98lSy63NZvi4n+ez5m2u5d4PkZyw==",
+      "version": "5.6.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.6.3.tgz",
+      "integrity": "sha512-hjcS1mhfuyi4WW8IWtjP7brDrG2cuDZukyrYrSauoXGNgx0S7zceP07adYkJycEr56BOUTNPzbInooiN3fn1qw==",
      "dev": true,
      "bin": {
        "tsc": "bin/tsc",
@@ -9614,9 +9600,9 @@
      }
    },
    "node_modules/which": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/which/-/which-4.0.0.tgz",
-      "integrity": "sha512-GlaYyEb07DPxYCKhKzplCWBJtvxZcZMrL+4UkrTSJHHPyZU4mYYTv3qaOe77H7EODLSSopAUFAc6W8U4yqvscg==",
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/which/-/which-5.0.0.tgz",
+      "integrity": "sha512-JEdGzHwwkrbWoGOlIHqQ5gtprKGOenpDHpxE9zVR1bWbOtYRyPPHMe9FaP6x61CmNaTThSkb0DAJte5jD+DmzQ==",
      "dependencies": {
        "isexe": "^3.1.1"
      },
@@ -9624,7 +9610,7 @@
        "node-which": "bin/which.js"
      },
      "engines": {
-        "node": "^16.13.0 || >=18.0.0"
+        "node": "^18.17.0 || >=20.5.0"
      }
    },
    "node_modules/which-boxed-primitive": {
@@ -9842,9 +9828,9 @@
      "dev": true
    },
    "@actions/artifact": {
-      "version": "2.1.9",
-      "resolved": "https://registry.npmjs.org/@actions/artifact/-/artifact-2.1.9.tgz",
-      "integrity": "sha512-f9JXC9JrwramDRJHZiIOKJo3PGw/V3riYegLj5kHi8YEJ2k72TNUd1zDW1BG50ILnzJ0cp1faDVJ2pSdolRQfg==",
+      "version": "2.1.11",
+      "resolved": "https://registry.npmjs.org/@actions/artifact/-/artifact-2.1.11.tgz",
+      "integrity": "sha512-V/N/3yM3oLxozq2dpdGqbd/39UbDOR54bF25vYsvn3QZnyZERSzPjTAAwpGzdcwESye9G7vnuhPiKQACEuBQpg==",
      "requires": {
        "@actions/core": "^1.10.0",
        "@actions/github": "^5.1.1",
@@ -9856,7 +9842,6 @@
        "@octokit/request-error": "^5.0.0",
        "@protobuf-ts/plugin": "^2.2.3-alpha.1",
        "archiver": "^7.0.1",
-        "crypto": "^1.0.1",
        "jwt-decode": "^3.1.2",
        "twirp-ts": "^2.5.0",
        "unzip-stream": "^0.3.1"
@@ -9985,11 +9970,11 @@
      }
    },
    "@actions/cache": {
-      "version": "3.2.4",
-      "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-3.2.4.tgz",
-      "integrity": "sha512-RuHnwfcDagtX+37s0ZWy7clbOfnZ7AlDJQ7k/9rzt2W4Gnwde3fa/qjSjVuz4vLcLIpc7fUob27CMrqiWZytYA==",
+      "version": "3.3.0",
+      "resolved": "https://registry.npmjs.org/@actions/cache/-/cache-3.3.0.tgz",
+      "integrity": "sha512-+eCsMTIZUEm+QA9GqjollOhCdvRrZ1JV8d9Rp34zVNizBkYITO8dhKczP5Xps1dFzc5n59p7vYVtZrGt18bb5Q==",
      "requires": {
-        "@actions/core": "^1.10.0",
+        "@actions/core": "^1.11.1",
        "@actions/exec": "^1.0.1",
        "@actions/glob": "^0.1.0",
        "@actions/http-client": "^2.1.1",
@@ -9997,8 +9982,7 @@
        "@azure/abort-controller": "^1.1.0",
        "@azure/ms-rest-js": "^2.6.0",
        "@azure/storage-blob": "^12.13.0",
-        "semver": "^6.3.1",
-        "uuid": "^3.3.3"
+        "semver": "^6.3.1"
      },
      "dependencies": {
        "@actions/glob": {
@@ -10018,19 +10002,12 @@
      }
    },
    "@actions/core": {
-      "version": "1.10.1",
-      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.10.1.tgz",
-      "integrity": "sha512-3lBR9EDAY+iYIpTnTIXmWcNbX3T2kCkAEQGIQx4NVQ0575nk2k3GRZDTPQG+vVtS2izSLmINlxXf0uLtnrTP+g==",
+      "version": "1.11.1",
+      "resolved": "https://registry.npmjs.org/@actions/core/-/core-1.11.1.tgz",
+      "integrity": "sha512-hXJCSrkwfA46Vd9Z3q4cpEpHB1rL5NG04+/rbqW9d3+CSvtB1tYe8UTpAlixa1vj0m/ULglfEK2UKxMGxCxv5A==",
      "requires": {
-        "@actions/http-client": "^2.0.1",
-        "uuid": "^8.3.2"
-      },
-      "dependencies": {
-        "uuid": {
-          "version": "8.3.2",
-          "resolved": "https://registry.npmjs.org/uuid/-/uuid-8.3.2.tgz",
-          "integrity": "sha512-+NYs2QeMWy+GWFOEm9xnn6HCDp0l7QBD7ml8zLUmJ+93Q5NF0NocErnwkTkXVFNiX3/fpC6afS8Dhb/gz7R7eg=="
-        }
+        "@actions/exec": "^1.1.1",
+        "@actions/http-client": "^2.0.1"
      }
    },
    "@actions/exec": {
@@ -10803,9 +10780,9 @@
      }
    },
    "@eslint/js": {
-      "version": "8.57.0",
-      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-8.57.0.tgz",
-      "integrity": "sha512-Ys+3g2TaW7gADOJzPt83SJtCDhMjndcDMFVQ/Tj9iA1BfJzFKD9mAUXT3OenpuPHbI6P/myECxRJrofUsDx/5g==",
+      "version": "8.57.1",
+      "resolved": "https://registry.npmjs.org/@eslint/js/-/js-8.57.1.tgz",
+      "integrity": "sha512-d9zaMRSTIKDLhctzH12MtXvJKSSUhaHcjV+2Z+GK+EEY7XKpP5yR4x+N3TAcHTcu963nIr+TMcCb4DBCYX1z6Q==",
      "dev": true
    },
    "@fastify/busboy": {
@@ -10820,12 +10797,12 @@
      "dev": true
    },
    "@humanwhocodes/config-array": {
-      "version": "0.11.14",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/config-array/-/config-array-0.11.14.tgz",
-      "integrity": "sha512-3T8LkOmg45BV5FICb15QQMsyUSWrQ8AygVfC7ZG32zOalnqrilm018ZVCw0eapXux8FtA33q8PSRSstjee3jSg==",
+      "version": "0.13.0",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/config-array/-/config-array-0.13.0.tgz",
+      "integrity": "sha512-DZLEEqFWQFiyK6h5YIeynKx7JlvCYWL0cImfSRXZ9l4Sg2efkFGTuFf6vzXjK1cq6IYkU+Eg/JizXw+TD2vRNw==",
      "dev": true,
      "requires": {
-        "@humanwhocodes/object-schema": "^2.0.2",
+        "@humanwhocodes/object-schema": "^2.0.3",
        "debug": "^4.3.1",
        "minimatch": "^3.0.5"
      }
@@ -10837,9 +10814,9 @@
      "dev": true
    },
    "@humanwhocodes/object-schema": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/@humanwhocodes/object-schema/-/object-schema-2.0.2.tgz",
-      "integrity": "sha512-6EwiSjwWYP7pTckG6I5eyFANjPhmPjUX9JRLUSfNPC7FX7zK9gyZAfUEaECL6ALTpGX5AjnBq3C9XmVWPitNpw==",
+      "version": "2.0.3",
+      "resolved": "https://registry.npmjs.org/@humanwhocodes/object-schema/-/object-schema-2.0.3.tgz",
+      "integrity": "sha512-93zYdMES/c1D69yZiKDBj0V24vqNzB/koF26KPaagAfd3P/4gUlh3Dys5ogAK+Exi9QyzlD8x/08Zt7wIKcDcA==",
      "dev": true
    },
    "@isaacs/cliui": {
@@ -11511,9 +11488,9 @@
      }
    },
    "@octokit/webhooks-types": {
-      "version": "7.5.1",
-      "resolved": "https://registry.npmjs.org/@octokit/webhooks-types/-/webhooks-types-7.5.1.tgz",
-      "integrity": "sha512-1dozxWEP8lKGbtEu7HkRbK1F/nIPuJXNfT0gd96y6d3LcHZTtRtlf8xz3nicSJfesADxJyDh+mWBOsdLkqgzYw=="
+      "version": "7.6.1",
+      "resolved": "https://registry.npmjs.org/@octokit/webhooks-types/-/webhooks-types-7.6.1.tgz",
+      "integrity": "sha512-S8u2cJzklBC0FgTwWVLaM8tMrDuDMVE4xiTK4EYXM9GntyvrdbSoxqDQa+Fh57CCNApyIpyeqPhhFEmHPfrXgw=="
    },
    "@opentelemetry/api": {
      "version": "1.4.1",
@@ -11684,9 +11661,9 @@
      }
    },
    "@types/jest": {
-      "version": "29.5.13",
-      "resolved": "https://registry.npmjs.org/@types/jest/-/jest-29.5.13.tgz",
-      "integrity": "sha512-wd+MVEZCHt23V0/L642O5APvspWply/rGY5BcW4SUETo2UzPU3Z26qr8jC2qxpimI2jjx9h7+2cj2FwIr01bXg==",
+      "version": "29.5.14",
+      "resolved": "https://registry.npmjs.org/@types/jest/-/jest-29.5.14.tgz",
+      "integrity": "sha512-ZN+4sdnLUbo8EVvVc2ao0GFW6oVrQRPn4K2lglySj7APvSrgzxHiNNK99us4WDMi57xxA2yggblIAMNhXOotLQ==",
      "dev": true,
      "requires": {
        "expect": "^29.0.0",
@@ -11708,9 +11685,9 @@
      "dev": true
    },
    "@types/node": {
-      "version": "20.16.5",
-      "resolved": "https://registry.npmjs.org/@types/node/-/node-20.16.5.tgz",
-      "integrity": "sha512-VwYCweNo3ERajwy0IUlqqcyZ8/A7Zwa9ZP3MnENWcB11AejO+tLy3pu850goUW2FC/IJMdZUfKpX/yxL1gymCA==",
+      "version": "20.17.6",
+      "resolved": "https://registry.npmjs.org/@types/node/-/node-20.17.6.tgz",
+      "integrity": "sha512-VEI7OdvK2wP7XHnsuXbAJnEpEkF6NjSN45QJlL4VGqZSXsnicpesdTWsg9RISeSdYd3yeRj/y3k5KGjUXYnFwQ==",
