Merge pull request #911 - Improve dependency review support

A common issue when submitting a dependency graph is that the required
'contents: write' permission is not set.
We now catch any dependency submission failure and inform the user to check
that the required permissions are available.

.eslintrc.json

@@ -12,6 +12,7 @@
       "import/no-namespace": "off",
       "i18n-text/no-en": "off",
       "no-unused-vars": "off",
+      "no-shadow": "off",
       "sort-imports": "off",
       "@typescript-eslint/no-unused-vars": ["error", { "argsIgnorePattern": "^_" }],
       "@typescript-eslint/explicit-member-accessibility": ["error", {"accessibility": "no-public"}],
@@ -30,6 +31,7 @@
       "@typescript-eslint/no-misused-new": "error",
       "@typescript-eslint/no-namespace": "error", 
       "@typescript-eslint/no-non-null-assertion": "off",
+      "@typescript-eslint/no-shadow": "error",
       "@typescript-eslint/no-unnecessary-qualifier": "error",
       "@typescript-eslint/no-unnecessary-type-assertion": "error",
       "@typescript-eslint/no-useless-constructor": "error",

.github/dependabot.yml

@@ -6,13 +6,27 @@ registries:
     username: dummy # Required by dependabot
     password: dummy # Required by dependabot
 updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+    groups:
+      github-actions:
+        patterns:
+        - "*"
+
   - package-ecosystem: "npm"
     directory: "/"
     schedule:
       interval: "weekly"
-    open-pull-requests-limit: 10
     ignore:
-      - dependency-name: "@types/node"
+      - dependency-name: "@types/node" # Breaking change: update with next major release
+      - dependency-name: "@octokit/rest" # Tied to node version
+    groups:
+      npm-dependencies:
+        patterns:
+        - "*"
+      
   - package-ecosystem: "gradle"
     directory: ".github/workflow-samples/gradle-plugin"
     registries:

.github/workflow-samples/gradle-plugin/gradle/wrapper/gradle-wrapper.properties

@@ -1,7 +1,8 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=1b6b558be93f29438d3df94b7dfee02e794b94d9aca4611a92cdb79b6b88e909
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.0.1-bin.zip
+distributionSha256Sum=591855b517fc635b9e04de1d05d5e76ada3f89f5fc76f87978d1b245b4f69225
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.3-bin.zip
 networkTimeout=10000
+validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists

.github/workflow-samples/gradle-plugin/gradlew

@@ -83,10 +83,8 @@ done
 # This is normally unused
 # shellcheck disable=SC2034
 APP_BASE_NAME=${0##*/}
-APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit
-
-# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd "${APP_HOME:-./}" > /dev/null && pwd -P ) || exit
 
 # Use the maximum available, or set MAX_FD != -1 to use that value.
 MAX_FD=maximum
@@ -133,11 +131,14 @@ location of your Java installation."
     fi
 else
     JAVACMD=java
-    which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+    if ! command -v java >/dev/null 2>&1
+    then
+        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
 
 Please set the JAVA_HOME variable in your environment to match the
 location of your Java installation."
     fi
+fi
 
 # Increase the maximum file descriptors if we can.
 if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
@@ -197,6 +198,10 @@ if "$cygwin" || "$msys" ; then
     done
 fi
 
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
 # Collect all arguments for the java command;
 #   * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of
 #     shell script including quotes and variable substitutions, so put them in

.github/workflow-samples/groovy-dsl/gradle/wrapper/gradle-wrapper.properties

@@ -1,7 +1,8 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=1b6b558be93f29438d3df94b7dfee02e794b94d9aca4611a92cdb79b6b88e909
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.0.1-bin.zip
+distributionSha256Sum=591855b517fc635b9e04de1d05d5e76ada3f89f5fc76f87978d1b245b4f69225
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.3-bin.zip
 networkTimeout=10000
+validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists

.github/workflow-samples/groovy-dsl/gradlew

@@ -83,10 +83,8 @@ done
 # This is normally unused
 # shellcheck disable=SC2034
 APP_BASE_NAME=${0##*/}
-APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit
-
-# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd "${APP_HOME:-./}" > /dev/null && pwd -P ) || exit
 
 # Use the maximum available, or set MAX_FD != -1 to use that value.
 MAX_FD=maximum
@@ -133,11 +131,14 @@ location of your Java installation."
     fi
 else
     JAVACMD=java
-    which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+    if ! command -v java >/dev/null 2>&1
+    then
+        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
 
 Please set the JAVA_HOME variable in your environment to match the
 location of your Java installation."
     fi
+fi
 
 # Increase the maximum file descriptors if we can.
 if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
@@ -197,6 +198,10 @@ if "$cygwin" || "$msys" ; then
     done
 fi
 
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
 # Collect all arguments for the java command;
 #   * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of
 #     shell script including quotes and variable substitutions, so put them in

.github/workflow-samples/groovy-dsl/settings.gradle

@@ -1,6 +1,6 @@
 plugins {
-    id "com.gradle.enterprise" version "3.12.3"
-    id "com.gradle.common-custom-user-data-gradle-plugin" version "1.8.2"
+    id "com.gradle.enterprise" version "3.15"
+    id "com.gradle.common-custom-user-data-gradle-plugin" version "1.11.2"
 }
 
 gradleEnterprise {

.github/workflow-samples/java-toolchain/gradle/wrapper/gradle-wrapper.properties

@@ -1,7 +1,8 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=1b6b558be93f29438d3df94b7dfee02e794b94d9aca4611a92cdb79b6b88e909
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.0.1-bin.zip
+distributionSha256Sum=591855b517fc635b9e04de1d05d5e76ada3f89f5fc76f87978d1b245b4f69225
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.3-bin.zip
 networkTimeout=10000
+validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists

