Daz DeBoerandClaude Opus 5 3f5f9adaf7 Document the new Gradle signing key for dependency verification (#1071) ...

Follow-up to #1069, which bumped the
`github-dependency-graph-gradle-plugin` default to `1.5.0`.

`1.5.0` is signed with a **new** Gradle signing subkey, and the key
currently documented in `docs/setup-gradle.md` has been revoked
upstream. Without this docs change, the snippet we publish will fail
dependency verification for Dependency Graph generation.

I verified the published signatures rather than relying on the
changelog:

| Artifact | Issuer key | |
|---|---|---|
| `github-dependency-graph-gradle-plugin:1.5.0` | `D9B2DFBD9F3298BA` |
new |
| `github-dependency-graph-gradle-plugin:1.4.2` | `893A028475557671` |
old |
| `develocity-gradle-plugin:4.5.0` | `893A028475557671` | old |

So the docs now list **both** keys instead of swapping one for the
other. The Develocity Gradle plugin (`com.gradle`) is still signed with
the old key, so replacing it outright would have broken Develocity
injection for builds with dependency verification enabled.

Docs-only change; no source or `dist` impact.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude Opus 5 (1M context) <noreply@anthropic.com>

2026-09-07 18:57:35 -06:00

..

dependency-submission-faq.md

Restructure documentation and add a dependency-submission FAQ (#110)

2024-04-04 16:38:14 -06:00

dependency-submission.md

Update docs for v6

2026-04-03 15:25:10 -06:00

deprecation-upgrade-guide.md

Update docs for v6

2026-04-03 15:25:10 -06:00

setup-gradle.md

Document the new Gradle signing key for dependency verification (#1071)

2026-09-07 18:57:35 -06:00

wrapper-validation.md

Use the root-qualified :wrapper task (#1064)

2026-09-07 14:42:32 -06:00