      "requires": {
        "undici-types": "~6.19.2"
      }
@@ -12161,9 +12138,9 @@
      "dev": true
    },
    "@vercel/ncc": {
-      "version": "0.38.1",
-      "resolved": "https://registry.npmjs.org/@vercel/ncc/-/ncc-0.38.1.tgz",
-      "integrity": "sha512-IBBb+iI2NLu4VQn3Vwldyi2QwaXt5+hTyh58ggAMoCGE6DJmPvwL3KPBWcJl1m9LYPChBLE980Jw+CS4Wokqxw==",
+      "version": "0.38.3",
+      "resolved": "https://registry.npmjs.org/@vercel/ncc/-/ncc-0.38.3.tgz",
+      "integrity": "sha512-rnK6hJBS6mwc+Bkab+PGPs9OiS0i/3kdTO+CkI8V0/VrW3vmz7O2Pxjw/owOlmo6PKEIxRSeZKv/kuL9itnpYA==",
      "dev": true
    },
    "@yarnpkg/lockfile": {
@@ -12857,11 +12834,6 @@
        }
      }
    },
-    "crypto": {
-      "version": "1.0.1",
-      "resolved": "https://registry.npmjs.org/crypto/-/crypto-1.0.1.tgz",
-      "integrity": "sha512-VxBKmeNcqQdiUQUW2Tzq0t377b54N2bMtXO/qiLa+6eRRmmC4qT3D4OnTGoT/U6O9aklQ/jTwbOtRMTTY8G0Ig=="
-    },
    "css-select": {
      "version": "5.1.0",
      "resolved": "https://registry.npmjs.org/css-select/-/css-select-5.1.0.tgz",
@@ -13231,16 +13203,16 @@
      "dev": true
    },
    "eslint": {
-      "version": "8.57.0",
-      "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.57.0.tgz",
-      "integrity": "sha512-dZ6+mexnaTIbSBZWgou51U6OmzIhYM2VcNdtiTtI7qPNZm35Akpr0f6vtw3w1Kmn5PYo+tZVfh13WrhpS6oLqQ==",
+      "version": "8.57.1",
+      "resolved": "https://registry.npmjs.org/eslint/-/eslint-8.57.1.tgz",
+      "integrity": "sha512-ypowyDxpVSYpkXr9WPv2PAZCtNip1Mv5KTW0SCurXv/9iOpcrH9PaqUElksqEB6pChqHGDRCFTyrZlGhnLNGiA==",
      "dev": true,
      "requires": {
        "@eslint-community/eslint-utils": "^4.2.0",
        "@eslint-community/regexpp": "^4.6.1",
        "@eslint/eslintrc": "^2.1.4",
-        "@eslint/js": "8.57.0",
-        "@humanwhocodes/config-array": "^0.11.14",
+        "@eslint/js": "8.57.1",
+        "@humanwhocodes/config-array": "^0.13.0",
        "@humanwhocodes/module-importer": "^1.0.1",
        "@nodelib/fs.walk": "^1.2.8",
        "@ungap/structured-clone": "^1.2.0",
@@ -13490,9 +13462,9 @@
      }
    },
    "eslint-plugin-jest": {
-      "version": "28.8.3",
-      "resolved": "https://registry.npmjs.org/eslint-plugin-jest/-/eslint-plugin-jest-28.8.3.tgz",
-      "integrity": "sha512-HIQ3t9hASLKm2IhIOqnu+ifw7uLZkIlR7RYNv7fMcEi/p0CIiJmfriStQS2LDkgtY4nyLbIZAD+JL347Yc2ETQ==",
+      "version": "28.9.0",
+      "resolved": "https://registry.npmjs.org/eslint-plugin-jest/-/eslint-plugin-jest-28.9.0.tgz",
+      "integrity": "sha512-rLu1s1Wf96TgUUxSw6loVIkNtUjq1Re7A9QdCCHSohnvXEBAjuL420h0T/fMmkQlNsQP2GhQzEUpYHPfxBkvYQ==",
      "dev": true,
      "requires": {
        "@typescript-eslint/utils": "^6.0.0 || ^7.0.0 || ^8.0.0"
@@ -15254,12 +15226,12 @@
      "dev": true
    },
    "micromatch": {
-      "version": "4.0.5",
-      "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.5.tgz",
-      "integrity": "sha512-DMy+ERcEW2q8Z2Po+WNXuw3c5YaUSFjAO5GsJqfEl7UjvtIuFKO6ZrKvcItdy98dwFI2N1tg3zNIdKaQT+aNdA==",
+      "version": "4.0.8",
+      "resolved": "https://registry.npmjs.org/micromatch/-/micromatch-4.0.8.tgz",
+      "integrity": "sha512-PXwfBhYu0hBCPw8Dn0E+WDYb7af3dSLVWKi3HGv84IdF4TyFoC0ysxFd0Goxw7nSv4T/PzEJQxsYsEiFCKo2BA==",
      "dev": true,
      "requires": {
-        "braces": "^3.0.2",
+        "braces": "^3.0.3",
        "picomatch": "^2.3.1"
      }
    },
@@ -15341,9 +15313,9 @@
      }
    },
    "nock": {
-      "version": "13.5.5",
-      "resolved": "https://registry.npmjs.org/nock/-/nock-13.5.5.tgz",
-      "integrity": "sha512-XKYnqUrCwXC8DGG1xX4YH5yNIrlh9c065uaMZZHUoeUUINTOyt+x/G+ezYk0Ft6ExSREVIs+qBJDK503viTfFA==",
+      "version": "13.5.6",
+      "resolved": "https://registry.npmjs.org/nock/-/nock-13.5.6.tgz",
+      "integrity": "sha512-o2zOYiCpzRqSzPj0Zt/dQ/DqZeYoaQ7TUonc/xUPjCGl9WeHpNbxgVvOquXYAaJzI0M9BXV3HTzG0p8IUAbBTQ==",
      "dev": true,
      "requires": {
        "debug": "^4.1.0",
@@ -16766,9 +16738,9 @@
      }
    },
    "typed-rest-client": {
-      "version": "2.0.2",
-      "resolved": "https://registry.npmjs.org/typed-rest-client/-/typed-rest-client-2.0.2.tgz",
-      "integrity": "sha512-rmAQM2gZw/PQpK5+5aSs+I6ZBv4PFC2BT1o+0ADS1SgSejA+14EmbI2Lt8uXwkX7oeOMkwFmg0pHKwe8D9IT5A==",
+      "version": "2.1.0",
+      "resolved": "https://registry.npmjs.org/typed-rest-client/-/typed-rest-client-2.1.0.tgz",
+      "integrity": "sha512-Nel9aPbgSzRxfs1+4GoSB4wexCF+4Axlk7OSGVQCMa+4fWcyxIsN/YNmkp0xTT2iQzMD98h8yFLav/cNaULmRA==",
      "requires": {
        "des.js": "^1.1.0",
        "js-md4": "^0.3.2",
@@ -16778,9 +16750,9 @@
      }
    },
    "typescript": {
-      "version": "5.6.2",
-      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.6.2.tgz",
-      "integrity": "sha512-NW8ByodCSNCwZeghjN3o+JX5OFH0Ojg6sadjEKY4huZ52TqbJTJnDo5+Tw98lSy63NZvi4n+ez5m2u5d4PkZyw==",
+      "version": "5.6.3",
+      "resolved": "https://registry.npmjs.org/typescript/-/typescript-5.6.3.tgz",
+      "integrity": "sha512-hjcS1mhfuyi4WW8IWtjP7brDrG2cuDZukyrYrSauoXGNgx0S7zceP07adYkJycEr56BOUTNPzbInooiN3fn1qw==",
      "dev": true
    },
    "unbox-primitive": {
@@ -16933,9 +16905,9 @@
      }
    },
    "which": {
-      "version": "4.0.0",
-      "resolved": "https://registry.npmjs.org/which/-/which-4.0.0.tgz",
-      "integrity": "sha512-GlaYyEb07DPxYCKhKzplCWBJtvxZcZMrL+4UkrTSJHHPyZU4mYYTv3qaOe77H7EODLSSopAUFAc6W8U4yqvscg==",
+      "version": "5.0.0",
+      "resolved": "https://registry.npmjs.org/which/-/which-5.0.0.tgz",
+      "integrity": "sha512-JEdGzHwwkrbWoGOlIHqQ5gtprKGOenpDHpxE9zVR1bWbOtYRyPPHMe9FaP6x61CmNaTThSkb0DAJte5jD+DmzQ==",
      "requires": {
        "isexe": "^3.1.1"
      },
--- a/sources/package.json
+++ b/sources/package.json
@@ -32,40 +32,40 @@
  ],
  "license": "MIT",
  "dependencies": {
-    "@actions/artifact": "2.1.9",
-    "@actions/cache": "3.2.4",
-    "@actions/core": "1.10.1",
+    "@actions/artifact": "2.1.11",
+    "@actions/cache": "3.3.0",
+    "@actions/core": "1.11.1",
    "@actions/exec": "1.1.1",
    "@actions/github": "6.0.0",
    "@actions/glob": "0.5.0",
    "@actions/http-client": "2.2.3",
    "@actions/tool-cache": "2.0.1",
    "@octokit/rest": "21.0.2",
-    "@octokit/webhooks-types": "7.5.1",
+    "@octokit/webhooks-types": "7.6.1",
    "cheerio": "^1.0.0",
    "semver": "7.6.3",
    "string-argv": "0.3.2",
-    "typed-rest-client": "2.0.2",
+    "typed-rest-client": "2.1.0",
    "unhomoglyph": "1.0.6",
-    "which": "4.0.0"
+    "which": "5.0.0"
  },
  "devDependencies": {
-    "@types/jest": "29.5.13",
-    "@types/node": "20.16.5",
+    "@types/jest": "29.5.14",
+    "@types/node": "20.17.6",
    "@types/unzipper": "0.10.10",
    "@types/which": "3.0.4",
    "@typescript-eslint/parser": "7.18.0",
-    "@vercel/ncc": "0.38.1",
-    "eslint": "8.57.0",
+    "@vercel/ncc": "0.38.3",
+    "eslint": "8.57.1",
    "eslint-plugin-github": "5.0.2",
-    "eslint-plugin-jest": "28.8.3",
+    "eslint-plugin-jest": "28.9.0",
    "jest": "29.7.0",
    "js-yaml": "4.1.0",
-    "nock": "13.5.5",
+    "nock": "13.5.6",
    "npm-run-all": "4.1.5",
    "patch-package": "8.0.0",
    "prettier": "3.3.3",
    "ts-jest": "29.2.5",
-    "typescript": "5.6.2"
+    "typescript": "5.6.3"
  }
 }
--- a/sources/patches/@actions+cache+3.3.0.patch
+++ b/sources/patches/@actions+cache+3.3.0.patch
--- a/sources/src/caching/cache-cleaner.ts
+++ b/sources/src/caching/cache-cleaner.ts
@@ -44,19 +44,20 @@ export class CacheCleaner {
                settings.caches {
                    cleanup = Cleanup.ALWAYS
            