.github/workflow-samples/java-toolchain/gradlew

@@ -83,10 +83,8 @@ done
 # This is normally unused
 # shellcheck disable=SC2034
 APP_BASE_NAME=${0##*/}
-APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit
-
-# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd "${APP_HOME:-./}" > /dev/null && pwd -P ) || exit
 
 # Use the maximum available, or set MAX_FD != -1 to use that value.
 MAX_FD=maximum
@@ -133,11 +131,14 @@ location of your Java installation."
     fi
 else
     JAVACMD=java
-    which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+    if ! command -v java >/dev/null 2>&1
+    then
+        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
 
 Please set the JAVA_HOME variable in your environment to match the
 location of your Java installation."
     fi
+fi
 
 # Increase the maximum file descriptors if we can.
 if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
@@ -197,6 +198,10 @@ if "$cygwin" || "$msys" ; then
     done
 fi
 
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
 # Collect all arguments for the java command;
 #   * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of
 #     shell script including quotes and variable substitutions, so put them in

.github/workflow-samples/java-toolchain/settings.gradle

@@ -1,5 +1,5 @@
 plugins {
-    id("org.gradle.toolchains.foojay-resolver-convention") version("0.4.0")
+    id("org.gradle.toolchains.foojay-resolver-convention") version("0.7.0")
 }
 
 rootProject.name = 'basic'

.github/workflow-samples/kotlin-dsl/build.gradle.kts

@@ -8,9 +8,9 @@ repositories {
 
 dependencies {
     api("org.apache.commons:commons-math3:3.6.1")
-    implementation("com.google.guava:guava:31.1-jre")
+    implementation("com.google.guava:guava:32.1.2-jre")
 
-    testImplementation("org.junit.jupiter:junit-jupiter:5.9.2")
+    testImplementation("org.junit.jupiter:junit-jupiter:5.10.0")
 }
 
 tasks.test {

.github/workflow-samples/kotlin-dsl/gradle/wrapper/gradle-wrapper.properties

@@ -1,7 +1,8 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionSha256Sum=1b6b558be93f29438d3df94b7dfee02e794b94d9aca4611a92cdb79b6b88e909
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.0.1-bin.zip
+distributionSha256Sum=591855b517fc635b9e04de1d05d5e76ada3f89f5fc76f87978d1b245b4f69225
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.3-bin.zip
 networkTimeout=10000
+validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists

.github/workflow-samples/kotlin-dsl/gradlew

@@ -83,10 +83,8 @@ done
 # This is normally unused
 # shellcheck disable=SC2034
 APP_BASE_NAME=${0##*/}
-APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit
-
-# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd "${APP_HOME:-./}" > /dev/null && pwd -P ) || exit
 
 # Use the maximum available, or set MAX_FD != -1 to use that value.
 MAX_FD=maximum
@@ -133,11 +131,14 @@ location of your Java installation."
     fi
 else
     JAVACMD=java
-    which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+    if ! command -v java >/dev/null 2>&1
+    then
+        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
 
 Please set the JAVA_HOME variable in your environment to match the
 location of your Java installation."
     fi
+fi
 
 # Increase the maximum file descriptors if we can.
 if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
@@ -197,6 +198,10 @@ if "$cygwin" || "$msys" ; then
     done
 fi
 
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
 # Collect all arguments for the java command;
 #   * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of
 #     shell script including quotes and variable substitutions, so put them in

.github/workflow-samples/kotlin-dsl/settings.gradle.kts

@@ -1,6 +1,6 @@
 plugins {
-    id("com.gradle.enterprise") version "3.12.3"
-    id("com.gradle.common-custom-user-data-gradle-plugin") version "1.8.2"
+    id("com.gradle.enterprise") version "3.15"
+    id("com.gradle.common-custom-user-data-gradle-plugin") version "1.11.2"
 }
 
 gradleEnterprise {

.github/workflow-samples/no-ge/build.gradle

@@ -0,0 +1 @@
+// Required to keep dependabot happy

.github/workflow-samples/no-ge/settings.gradle

@@ -0,0 +1 @@
+rootProject.name = 'no-ge'

.github/workflow-samples/no-wrapper-gradle-5/build.gradle

@@ -1,5 +1,5 @@
 plugins {
-    id "com.gradle.build-scan" version "3.12.3" 
+    id "com.gradle.build-scan" version "3.15" 
 }
 
 gradleEnterprise {

.github/workflow-samples/no-wrapper/settings.gradle

@@ -1,5 +1,5 @@
 plugins {
-    id "com.gradle.enterprise" version "3.12.3"
+    id "com.gradle.enterprise" version "3.15"
 }
 
 gradleEnterprise {

.github/workflows/ci-codeql.yml

@@ -38,7 +38,7 @@ jobs:
 
     steps:
     - name: Checkout repository
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
 
     # Initializes the CodeQL tools for scanning.
     - name: Initialize CodeQL

.github/workflows/ci-dependency-review.yml

@@ -15,6 +15,6 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - name: 'Checkout Repository'
-        uses: actions/checkout@v3
+        uses: actions/checkout@v4
       - name: 'Dependency Review'
-        uses: actions/dependency-review-action@v2
+        uses: actions/dependency-review-action@v3

.github/workflows/ci-full-check.yml

@@ -29,6 +29,11 @@ jobs:
     with:
       cache-key-prefix: ${{github.run_number}}-
 
+  dependency-graph:
+    uses: ./.github/workflows/integ-test-dependency-graph.yml
+    with:
+      cache-key-prefix: ${{github.run_number}}-
+
   execution-with-caching:
     uses: ./.github/workflows/integ-test-execution-with-caching.yml
     with:
@@ -39,15 +44,22 @@ jobs:
     with:
       cache-key-prefix: ${{github.run_number}}-
 
+  gradle-enterprise-injection:
+    uses: ./.github/workflows/integ-test-inject-gradle-enterprise.yml
+    with:
+      cache-key-prefix: ${{github.run_number}}-
+    secrets:
+      GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GE_SOLUTIONS_ACCESS_TOKEN }}
+
   provision-gradle-versions:
     uses: ./.github/workflows/integ-test-provision-gradle-versions.yml
     with:
       cache-key-prefix: ${{github.run_number}}-
 