-                    releasedWrappers.removeUnusedEntriesOlderThan.set(cleanupTime)
-                    snapshotWrappers.removeUnusedEntriesOlderThan.set(cleanupTime)
-                    downloadedResources.removeUnusedEntriesOlderThan.set(cleanupTime)
-                    createdResources.removeUnusedEntriesOlderThan.set(cleanupTime)
-                    buildCache.removeUnusedEntriesOlderThan.set(cleanupTime)
+                    releasedWrappers.setRemoveUnusedEntriesOlderThan(cleanupTime)
+                    snapshotWrappers.setRemoveUnusedEntriesOlderThan(cleanupTime)
+                    downloadedResources.setRemoveUnusedEntriesOlderThan(cleanupTime)
+                    createdResources.setRemoveUnusedEntriesOlderThan(cleanupTime)
+                    buildCache.setRemoveUnusedEntriesOlderThan(cleanupTime)
                }
            }
            `
        )
        fs.writeFileSync(path.resolve(cleanupProjectDir, 'build.gradle'), 'task("noop") {}')

-        // Gradle >= 8.9 required for cache cleanup
-        const executable = await provisioner.provisionGradleAtLeast('8.9')
+        // Gradle >= 8.11 required for cache cleanup
+        // TODO: This is ineffective: we should be using the newest version of Gradle that ran a build, or a newer version if it's available on PATH.
+        const executable = await provisioner.provisionGradleAtLeast('8.11')

        await core.group('Executing Gradle to clean up caches', async () => {
            core.info(`Cleaning up caches last used before ${cleanTimestamp}`)
@@ -78,11 +79,8 @@ export class CacheCleaner {
            'noop'
        ]

-        const result = await exec.getExecOutput(executable, args, {
-            cwd: cleanupProjectDir,
-            silent: true
+        await exec.exec(executable, args, {
+            cwd: cleanupProjectDir
        })
-
-        core.info(result.stdout)
    }
 }
--- a/sources/src/caching/cache-reporting.ts
+++ b/sources/src/caching/cache-reporting.ts
@@ -110,10 +110,12 @@ export class CacheEntryListener {
    requestedRestoreKeys: string[] | undefined
    restoredKey: string | undefined
    restoredSize: number | undefined
+    restoredTime: number | undefined
    notRestored: string | undefined

    savedKey: string | undefined
    savedSize: number | undefined
+    savedTime: number | undefined
    notSaved: string | undefined

    constructor(entryName: string) {
@@ -130,9 +132,10 @@ export class CacheEntryListener {
        return this
    }

-    markRestored(key: string, size: number | undefined): CacheEntryListener {
+    markRestored(key: string, size: number | undefined, time: number): CacheEntryListener {
        this.restoredKey = key
        this.restoredSize = size
+        this.restoredTime = time
        return this
    }

@@ -141,9 +144,10 @@ export class CacheEntryListener {
        return this
    }

-    markSaved(key: string, size: number | undefined): CacheEntryListener {
+    markSaved(key: string, size: number | undefined, time: number): CacheEntryListener {
        this.savedKey = key
        this.savedSize = size
+        this.savedTime = time
        return this
    }

@@ -182,14 +186,16 @@ ${renderEntryTable(entries)}
 function renderEntryTable(entries: CacheEntryListener[]): string {
    return `
 <table>
-    <tr><td></td><th>Count</th><th>Total Size (Mb)</th></tr>
+    <tr><td></td><th>Count</th><th>Total Size (Mb)</th><th>Total Time (ms)</tr>
    <tr><td>Entries Restored</td>
        <td>${getCount(entries, e => e.restoredSize)}</td>
        <td>${getSize(entries, e => e.restoredSize)}</td>
+        <td>${getTime(entries, e => e.restoredTime)}</td>
    </tr>
    <tr><td>Entries Saved</td>
        <td>${getCount(entries, e => e.savedSize)}</td>
        <td>${getSize(entries, e => e.savedSize)}</td>
+        <td>${getTime(entries, e => e.savedTime)}</td>
    </tr>
 </table>
    `
@@ -202,9 +208,11 @@ function renderEntryDetails(listener: CacheListener): string {
    Requested Key : ${entry.requestedKey ?? ''}
    Restored  Key : ${entry.restoredKey ?? ''}
              Size: ${formatSize(entry.restoredSize)}
+              Time: ${formatTime(entry.restoredTime)}
              ${getRestoredMessage(entry, listener.cacheWriteOnly)}
    Saved     Key : ${entry.savedKey ?? ''}
              Size: ${formatSize(entry.savedSize)}
+              Time: ${formatTime(entry.savedTime)}
              ${getSavedMessage(entry, listener.cacheReadOnly)}
 `
        )
@@ -264,9 +272,23 @@ function getSize(
    return Math.round(bytes / (1024 * 1024))
 }

+function getTime(
+    cacheEntries: CacheEntryListener[],
+    predicate: (value: CacheEntryListener) => number | undefined
+): number {
+    return cacheEntries.map(e => predicate(e) ?? 0).reduce((p, v) => p + v, 0)
+}
+
 function formatSize(bytes: number | undefined): string {
    if (bytes === undefined || bytes === 0) {
        return ''
    }
    return `${Math.round(bytes / (1024 * 1024))} MB (${bytes} B)`
 }
+
+function formatTime(ms: number | undefined): string {
+    if (ms === undefined || ms === 0) {
+        return ''
+    }
+    return `${ms} ms`
+}
--- a/sources/src/caching/cache-utils.ts
+++ b/sources/src/caching/cache-utils.ts
@@ -38,13 +38,16 @@ export async function restoreCache(
 ): Promise<cache.CacheEntry | undefined> {
    listener.markRequested(cacheKey, cacheRestoreKeys)
    try {
+        const startTime = Date.now()
        // Only override the read timeout if the SEGMENT_DOWNLOAD_TIMEOUT_MINS env var has NOT been set
        const cacheRestoreOptions = process.env[SEGMENT_DOWNLOAD_TIMEOUT_VAR]
            ? {}
            : {segmentTimeoutInMs: SEGMENT_DOWNLOAD_TIMEOUT_DEFAULT}
        const restoredEntry = await cache.restoreCache(cachePath, cacheKey, cacheRestoreKeys, cacheRestoreOptions)
        if (restoredEntry !== undefined) {
-            listener.markRestored(restoredEntry.key, restoredEntry.size)
+            const restoreTime = Date.now() - startTime
+            listener.markRestored(restoredEntry.key, restoredEntry.size, restoreTime)
+            core.info(`Restored cache entry with key ${cacheKey} to ${cachePath.join()} in ${restoreTime}ms`)
        }
        return restoredEntry
    } catch (error) {
@@ -56,8 +59,11 @@ export async function restoreCache(