-  restore-configuration-cache:
-    uses: ./.github/workflows/integ-test-restore-configuration-cache.yml
-    with:
-      cache-key-prefix: ${{github.run_number}}-
+  # restore-configuration-cache:
+  #   uses: ./.github/workflows/integ-test-restore-configuration-cache.yml
+  #   with:
+  #     cache-key-prefix: ${{github.run_number}}-
 
   restore-custom-gradle-home:
     uses: ./.github/workflows/integ-test-restore-custom-gradle-home.yml
@@ -78,3 +90,8 @@ jobs:
     uses: ./.github/workflows/integ-test-sample-gradle-plugin.yml
     with:
       cache-key-prefix: ${{github.run_number}}-
+
+  toolchain-detection:
+    uses: ./.github/workflows/integ-test-detect-java-toolchains.yml
+    with:
+      cache-key-prefix: ${{github.run_number}}-

.github/workflows/ci-init-script-check.yml

@@ -13,14 +13,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Setup Java
       uses: actions/setup-java@v3
       with:
         distribution: temurin
         java-version: 8
     - name: Setup Gradle
-      uses: gradle/gradle-build-action@v2 # Use a released version to avoid breakages
+      uses: gradle/gradle-build-action@v2.8.1 # Use a released version to avoid breakages
     - name: Run integration tests
       working-directory: test/init-scripts
       run: ./gradlew check

.github/workflows/ci-quick-check.yml

@@ -10,7 +10,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Build and upload distribution
       uses: ./.github/actions/build-dist
 
@@ -18,11 +18,11 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Configure Gradle as default for unit test
       uses: ./
       with:
-        gradle-version: 7.6
+        gradle-version: 8.3
     - name: Run tests
       run: |
         npm install
@@ -50,6 +50,13 @@ jobs:
       runner-os: '["ubuntu-latest"]'
       download-dist: true
 
+  dependency-graph:
+    needs: build-distribution
+    uses: ./.github/workflows/integ-test-dependency-graph.yml
+    with:
+      runner-os: '["ubuntu-latest"]'
+      download-dist: true
+
   execution-with-caching:
     needs: build-distribution
     uses: ./.github/workflows/integ-test-execution-with-caching.yml
@@ -64,6 +71,15 @@ jobs:
       runner-os: '["ubuntu-latest"]'
       download-dist: true
 
+  gradle-enterprise-injection:
+    needs: build-distribution
+    uses: ./.github/workflows/integ-test-inject-gradle-enterprise.yml
+    with:
+      runner-os: '["ubuntu-latest"]'
+      download-dist: true
+    secrets:
+      GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GE_SOLUTIONS_ACCESS_TOKEN }}
+
   provision-gradle-versions:
     needs: build-distribution
     uses: ./.github/workflows/integ-test-provision-gradle-versions.yml
@@ -71,12 +87,12 @@ jobs:
       runner-os: '["ubuntu-latest"]'
       download-dist: true
 
-  restore-configuration-cache:
-    needs: build-distribution
-    uses: ./.github/workflows/integ-test-restore-configuration-cache.yml
-    with:
-      runner-os: '["ubuntu-latest"]'
-      download-dist: true
+  # restore-configuration-cache:
+  #   needs: build-distribution
+  #   uses: ./.github/workflows/integ-test-restore-configuration-cache.yml
+  #   with:
+  #     runner-os: '["ubuntu-latest"]'
+  #     download-dist: true
 
   restore-containerized-gradle-home:
     needs: build-distribution
@@ -117,3 +133,10 @@ jobs:
     with:
       runner-os: '["ubuntu-latest"]'
       download-dist: true
+
+  toolchain-detection:
+    needs: build-distribution
+    uses: ./.github/workflows/integ-test-detect-java-toolchains.yml
+    with:
+      runner-os: '["ubuntu-latest"]'
+      download-dist: true

.github/workflows/ci-verify-outputs.yml

@@ -15,7 +15,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Build
       run: |
         npm -v

.github/workflows/demo-failure-cases.yml

@@ -9,7 +9,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Test build failure
       uses: ./
       continue-on-error: true
@@ -21,7 +21,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Test wrapper missing
       uses: ./
       continue-on-error: true
@@ -33,7 +33,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Test bad config value
       uses: ./
       continue-on-error: true

.github/workflows/demo-job-summary.yml

@@ -1,4 +1,4 @@
-name: Demo Job Summary for Gradle builds
+name: Demo Job Summary, for Gradle builds
 
 on:
   workflow_dispatch:
@@ -12,7 +12,7 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Build distribution
       shell: bash
       run: |
@@ -23,10 +23,10 @@ jobs:
     - name: Build kotlin-dsl project
       working-directory: .github/workflow-samples/kotlin-dsl
       run: ./gradlew assemble
-    - name: Build kotlin-dsl project without build scan
+    - name: Build kotlin-dsl project without Build Scan®
       working-directory: .github/workflow-samples/kotlin-dsl
       run: ./gradlew assemble check --no-scan
-    - name: Build kotlin-dsl project with build scan publish failure
+    - name: Build kotlin-dsl project with Build Scan® publish failure
       working-directory: .github/workflow-samples/kotlin-dsl
       run: ./gradlew check -Dgradle.enterprise.url=https://not.valid.server
     - name: Build groovy-dsl project
@@ -41,3 +41,25 @@ jobs:
       working-directory: .github/workflow-samples/groovy-dsl
       continue-on-error: true
       run: ./gradlew not-a-real-task
+
+  pre-existing-gradle-home:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Build distribution
+      shell: bash
+      run: |
+        npm install
+        npm run build
+    - name: Pre-create Gradle User Home
+      shell: bash
+      run: |
+        mkdir ~/.gradle
+        mkdir ~/.gradle/caches
+        touch ~/.gradle/caches/dummy.txt
+    - name: Setup Gradle
+      uses: ./
+    - name: Run build
+      working-directory: .github/workflow-samples/groovy-dsl
+      run: ./gradlew assemble