 export async function saveCache(cachePath: string[], cacheKey: string, listener: CacheEntryListener): Promise<void> {
    try {
+        const startTime = Date.now()
        const savedEntry = await cache.saveCache(cachePath, cacheKey)
-        listener.markSaved(savedEntry.key, savedEntry.size)
+        const saveTime = Date.now() - startTime
+        listener.markSaved(savedEntry.key, savedEntry.size, saveTime)
+        core.info(`Saved cache entry with key ${cacheKey} from ${cachePath.join()} in ${saveTime}ms`)
    } catch (error) {
        if (error instanceof cache.ReserveCacheError) {
            listener.markAlreadyExists(cacheKey)
--- a/sources/src/caching/gradle-home-extry-extractor.ts
+++ b/sources/src/caching/gradle-home-extry-extractor.ts
@@ -132,9 +132,8 @@ abstract class AbstractEntryExtractor {
        pattern: string,
        listener: CacheEntryListener
    ): Promise<ExtractedCacheEntry> {
-        const restoredEntry = await restoreCache([pattern], cacheKey, [], listener)
+        const restoredEntry = await restoreCache(pattern.split('\n'), cacheKey, [], listener)
        if (restoredEntry) {
-            core.info(`Restored ${artifactType} with key ${cacheKey} to ${pattern}`)
            return new ExtractedCacheEntry(artifactType, pattern, cacheKey)
        } else {
            core.info(`Did not restore ${artifactType} with key ${cacheKey} to ${pattern}`)
@@ -232,8 +231,7 @@ abstract class AbstractEntryExtractor {
            cacheDebug(`No change to previously restored ${artifactType}. Not saving.`)
            entryListener.markNotSaved('contents unchanged')
        } else {
-            core.info(`Caching ${artifactType} with path '${pattern}' and cache key: ${cacheKey}`)
-            await saveCache([pattern], cacheKey, entryListener)
+            await saveCache(pattern.split('\n'), cacheKey, entryListener)
        }

        for (const file of matchingFiles) {
--- a/sources/src/caching/gradle-user-home-cache.ts
+++ b/sources/src/caching/gradle-user-home-cache.ts
@@ -60,7 +60,8 @@ export class GradleUserHomeCache {
    restoreKeys:[${cacheKey.restoreKeys}]`
        )

-        const cacheResult = await restoreCache(this.getCachePath(), cacheKey.key, cacheKey.restoreKeys, entryListener)
+        const cachePath = this.getCachePath()
+        const cacheResult = await restoreCache(cachePath, cacheKey.key, cacheKey.restoreKeys, entryListener)
        if (!cacheResult) {
            core.info(`${this.cacheDescription} cache not found. Will initialize empty.`)
            return
@@ -68,8 +69,6 @@ export class GradleUserHomeCache {

        core.saveState(RESTORED_CACHE_KEY_KEY, cacheResult.key)

-        core.info(`Restored ${this.cacheDescription} from cache key: ${cacheResult.key}`)
-
        try {
            await this.afterRestore(listener)
        } catch (error) {
@@ -120,10 +119,8 @@ export class GradleUserHomeCache {
            return
        }

-        core.info(`Caching ${this.cacheDescription} with cache key: ${cacheKey}`)
        const cachePath = this.getCachePath()
        await saveCache(cachePath, cacheKey, gradleHomeEntryListener)
-
        return
    }

--- a/sources/src/develocity/build-scan.ts
+++ b/sources/src/develocity/build-scan.ts
@@ -5,13 +5,6 @@ import {setupToken} from './short-lived-token'
 export async function setup(config: BuildScanConfig): Promise<void> {
    maybeExportVariable('DEVELOCITY_INJECTION_INIT_SCRIPT_NAME', 'gradle-actions.inject-develocity.init.gradle')
    maybeExportVariable('DEVELOCITY_AUTO_INJECTION_CUSTOM_VALUE', 'gradle-actions')
-    if (config.getBuildScanPublishEnabled()) {
-        maybeExportVariable('DEVELOCITY_INJECTION_ENABLED', 'true')
-        maybeExportVariable('DEVELOCITY_PLUGIN_VERSION', '3.18.1')
-        maybeExportVariable('DEVELOCITY_CCUD_PLUGIN_VERSION', '2.0')
-        maybeExportVariable('DEVELOCITY_TERMS_OF_USE_URL', config.getBuildScanTermsOfUseUrl())
-        maybeExportVariable('DEVELOCITY_TERMS_OF_USE_AGREE', config.getBuildScanTermsOfUseAgree())
-    }

    maybeExportVariableNotEmpty('DEVELOCITY_INJECTION_ENABLED', config.getDevelocityInjectionEnabled())
    maybeExportVariableNotEmpty('DEVELOCITY_URL', config.getDevelocityUrl())
@@ -19,10 +12,22 @@ export async function setup(config: BuildScanConfig): Promise<void> {
    maybeExportVariableNotEmpty('DEVELOCITY_CAPTURE_FILE_FINGERPRINTS', config.getDevelocityCaptureFileFingerprints())
    maybeExportVariableNotEmpty('DEVELOCITY_ENFORCE_URL', config.getDevelocityEnforceUrl())
    maybeExportVariableNotEmpty('DEVELOCITY_PLUGIN_VERSION', config.getDevelocityPluginVersion())
+    maybeExportVariableNotEmpty('DEVELOCITY_CCUD_PLUGIN_VERSION', config.getDevelocityCcudPluginVersion())
    maybeExportVariableNotEmpty('GRADLE_PLUGIN_REPOSITORY_URL', config.getGradlePluginRepositoryUrl())
    maybeExportVariableNotEmpty('GRADLE_PLUGIN_REPOSITORY_USERNAME', config.getGradlePluginRepositoryUsername())
    maybeExportVariableNotEmpty('GRADLE_PLUGIN_REPOSITORY_PASSWORD', config.getGradlePluginRepositoryPassword())

+    // If build-scan-publish is enabled, ensure the environment variables are set
+    // The DEVELOCITY_PLUGIN_VERSION and DEVELOCITY_CCUD_PLUGIN_VERSION are set to the latest versions
+    // except if they are defined in the configuration
+    if (config.getBuildScanPublishEnabled()) {
+        maybeExportVariable('DEVELOCITY_INJECTION_ENABLED', 'true')
+        maybeExportVariable('DEVELOCITY_PLUGIN_VERSION', '3.18.2')
+        maybeExportVariable('DEVELOCITY_CCUD_PLUGIN_VERSION', '2.0.2')
+        maybeExportVariable('DEVELOCITY_TERMS_OF_USE_URL', config.getBuildScanTermsOfUseUrl())
+        maybeExportVariable('DEVELOCITY_TERMS_OF_USE_AGREE', config.getBuildScanTermsOfUseAgree())
+    }
+
    return setupToken(config.getDevelocityAccessKey(), config.getDevelocityTokenExpiry())
 }

--- a/sources/src/resources/init-scripts/gradle-actions.build-result-capture.init.gradle
+++ b/sources/src/resources/init-scripts/gradle-actions.build-result-capture.init.gradle
@@ -32,15 +32,19 @@ if (isTopLevelBuild) {

        // Use the Develocity plugin to also capture build scan links, when available
        settingsEvaluated { settings ->
-            settings.pluginManager.withPlugin(GE_PLUGIN_ID) {
-                // Only execute if develocity plugin isn't applied.
-                if (!settings.extensions.findByName(DEVELOCITY_EXTENSION)) {
+            def captureBuildScanLink = {
+                // Prefer the 'develocity' extension, if available
+                if (settings.extensions.findByName(DEVELOCITY_EXTENSION)) {
+                    captureUsingBuildScanPublished(settings.extensions[DEVELOCITY_EXTENSION].buildScan, invocationId, resultsWriter)
+                } else {
                    captureUsingBuildScanPublished(settings.extensions[GE_EXTENSION].buildScan, invocationId, resultsWriter)
                }
            }
-
+            settings.pluginManager.withPlugin(GE_PLUGIN_ID, captureBuildScanLink)
            settings.pluginManager.withPlugin(DEVELOCITY_PLUGIN_ID) {
-                captureUsingBuildScanPublished(settings.extensions[DEVELOCITY_EXTENSION].buildScan, invocationId, resultsWriter)
+                // Develocity plugin applies GE plugin: avoid duplicate call
+                if (settings.pluginManager.hasPlugin(GE_PLUGIN_ID)) return
+                captureBuildScanLink()
            }
        }
    } else if (atLeastGradle3) {
@@ -48,15 +52,21 @@ if (isTopLevelBuild) {
            // By default, use 'buildFinished' to capture build results
            captureUsingBuildFinished(gradle, invocationId, resultsWriter)

-            gradle.rootProject.pluginManager.withPlugin(BUILD_SCAN_PLUGIN_ID) {
-                // Only execute if develocity plugin isn't applied.
-                if (!gradle.rootProject.extensions.findByName(DEVELOCITY_EXTENSION)) {
+            def captureBuildScanLink = {
+                // Prefer the 'develocity' extension, if available
+                if (gradle.rootProject.extensions.findByName(DEVELOCITY_EXTENSION)) {
+                    captureUsingBuildScanPublished(gradle.rootProject.extensions[DEVELOCITY_EXTENSION].buildScan, invocationId, resultsWriter)
+                } else {
                    captureUsingBuildScanPublished(gradle.rootProject.extensions[BUILD_SCAN_EXTENSION], invocationId, resultsWriter)
                }
            }

+            gradle.rootProject.pluginManager.withPlugin(BUILD_SCAN_PLUGIN_ID, captureBuildScanLink)
+
            gradle.rootProject.pluginManager.withPlugin(DEVELOCITY_PLUGIN_ID) {
-                captureUsingBuildScanPublished(gradle.rootProject.extensions[DEVELOCITY_EXTENSION].buildScan, invocationId, resultsWriter)
+                // Develocity plugin applies Build Scan plugin: avoid duplicate call
+                if (gradle.rootProject.pluginManager.hasPlugin(BUILD_SCAN_PLUGIN_ID)) return
+                captureBuildScanLink()
            }
        }
    }
--- a/sources/src/wrapper-validation/checksums.ts
+++ b/sources/src/wrapper-validation/checksums.ts
@@ -38,7 +38,7 @@ export const KNOWN_CHECKSUMS = loadKnownChecksums()
 export async function fetchUnknownChecksums(
    allowSnapshots: boolean,
    knownChecksums: WrapperChecksums
-): Promise<Set<string>> {
+): Promise<WrapperChecksums> {
    const all = await httpGetJsonArray('https://services.gradle.org/versions/all')
    const withChecksum = all.filter(
        entry => typeof entry === 'object' && entry != null && entry.hasOwnProperty('wrapperChecksumUrl')
@@ -51,20 +51,21 @@ export async function fetchUnknownChecksums(
        // eslint-disable-next-line @typescript-eslint/no-explicit-any
        (entry: any) => !knownChecksums.versions.has(entry.version)
    )
-    const checksumUrls = notKnown.map(
-        // eslint-disable-next-line @typescript-eslint/no-explicit-any
-        (entry: any) => entry.wrapperChecksumUrl as string
-    )
+
+    // eslint-disable-next-line @typescript-eslint/no-explicit-any
+    const checksumUrls = notKnown.map((entry: any) => [entry.version, entry.wrapperChecksumUrl] as [string, string])
    if (allowSnapshots) {
-        await addDistributionSnapshotChecksums(checksumUrls)
+        await addDistributionSnapshotChecksumUrls(checksumUrls)
    }
-    const checksums = await Promise.all(
-        checksumUrls.map(async (url: string) => {
-            // console.log(`Fetching checksum from ${url}`)
-            return httpGetText(url)
+
+    const wrapperChecksums = new WrapperChecksums()
+    await Promise.all(
+        checksumUrls.map(async ([version, url]) => {
+            const checksum = await httpGetText(url)
+            wrapperChecksums.add(version, checksum)
        })
    )
-    return new Set(checksums)
+    return wrapperChecksums
 }

 async function httpGetJsonArray(url: string): Promise<unknown[]> {
@@ -76,21 +77,20 @@ async function httpGetText(url: string): Promise<string> {
    return await response.readBody()
 }

-// Public for testing
-export async function addDistributionSnapshotChecksums(checksumUrls: string[]): Promise<void> {
-    // Load the index page of the distribution snapshot repository
+async function addDistributionSnapshotChecksumUrls(checksumUrls: [string, string][]): Promise<void> {
+    // Load the index page of the distribution snapshot repository into cheerio
    const indexPage = await httpGetText('https://services.gradle.org/distributions-snapshots/')
-
-    // // Extract all wrapper checksum from the index page. These end in -wrapper.jar.sha256
-    // // Load the HTML into cheerio
    const $ = cheerio.load(indexPage)

    // // Find all links ending with '-wrapper.jar.sha256'
    const wrapperChecksumLinks = $('a[href$="-wrapper.jar.sha256"]')
-
-    // build the absolute URL for each wrapper checksum
    wrapperChecksumLinks.each((index, element) => {
-        const url = $(element).attr('href')
-        checksumUrls.push(`https://services.gradle.org${url}`)
+        const url = $(element).attr('href')!
+
+        // Extract the version from the url
+        const version = url.match(/\/distributions-snapshots\/gradle-(.*?)-wrapper\.jar\.sha256/)?.[1]
+        if (version) {
+            checksumUrls.push([version, `https://services.gradle.org${url}`])
+        }
    })
 }
--- a/sources/src/wrapper-validation/find.ts
+++ b/sources/src/wrapper-validation/find.ts
@@ -18,9 +18,14 @@ async function recursivelyListFiles(baseDir: string): Promise<string[]> {
    const childrenPaths = await Promise.all(
        childrenNames.map(async childName => {
            const childPath = path.resolve(baseDir, childName)
-            return fs.lstatSync(childPath).isDirectory()
-                ? recursivelyListFiles(childPath)
-                : new Promise(resolve => resolve([childPath]))
+            const stat = fs.lstatSync(childPath, {throwIfNoEntry: false})
+            if (stat === undefined) {
+                return []
+            } else if (stat.isDirectory()) {
+                return recursivelyListFiles(childPath)
+            } else {
+                return new Promise(resolve => resolve([childPath]))
+            }
        })
    )
    return Array.prototype.concat(...childrenPaths)
--- a/sources/src/wrapper-validation/validate.ts
+++ b/sources/src/wrapper-validation/validate.ts
@@ -33,7 +33,7 @@ export async function findInvalidWrapperJars(
            const fetchedValidChecksums = await checksums.fetchUnknownChecksums(allowSnapshots, knownValidChecksums)