.github/workflows/demo-pr-build-scan-comment.yml

@@ -1,4 +1,4 @@
-name: Demo adding build scan comment to PR
+name: Demo adding Build Scan® comment to PR
 on:
   pull_request:
     types: [assigned, review_requested]
@@ -7,14 +7,14 @@ jobs:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout project sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Setup Gradle
       uses: ./
     - name: Run build with Gradle wrapper
       id: gradle
       working-directory: .github/workflow-samples/kotlin-dsl
       run: ./gradlew build --scan
-    - name: "Add build scan URL as PR comment"
+    - name: "Add Build Scan URL as PR comment"
       uses: actions/github-script@v6
       with:
         github-token: ${{secrets.GITHUB_TOKEN}}

.github/workflows/integ-test-action-inputs-caching.yml

@@ -25,7 +25,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
@@ -52,7 +52,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
@@ -77,7 +77,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
@@ -88,19 +88,19 @@ jobs:
       id: gradle
       working-directory: .github/workflow-samples/no-wrapper${{ matrix.build-root-suffix }}
       run: gradle help "-DgradleVersionCheck=${{matrix.gradle}}"
-    - name: Check build scan url is captured
+    - name: Check Build Scan url is captured
       if: ${{ !steps.gradle.outputs.build-scan-url }}
       uses: actions/github-script@v6
       with:
         script: |
-          core.setFailed('No build scan detected')
+          core.setFailed('No Build Scan detected')
 
   # Test that build scans are captured when caching is disabled because Gradle User Home already exists
   cache-disabled-pre-existing-gradle-home:
     runs-on: ubuntu-latest
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Create dummy Gradle User Home
@@ -111,12 +111,12 @@ jobs:
       id: gradle
       working-directory: .github/workflow-samples/no-wrapper${{ matrix.build-root-suffix }}
       run: gradle help "-DgradleVersionCheck=${{matrix.gradle}}"
-    - name: Check build scan url is captured
+    - name: Check Build Scan url is captured
       if: ${{ !steps.gradle.outputs.build-scan-url }}
       uses: actions/github-script@v6
       with:
         script: |
-          core.setFailed('No build scan detected')
+          core.setFailed('No Build Scan detected')
 
   # Test seed the cache with cache-write-only and verify with cache-read-only
   seed-build-write-only:
@@ -128,7 +128,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
@@ -149,7 +149,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle

.github/workflows/integ-test-action-inputs.yml

@@ -25,7 +25,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Invoke with multi-line arguments

.github/workflows/integ-test-cache-cleanup.yml

@@ -25,7 +25,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
@@ -45,7 +45,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
@@ -65,7 +65,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle

.github/workflows/integ-test-dependency-graph.yml

@@ -0,0 +1,103 @@
+name: Test dependency graph
+
+on:
+  workflow_call:
+    inputs:
+      cache-key-prefix:
+        type: string
+      runner-os:
+        type: string
+        default: '["ubuntu-latest", "windows-latest", "macos-latest"]'
+      download-dist:
+        type: boolean
+        default: false
+
+env:
+  DOWNLOAD_DIST: ${{ inputs.download-dist }}
+  GRADLE_BUILD_ACTION_CACHE_KEY_PREFIX: dependency-graph-${{ inputs.cache-key-prefix }}
+  GRADLE_BUILD_ACTION_CACHE_DEBUG_ENABLED: true
+
+jobs:
+  groovy-generate:
+    strategy:
+      matrix:
+        os: ${{fromJSON(inputs.runner-os)}}
+    runs-on: ${{ matrix.os }}
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Download distribution if required
+      uses: ./.github/actions/download-dist
+    - name: Setup Gradle for dependency-graph generate
+      uses: ./
+      with:
+        dependency-graph: generate
+    - name: Run gradle build
+      run: ./gradlew build
+      working-directory: .github/workflow-samples/groovy-dsl
+
+  kotlin-generate:
+    strategy:
+      matrix:
+        os: ${{fromJSON(inputs.runner-os)}}
+    runs-on: ${{ matrix.os }}
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Download distribution if required
+      uses: ./.github/actions/download-dist
+    - name: Setup Gradle for dependency-graph generate
+      uses: ./
+      with:
+        dependency-graph: generate-and-submit
+    - name: Run gradle build
+      run: ./gradlew build
+      working-directory: .github/workflow-samples/kotlin-dsl
+  
+  submit:
+    needs: [groovy-generate, kotlin-generate]
+    runs-on: "ubuntu-latest"
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Download distribution if required
+      uses: ./.github/actions/download-dist
+    - name: Submit dependency graphs
+      uses: ./
+      with:
+        dependency-graph: download-and-submit
+
+  multiple-builds:
+    strategy:
+      matrix:
+        os: ${{fromJSON(inputs.runner-os)}}
+    runs-on: ${{ matrix.os }}
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Download distribution if required
+      uses: ./.github/actions/download-dist
+    - name: Setup Gradle for dependency-graph generate
+      uses: ./
+      with:
+        dependency-graph: generate
+    - id: gradle-assemble
+      run: ./gradlew assemble
+      working-directory: .github/workflow-samples/groovy-dsl
+    - id: gradle-build
+      run: ./gradlew build
+      working-directory: .github/workflow-samples/groovy-dsl
+    - name: Check generated dependency graphs
+      shell: bash
+      run: |
+        echo "gradle-assemble report file: ${{ steps.gradle-assemble.outputs.dependency-graph-file }}"
+        echo "gradle-build report file: ${{ steps.gradle-build.outputs.dependency-graph-file }}"
+        ls -l dependency-graph-reports
+        if [ ! -e "${{ steps.gradle-assemble.outputs.dependency-graph-file }}" ]; then
+            echo "Did not find gradle-assemble dependency graph file"
+            exit 1
+        fi
+        if [ ! -e "${{ steps.gradle-build.outputs.dependency-graph-file }}" ]; then
+            echo "Did not find gradle-build dependency graph files"
+            exit 1
+        fi