            for (const wrapperJar of notYetValidatedWrappers) {
-                if (!fetchedValidChecksums.has(wrapperJar.checksum)) {
+                if (!fetchedValidChecksums.checksums.has(wrapperJar.checksum)) {
                    result.invalid.push(wrapperJar)
                } else {
                    result.valid.push(wrapperJar)
--- a/sources/src/wrapper-validation/wrapper-checksums.json
+++ b/sources/src/wrapper-validation/wrapper-checksums.json
@@ -1,4 +1,36 @@
 [
+  {
+    "version": "8.11",
+    "checksum": "2db75c40782f5e8ba1fc278a5574bab070adccb2d21ca5a6e5ed840888448046"
+  },
+  {
+    "version": "8.11-rc-3",
+    "checksum": "2db75c40782f5e8ba1fc278a5574bab070adccb2d21ca5a6e5ed840888448046"
+  },
+  {
+    "version": "8.11-rc-2",
+    "checksum": "2db75c40782f5e8ba1fc278a5574bab070adccb2d21ca5a6e5ed840888448046"
+  },
+  {
+    "version": "8.11-rc-1",
+    "checksum": "2db75c40782f5e8ba1fc278a5574bab070adccb2d21ca5a6e5ed840888448046"
+  },
+  {
+    "version": "8.11-milestone-1",
+    "checksum": "2db75c40782f5e8ba1fc278a5574bab070adccb2d21ca5a6e5ed840888448046"
+  },
+  {
+    "version": "8.10.2",
+    "checksum": "2db75c40782f5e8ba1fc278a5574bab070adccb2d21ca5a6e5ed840888448046"
+  },
+  {
+    "version": "8.10.2-milestone-1",
+    "checksum": "2db75c40782f5e8ba1fc278a5574bab070adccb2d21ca5a6e5ed840888448046"
+  },
+  {
+    "version": "8.10.1",
+    "checksum": "2db75c40782f5e8ba1fc278a5574bab070adccb2d21ca5a6e5ed840888448046"
+  },
  {
    "version": "8.10",
    "checksum": "2db75c40782f5e8ba1fc278a5574bab070adccb2d21ca5a6e5ed840888448046"
--- a/sources/test/init-scripts/build.gradle
+++ b/sources/test/init-scripts/build.gradle
@@ -20,7 +20,7 @@ dependencies {
    testImplementation ('io.ratpack:ratpack-groovy-test:1.9.0') {
        exclude group: 'org.codehaus.groovy', module: 'groovy-all'
    }
-    testImplementation 'com.fasterxml.jackson.dataformat:jackson-dataformat-smile:2.17.2'
+    testImplementation 'com.fasterxml.jackson.dataformat:jackson-dataformat-smile:2.18.1'
 }

 test {
--- a/sources/test/init-scripts/gradle/wrapper/gradle-wrapper.properties
+++ b/sources/test/init-scripts/gradle/wrapper/gradle-wrapper.properties
@@ -1,7 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=5b9c5eb3f9fc2c94abaea57d90bd78747ca117ddbbf96c859d3741181a12bf2a
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.10-bin.zip
+distributionSha256Sum=31c55713e40233a8303827ceb42ca48a47267a0ad4bab9177123121e71524c26
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.10.2-bin.zip
 networkTimeout=10000
 validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
--- a/sources/test/init-scripts/settings.gradle
+++ b/sources/test/init-scripts/settings.gradle
@@ -1,6 +1,6 @@
 plugins {
-    id "com.gradle.develocity" version "3.18.1"
-    id "com.gradle.common-custom-user-data-gradle-plugin" version "2.0.1"
+    id "com.gradle.develocity" version "3.18.2"
+    id "com.gradle.common-custom-user-data-gradle-plugin" version "2.0.2"
 }

 develocity {
--- a/sources/test/init-scripts/src/test/groovy/com/gradle/gradlebuildaction/BaseInitScriptTest.groovy
+++ b/sources/test/init-scripts/src/test/groovy/com/gradle/gradlebuildaction/BaseInitScriptTest.groovy
@@ -16,8 +16,8 @@ import java.nio.file.Files
 import java.util.zip.GZIPOutputStream

 class BaseInitScriptTest extends Specification {
-    static final String DEVELOCITY_PLUGIN_VERSION = '3.18.1'
-    static final String CCUD_PLUGIN_VERSION = '2.0.1'
+    static final String DEVELOCITY_PLUGIN_VERSION = '3.18.2'
+    static final String CCUD_PLUGIN_VERSION = '2.0.2'

    static final TestGradleVersion GRADLE_3_X = new TestGradleVersion(GradleVersion.version('3.5.1'), 7, 9)
    static final TestGradleVersion GRADLE_4_X = new TestGradleVersion(GradleVersion.version('4.10.3'), 7, 10)
@@ -28,7 +28,7 @@ class BaseInitScriptTest extends Specification {
    static final TestGradleVersion GRADLE_7_1 = new TestGradleVersion(GradleVersion.version('7.1.1'), 8, 16)
    static final TestGradleVersion GRADLE_7_X = new TestGradleVersion(GradleVersion.version('7.6.2'), 8, 19)
    static final TestGradleVersion GRADLE_8_0 = new TestGradleVersion(GradleVersion.version('8.0.2'), 8, 19)
-    static final TestGradleVersion GRADLE_8_X = new TestGradleVersion(GradleVersion.version('8.10'), 8, 23)
+    static final TestGradleVersion GRADLE_8_X = new TestGradleVersion(GradleVersion.version('8.11'), 8, 23)

    static final List<TestGradleVersion> ALL_VERSIONS = [
        GRADLE_3_X, // First version where TestKit supports environment variables
--- a/sources/test/init-scripts/src/test/groovy/com/gradle/gradlebuildaction/TestBuildResultRecorder.groovy
+++ b/sources/test/init-scripts/src/test/groovy/com/gradle/gradlebuildaction/TestBuildResultRecorder.groovy
@@ -196,7 +196,7 @@ class TestBuildResultRecorder extends BaseInitScriptTest {
        when:
        settingsFile.text = """
            plugins {
-                id 'com.gradle.develocity' version '3.18.1' apply(false)
+                id 'com.gradle.develocity' version '3.18.2' apply(false)
            }
            gradle.settingsEvaluated {
                apply plugin: 'com.gradle.develocity'
--- a/sources/test/jest/cache-cleanup.test.ts
+++ b/sources/test/jest/cache-cleanup.test.ts
@@ -53,8 +53,8 @@ test('will cleanup unused gradle versions', async () => {
    const transforms3 = path.resolve(gradleUserHome, "caches/transforms-3")
    const metadata100 = path.resolve(gradleUserHome, "caches/modules-2/metadata-2.100")
    const wrapper802 = path.resolve(gradleUserHome, "wrapper/dists/gradle-8.0.2-bin")
-    const gradleCurrent = path.resolve(gradleUserHome, "caches/8.10")
-    const metadataCurrent = path.resolve(gradleUserHome, "caches/modules-2/metadata-2.106")
+    const gradleCurrent = path.resolve(gradleUserHome, "caches/8.11")
+    const metadataCurrent = path.resolve(gradleUserHome, "caches/modules-2/metadata-2.107")