.github/workflows/integ-test-detect-java-toolchains.yml

@@ -0,0 +1,113 @@
+name: Test detect java toolchains
+
+on:
+  workflow_call:
+    inputs:
+      cache-key-prefix:
+        type: string
+      runner-os:
+        type: string
+        default: '["ubuntu-latest", "windows-latest", "macos-latest"]'
+      download-dist:
+        type: boolean
+        default: false
+
+env:
+  DOWNLOAD_DIST: ${{ inputs.download-dist }}
+  GRADLE_BUILD_ACTION_CACHE_KEY_PREFIX: detect-java-toolchain-${{ inputs.cache-key-prefix }}
+  GRADLE_BUILD_ACTION_CACHE_DEBUG_ENABLED: true
+
+jobs:
+  # Test that pre-installed runner JDKs are detected
+  pre-installed-toolchains:
+    strategy:
+      matrix:
+        os: ${{fromJSON(inputs.runner-os)}}
+    runs-on: ${{ matrix.os }}
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Download distribution if required
+      uses: ./.github/actions/download-dist
+    - name: Setup Gradle
+      uses: ./
+    - name: List detected toolchains
+      shell: bash
+      working-directory: .github/workflow-samples/groovy-dsl
+      run: | 
+        gradle -q javaToolchains > output.txt
+        cat output.txt
+    - name: Verify detected toolchains
+      shell: bash
+      working-directory: .github/workflow-samples/groovy-dsl
+      run: | 
+        grep -q 'Eclipse Temurin JDK 1.8' output.txt || (echo "::error::Did not detect preinstalled JDK 1.8" && exit 1)
+        grep -q 'Eclipse Temurin JDK 11' output.txt || (echo "::error::Did not detect preinstalled JDK 11" && exit 1)
+        grep -q 'Eclipse Temurin JDK 17' output.txt || (echo "::error::Did not detect preinstalled JDK 17" && exit 1)
+
+  # Test that JDKs provisioned by setup-java are detected
+  setup-java-installed-toolchain:
+    strategy:
+      matrix:
+        os: ${{fromJSON(inputs.runner-os)}}
+    runs-on: ${{ matrix.os }}
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Download distribution if required
+      uses: ./.github/actions/download-dist
+    - name: Setup Java 20
+      uses: actions/setup-java@v3
+      with:
+        distribution: 'temurin'
+        java-version: '20'
+    - name: Setup Java 16
+      uses: actions/setup-java@v3
+      with:
+        distribution: 'temurin'
+        java-version: '16'
+    - name: Setup Gradle
+      uses: ./
+    - name: List detected toolchains
+      shell: bash
+      working-directory: .github/workflow-samples/groovy-dsl
+      run: | 
+        gradle -q javaToolchains > output.txt
+        cat output.txt
+    - name: Verify detected toolchains
+      shell: bash
+      working-directory: .github/workflow-samples/groovy-dsl
+      run: | 
+        grep -q 'Eclipse Temurin JDK 16' output.txt || (echo "::error::Did not detect setup-java installed JDK 16" && exit 1)
+        grep -q 'Eclipse Temurin JDK 20' output.txt || (echo "::error::Did not detect setup-java installed JDK 20" && exit 1)
+
+  # Test that predefined JDK detection property is not overwritten by action
+  check-no-overwrite:
+    strategy:
+      matrix:
+        os: ${{fromJSON(inputs.runner-os)}}
+    runs-on: ${{ matrix.os }}
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Download distribution if required
+      uses: ./.github/actions/download-dist
+    - name: Configure java installations env var in Gradle User Home
+      shell: bash
+      run: | 
+        mkdir -p ~/.gradle
+        echo "org.gradle.java.installations.fromEnv=XXXXX" > ~/.gradle/gradle.properties
+    - name: Setup Gradle
+      uses: ./
+    - name: Check gradle.properties
+      shell: bash
+      run: |
+        cat ~/.gradle/gradle.properties
+        if grep -q 'org.gradle.java.installations.fromEnv=JAVA_HOME' ~/.gradle/gradle.properties ; then
+          echo 'Found overwritten fromEnv'
+          exit 1
+        fi
+        if ! grep -q 'org.gradle.java.installations.fromEnv=XXXXX' ~/.gradle/gradle.properties ; then
+          echo 'Did NOT find original fromEnv'
+          exit 1
+        fi

.github/workflows/integ-test-execution-with-caching.yml

@@ -25,7 +25,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Execute Gradle build
@@ -44,7 +44,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Execute Gradle build

.github/workflows/integ-test-execution.yml

@@ -30,7 +30,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Test use defined Gradle version
@@ -68,7 +68,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Java
@@ -84,11 +84,11 @@ jobs:
         gradle-version: ${{matrix.gradle}}
         build-root-directory: .github/workflow-samples/no-wrapper${{ matrix.build-root-suffix }}
         arguments: help -DgradleVersionCheck=${{matrix.gradle}}
-    - name: Check build scan url
+    - name: Check Build Scan url
       if: ${{ !steps.gradle.outputs.build-scan-url }}
       uses: actions/github-script@v6
       with:
         script: |
-          core.setFailed('No build scan detected')    
+          core.setFailed('No Build Scan detected')    
   
    

.github/workflows/integ-test-inject-gradle-enterprise.yml

@@ -0,0 +1,60 @@
+name: Test gradle enterprise injection
+
+on:
+  workflow_call:
+    inputs:
+      cache-key-prefix:
+        type: string
+      runner-os:
+        type: string
+        default: '["ubuntu-latest", "windows-latest", "macos-latest"]'
+      download-dist:
+        type: boolean
+        default: false
+    secrets:
+      GRADLE_ENTERPRISE_ACCESS_KEY:
+        required: true
+
+env:
+  DOWNLOAD_DIST: ${{ inputs.download-dist }}
+  GRADLE_BUILD_ACTION_CACHE_KEY_PREFIX: provision-gradle-versions-${{ inputs.cache-key-prefix }}
+  GRADLE_BUILD_ACTION_CACHE_DEBUG_ENABLED: true
+  GRADLE_ENTERPRISE_INJECTION_ENABLED: true
+  GRADLE_ENTERPRISE_URL: https://ge.solutions-team.gradle.com
+  GRADLE_ENTERPRISE_PLUGIN_VERSION: 3.15
+  GRADLE_ENTERPRISE_CCUD_PLUGIN_VERSION: 1.11.2
+  GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GRADLE_ENTERPRISE_ACCESS_KEY }}
+
+jobs:
+  inject-gradle-enterprise:
+    strategy:
+      matrix:
+        gradle: [current, 7.6.2, 6.9.4, 5.6.4]
+        os: ${{fromJSON(inputs.runner-os)}}
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Download distribution if required
+      uses: ./.github/actions/download-dist
+    - name: Setup Java
+      uses: actions/setup-java@v3
+      with:
+        distribution: temurin
+        java-version: 8
+    - name: Setup Gradle
+      id: setup-gradle
+      uses: ./
+      with:
+        cache-read-only: false # For testing, allow writing cache entries on non-default branches
+        gradle-version: ${{ matrix.gradle }}
+    - name: Run Gradle build
+      id: gradle
+      working-directory: .github/workflow-samples/no-ge
+      run: gradle help
+    - name: Check Build Scan url
+      if: ${{ !steps.gradle.outputs.build-scan-url }}
+      uses: actions/github-script@v6
+      with:
+        script: |
+          core.setFailed('No Build Scan detected')   

.github/workflows/integ-test-provision-gradle-versions.yml

@@ -30,7 +30,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle with v6.9
@@ -55,6 +55,17 @@ jobs:
     - name: Test use release-candidate
       working-directory: .github/workflow-samples/no-wrapper
       run: gradle help
+    - name: Setup Gradle with current
+      id: gradle-current
+      uses: ./
+      with:
+        gradle-version: current
+    - name: Check current version output parameter
+      if: ${{ !startsWith(steps.gradle-current.outputs.gradle-version , '8.') }}
+      uses: actions/github-script@v6
+      with:
+        script: |
+          core.setFailed('Gradle version parameter not set correctly: value was "${{ steps.gradle-current.outputs.gradle-version }}"')    
   
   gradle-versions:
     strategy:
@@ -71,7 +82,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Java
@@ -80,19 +91,26 @@ jobs:
         distribution: temurin
         java-version: 8
     - name: Setup Gradle
+      id: setup-gradle
       uses: ./
       with:
         cache-read-only: false # For testing, allow writing cache entries on non-default branches
         gradle-version: ${{ matrix.gradle }}
+    - name: Check output parameter
+      if: ${{ steps.setup-gradle.outputs.gradle-version != matrix.gradle }}
+      uses: actions/github-script@v6
+      with:
+        script: |
+          core.setFailed('Gradle version parameter not set correctly: value was "${{ steps.setup-gradle.outputs.gradle-version }}"')    
     - name: Run Gradle build
       id: gradle
       working-directory: .github/workflow-samples/no-wrapper${{ matrix.build-root-suffix }}
       run: gradle help "-DgradleVersionCheck=${{matrix.gradle}}"
-    - name: Check build scan url
+    - name: Check Build Scan url
       if: ${{ !steps.gradle.outputs.build-scan-url }}
       uses: actions/github-script@v6
       with:
         script: |
-          core.setFailed('No build scan detected')    
+          core.setFailed('No Build Scan detected')    
   
    

.github/workflows/integ-test-restore-configuration-cache.yml

@@ -27,7 +27,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
@@ -48,7 +48,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
@@ -79,7 +79,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle with no extracted cache entries restored
@@ -101,7 +101,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
@@ -122,7 +122,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
@@ -144,7 +144,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle

.github/workflows/integ-test-restore-containerized-gradle-home.yml

@@ -20,7 +20,7 @@ jobs:
     container: fedora:latest
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Java
@@ -43,7 +43,7 @@ jobs:
     container: fedora:latest
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Java

.github/workflows/integ-test-restore-custom-gradle-home.yml

@@ -23,7 +23,7 @@ jobs:
         mkdir -p $GITHUB_WORKSPACE/gradle-user-home
         echo "GRADLE_USER_HOME=$GITHUB_WORKSPACE/gradle-user-home" >> $GITHUB_ENV
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
@@ -44,7 +44,7 @@ jobs:
         mkdir -p $GITHUB_WORKSPACE/gradle-user-home
         echo "GRADLE_USER_HOME=$GITHUB_WORKSPACE/gradle-user-home" >> $GITHUB_ENV
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
@@ -65,7 +65,7 @@ jobs:
         mkdir -p $GITHUB_WORKSPACE/gradle-user-home
         echo "GRADLE_USER_HOME=$GITHUB_WORKSPACE/gradle-user-home" >> $GITHUB_ENV
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle

.github/workflows/integ-test-restore-gradle-home.yml

@@ -26,7 +26,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
@@ -46,7 +46,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
@@ -66,7 +66,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
@@ -86,7 +86,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle with no extracted cache entries restored
@@ -99,3 +99,40 @@ jobs:
       working-directory: .github/workflow-samples/groovy-dsl
       run: ./gradlew test
 