    expect(fs.existsSync(gradle802)).toBe(true)
    expect(fs.existsSync(transforms3)).toBe(true)
--- a/sources/test/jest/cache-reporting.test.ts
+++ b/sources/test/jest/cache-reporting.test.ts
@@ -1,3 +1,4 @@
+import exp from 'constants'
 import {CacheEntryListener, CacheListener} from '../../src/caching/cache-reporting'

 describe('caching report', () => {
@@ -5,7 +6,7 @@ describe('caching report', () => {
        it('with one requested entry report', async () => {
            const report = new CacheListener()
            report.entry('foo').markRequested('1', ['2'])
-            report.entry('bar').markRequested('3').markRestored('4', 500)
+            report.entry('bar').markRequested('3').markRestored('4', 500, 1000)
            expect(report.fullyRestored).toBe(false)
        })
    })
@@ -22,13 +23,13 @@ describe('caching report', () => {
        })
        it('with restored entry report', async () => {
            const report = new CacheListener()
-            report.entry('bar').markRequested('3').markRestored('4', 300)
+            report.entry('bar').markRequested('3').markRestored('4', 300, 1000)
            expect(report.fullyRestored).toBe(true)
        })
        it('with multiple restored entry reportss', async () => {
            const report = new CacheListener()
-            report.entry('foo').markRestored('4', 3300)
-            report.entry('bar').markRequested('3').markRestored('4', 333)
+            report.entry('foo').markRestored('4', 3300, 111)
+            report.entry('bar').markRequested('3').markRestored('4', 333, 1000)
            expect(report.fullyRestored).toBe(true)
        })
    })
@@ -64,7 +65,7 @@ describe('caching report', () => {
            const report = new CacheListener()
            const entryReport = report.entry('foo')
            entryReport.markRequested('1', ['2', '3'])
-            entryReport.markSaved('4', 100)
+            entryReport.markSaved('4', 100, 1000)

            const stringRep = report.stringify()
            const reportClone: CacheListener = CacheListener.rehydrate(stringRep)
@@ -73,6 +74,8 @@ describe('caching report', () => {
            expect(entryClone.requestedKey).toBe('1')
            expect(entryClone.requestedRestoreKeys).toEqual(['2', '3'])
            expect(entryClone.savedKey).toBe('4')
+            expect(entryClone.savedSize).toBe(100)
+            expect(entryClone.savedTime).toBe(1000)
        })
        it('with live entry report', async () => {
            const report = new CacheListener()
@@ -85,7 +88,7 @@ describe('caching report', () => {

            // Check type and call method on rehydrated entry report
            expect(entryClone).toBeInstanceOf(CacheEntryListener)
-            entryClone.markSaved('4', 100)
+            entryClone.markSaved('4', 100, 1000)

            expect(entryClone.requestedKey).toBe('1')
            expect(entryClone.requestedRestoreKeys).toEqual(['2', '3'])
--- a/sources/test/jest/wrapper-validation/checksums.test.ts
+++ b/sources/test/jest/wrapper-validation/checksums.test.ts
@@ -4,6 +4,22 @@ import {afterEach, describe, expect, test, jest} from '@jest/globals'

 jest.setTimeout(30000)

+const CHECKSUM_8_1 = 'ed2c26eba7cfb93cc2b7785d05e534f07b5b48b5e7fc941921cd098628abca58'
+
+function knownChecksumsWithout8_1(): checksums.WrapperChecksums {
+  const knownChecksums = new checksums.WrapperChecksums()
+  // iterate over all known checksums and add them to the knownChecksums object
+  for (const [checksum, versions] of checksums.KNOWN_CHECKSUMS.checksums) {
+    if (checksum !== CHECKSUM_8_1) {
+      for (const version of versions) {
+        knownChecksums.add(version, checksum)
+      }
+    }
+  }
+  return knownChecksums
+}
+
+
 test('has loaded hardcoded wrapper jars checksums', async () => {
  // Sanity check that generated checksums file is not empty and was properly imported
  expect(checksums.KNOWN_CHECKSUMS.checksums.size).toBeGreaterThan(10)
@@ -20,32 +36,23 @@ test('has loaded hardcoded wrapper jars checksums', async () => {
  ).toEqual(new Set(['6.0-rc-1', '6.0-rc-2', '6.0-rc-3', '6.0', '6.0.1']))
 })

-test('fetches wrapper jars checksums', async () => {
-  const validChecksums = await checksums.fetchUnknownChecksums(false, new checksums.WrapperChecksums)
-  expect(validChecksums.size).toBeGreaterThan(10)
-  // Verify that checksum of arbitrary version is contained
-  expect(
-    validChecksums.has(
-      // Checksum for version 6.0
-      '28b330c20a9a73881dfe9702df78d4d78bf72368e8906c70080ab6932462fe9e'
-    )
-  ).toBe(true)
+test('fetches wrapper jar checksums that are missing from hardcoded set', async () => {
+  const unknownChecksums = await checksums.fetchUnknownChecksums(false, knownChecksumsWithout8_1())
+
+  expect(unknownChecksums.checksums.size).toEqual(1)
+  expect(unknownChecksums.checksums.has(CHECKSUM_8_1)).toBe(true)
+  expect(unknownChecksums.checksums.get(CHECKSUM_8_1)).toEqual(new Set(['8.1-rc-1', '8.1-rc-2', '8.1-rc-3', '8.1-rc-4', '8.1', '8.1.1']))
 })

 test('fetches wrapper jar checksums for snapshots', async () => {
-  const nonSnapshotChecksums = await checksums.fetchUnknownChecksums(false, new checksums.WrapperChecksums)
-  const validChecksums = await checksums.fetchUnknownChecksums(true, new checksums.WrapperChecksums)
+  const knownChecksums = knownChecksumsWithout8_1()
+  const nonSnapshotChecksums = await checksums.fetchUnknownChecksums(false, knownChecksums)
+  const allValidChecksums = await checksums.fetchUnknownChecksums(true, knownChecksums)

-  // Expect that at least one snapshot checksum is different from the non-snapshot checksums
-  expect(validChecksums.size).toBeGreaterThan(nonSnapshotChecksums.size)
-})
-
-test('fetches all wrapper checksum URLS for snapshots', async () => {
-  const checksumUrls: string[] = []
-  await checksums.addDistributionSnapshotChecksums(checksumUrls)
-
-  expect(checksumUrls.length).toBeGreaterThan(100) // May only be a few unique checksums
-  console.log(checksumUrls)
+  // Should always be many more snapshot versions
+  expect(allValidChecksums.versions.size - nonSnapshotChecksums.versions.size).toBeGreaterThan(20)
+  // May not be any unique snapshot checksums
+  expect(allValidChecksums.checksums.size).toBeGreaterThanOrEqual(nonSnapshotChecksums.checksums.size)
 })

 describe('retry', () => {
@@ -64,7 +71,7 @@ describe('retry', () => {
        })

      const validChecksums = await checksums.fetchUnknownChecksums(false, new checksums.WrapperChecksums)
-      expect(validChecksums.size).toBeGreaterThan(10)
+      expect(validChecksums.checksums.size).toBeGreaterThan(10)
      nock.isDone()
    })
  })