+  # Test that a pre-existing gradle-user-home can be overwritten by the restored cache
+  pre-existing-gradle-home:
+    needs: seed-build
+    strategy:
+      matrix:
+        os: ${{fromJSON(inputs.runner-os)}}
+    runs-on: ${{ matrix.os }}
+    steps:
+    - name: Checkout sources
+      uses: actions/checkout@v4
+    - name: Download distribution if required
+      uses: ./.github/actions/download-dist
+    - name: Pre-create Gradle User Home
+      shell: bash
+      run: |
+        mkdir -p ~/.gradle/caches
+        touch ~/.gradle/gradle.properties
+        touch ~/.gradle/caches/dummy.txt
+    - name: Setup Gradle
+      uses: ./
+      with:
+        cache-read-only: true
+        cache-overwrite-existing: true
+    - name: Check that pre-existing content still exists
+      shell: bash
+      run: |
+        if [ ! -e ~/.gradle/caches/dummy.txt ]; then
+          echo "::error ::Should find dummy.txt after cache restore"
+          exit 1
+        fi
+        if [ ! -e ~/.gradle/gradle.properties ]; then
+          echo "::error ::Should find gradle.properties after cache restore"
+          exit 1
+        fi
+    - name: Execute Gradle build with --offline
+      working-directory: .github/workflow-samples/groovy-dsl
+      run: ./gradlew test --offline

.github/workflows/integ-test-restore-java-toolchain.yml

@@ -25,7 +25,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
@@ -45,7 +45,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle

.github/workflows/integ-test-sample-gradle-plugin.yml

@@ -25,7 +25,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
@@ -44,7 +44,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle

.github/workflows/integ-test-sample-kotlin-dsl.yml

@@ -25,7 +25,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle
@@ -44,7 +44,7 @@ jobs:
     runs-on: ${{ matrix.os }}
     steps:
     - name: Checkout sources
-      uses: actions/checkout@v3
+      uses: actions/checkout@v4
     - name: Download distribution if required
       uses: ./.github/actions/download-dist
     - name: Setup Gradle

.tool-versions

@@ -1,2 +1,3 @@
 # Configuration file for asdf version manager
 nodejs 16.18.1
+gradle 8.3

LICENSE

@@ -1,7 +1,7 @@
 
 The MIT License (MIT)
 
-Copyright (c) 2018 GitHub, Inc. and contributors
+Copyright (c) 2023 Gradle Inc.
 
 Permission is hereby granted, free of charge, to any person obtaining a copy
 of this software and associated documentation files (the "Software"), to deal

README.md

@@ -2,12 +2,28 @@
 
 This GitHub Action can be used to configure Gradle and optionally execute a Gradle build on any platform supported by GitHub Actions.
 
+## Why use the `gradle-build-action`?
+
+It is possible to directly invoke Gradle in your workflow, and the `actions/setup-java@v3` action provides a simple way to cache Gradle dependencies. 
+
+However, the `gradle-build-action` offers a number of advantages over this approach:
+
+- Easily [configure your workflow to use a specific version of Gradle](#choose-a-specific-gradle-version) using the `gradle-version` parameter. Gradle distributions are automatically downloaded and cached. 
+- More sophisticated and more efficient caching of Gradle User Home between invocations, compared to `setup-java` and most custom configurations using `actions/cache`. [More details below](#caching-build-state-between-jobs).
+- Detailed reporting of cache usage and cache configuration options allow you to [optimize the use of the GitHub actions cache](#optimizing-cache-effectiveness).
+- [Generate and Submit a GitHub Dependency Graph](#github-dependency-graph-support) for your project, enabling Dependabot security alerts.
+- [Automatic capture of Build Scan® links](#build-reporting) from the build, making these easier to locate for workflow run.
+
+The `gradle-build-action` is designed to provide these benefits with minimal configuration. 
+These features work both when Gradle is executed via the `gradle-build-action` and for any Gradle execution in subsequent steps.
+
 ## Use the action to setup Gradle
 
-If you have an existing workflow invoking Gradle, you can add an initial "Setup Gradle" Step to benefit from caching, 
-build-scan capture and other features of the gradle-build-action.
+The recommended way to use the `gradle-build-action` is in an initial "Setup Gradle" step, with subsquent steps invoking Gradle directly with a `run` step. This makes the action minimally invasive, and allows a workflow to configure and execute a Gradle execution in any way.
+
+The `gradle-build-action` works by configuring environment variables and by adding a set of Gradle init-scripts to the Gradle User Home. These will apply to all Gradle executions on the runner, no matter how Gradle is invoked. 
+This means that if you have an existing workflow that executes Gradle with a `run` step, you can add an initial "Setup Gradle" Step to benefit from caching, build-scan capture and other features of the gradle-build-action.
 
-All subsequent Gradle invocations will benefit from this initial setup, via `init` scripts added to the Gradle User Home.
 
 ```yaml
 name: Run Gradle on PRs
@@ -32,23 +48,7 @@ jobs:
       run: ./gradlew build
 ```
 
-## Why use the `gradle-build-action`?
-
-It is possible to directly invoke Gradle in your workflow, and the `actions/setup-java@v3` action provides a simple way to cache Gradle dependencies. 
-
-However, the `gradle-build-action` offers a number of advantages over this approach:
-
-- Easily [run the build with different versions of Gradle](#use-a-specific-gradle-version) using the `gradle-version` parameter. Gradle distributions are automatically downloaded and cached. 
-- More sophisticated and more efficient caching of Gradle User Home between invocations, compared to `setup-java` and most custom configurations using `actions/cache`. [More details below](#caching).
-- Detailed reporting of cache usage and cache configuration options allow you to [optimize the use of the GitHub actions cache](#optimizing-cache-effectiveness).
-- [Automatic capture of build scan links](#build-scans) from the build, making these easier to locate for workflow run.
-
-The `gradle-build-action` is designed to provide these benefits with minimal configuration. 
-These features work both when Gradle is executed via the `gradle-build-action` and for any Gradle execution in subsequent steps.
-
-When using `gradle-build-action` we recommend that you _not_ use `actions/cache` or `actions/setup-java@v3` to explicitly cache the Gradle User Home. Doing so may interfere with the caching provided by this action.
-
-## Use a specific Gradle version
+## Choose a specific Gradle version
 
 The `gradle-build-action` can download and install a specified Gradle version, adding this installed version to the PATH.
 Downloaded Gradle versions are stored in the GitHub Actions cache, to avoid requiring downloading again later.
@@ -73,6 +73,8 @@ Moreover, you can use the following aliases:
 
 This can be handy to automatically verify your build works with the latest release candidate of Gradle:
 
+The actual Gradle version used is available as an action output: `gradle-version`.
+
 ```yaml
 name: Test latest Gradle RC
 on:
@@ -88,14 +90,341 @@ jobs:
         distribution: temurin
         java-version: 11
     - uses: gradle/gradle-build-action@v2
+      id: setup-gradle
       with:
         gradle-version: release-candidate
     - run: gradle build --dry-run # just test build configuration
+    - run: echo "The release-candidate version was ${{ steps.setup-gradle.outputs.gradle-version }}"
 ```
 
-## Gradle Execution
 
-If the action is configured with an `arguments` input, then Gradle will execute a Gradle build with the arguments provided.
+## Caching build state between Jobs
+
+The `gradle-build-action` will use the GitHub Actions cache to save and restore reusable state that may be speed up a subsequent build invocation. This includes most content that is downloaded from the internet as part of a build, as well as expensive to create content like compiled build scripts, transformed Jar files, etc.
+
+The state that is cached includes:
+- Any distributions downloaded to satisfy a `gradle-version` parameter ;
+- A subset of the Gradle User Home directory, including downloaded dependencies, wrapper distributions, and the local build cache ;
+
+To reduce the space required for caching, this action makes a best effort to reduce duplication in cache entries.
+
+State will be restored from the cache during the first `gradle-build-action` step for any workflow job, and cache entries will be written back to the cache at the end of the job, after all Gradle executions have completed.
+
+### Disabling caching
+
+Caching is enabled by default. You can disable caching for the action as follows:
+```yaml
+cache-disabled: true
+```
+
+### Using the cache read-only
+
+By default, the `gradle-build-action` will only write to the cache from Jobs on the default (`main`/`master`) branch.
+Jobs on other branches will read entries from the cache but will not write updated entries. 
+See [Optimizing cache effectiveness](#optimizing-cache-effectiveness) for a more detailed explanation.
+
+In some circumstances it makes sense to change this default, and to configure a workflow Job to read existing cache entries but not to write changes back.
+
+You can configure read-only caching for the `gradle-build-action` as follows:
+
+```yaml
+cache-read-only: true
+```
+
+You can also configure read-only caching only for certain branches:
+
+```yaml
+# Only write to the cache for builds on the 'main' and 'release' branches. (Default is 'main' only.)
+# Builds on other branches will only read existing entries from the cache.
+cache-read-only: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/release' }}
+```
+
+### Using the cache write-only
+
+In certain circumstances it may be desirable to start with a clean Gradle User Home state, but to save that state at the end of a workflow Job:
+
+```yaml
+cache-write-only: true
+```
+
+### Overwriting an existing Gradle User Home
+
+When the action detects that the Gradle User Home caches directory already exists (`~/.gradle/caches`), then by default it will not overwrite the existing content of this directory.
+This can occur when a prior action initializes this directory, or when using a self-hosted runner that retains this directory between uses.
+
+In this case the Job Summary will display a message like: 
+> Caching for gradle-build-action was disabled due to pre-existing Gradle User Home
+
+If you want override the default and have the `gradle-build-action` caches overwrite existing content in the Gradle User Home, you can set the `cache-overwrite-existing` parameter to 'true':
+
+```yaml
+cache-overwrite-existing: true
+```
+
+### Incompatibility with other caching mechanisms
+
+When using `gradle-build-action` we recommend that you avoid using other mechanisms to save and restore the Gradle User Home. 
+
+Specifically:
+- Avoid using `actions/cache` configured to cache the Gradle User Home, [as described in this example](https://github.com/actions/cache/blob/main/examples.md#java---gradle).
+- Avoid using `actions/setup-java` with the `cache: gradle` option, [as described here](https://github.com/actions/setup-java#caching-gradle-dependencies).
+
+Using either of these mechanisms may interfere with the caching provided by this action. If you choose to use a different mechanism to save and restore the Gradle User Home, you should disable the caching provided by this action, as described above.
+
+### Cache debugging and analysis
+
+A report of all cache entries restored and saved is printed to the Job Summary when saving the cache entries. 
+This report can provide valuable insignt into how much cache space is being used.
+
+It is possible to enable additional debug logging for cache operations. You do via the `GRADLE_BUILD_ACTION_CACHE_DEBUG_ENABLED` environment variable:
+
+```yaml
+env:
+  GRADLE_BUILD_ACTION_CACHE_DEBUG_ENABLED: true
+```
+
+Note that this setting will also prevent certain cache operations from running in parallel, further assisting with debugging.
+
+## How Gradle User Home caching works
+
+### Properties of the GitHub Actions cache
+
+The GitHub Actions cache has some properties that present problems for efficient caching of the Gradle User Home.
+- Immutable entries: once a cache entry is written for a key, it cannot be overwritten or changed.
+- Branch scope: cache entries written for a Git branch are not visible from actions running against different branches. Entries written for the default branch are visible to all. https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#restrictions-for-accessing-a-cache
+- Restore keys: if no exact match is found, a set of partial keys can be provided that will match by cache key prefix. https://docs.github.com/en/actions/using-workflows/caching-dependencies-to-speed-up-workflows#matching-a-cache-key
+
+Each of these properties has influenced the design and implementation of the caching in `gradle-build-action`, as described below.
+
+### Which content is cached
+
+Using experiments and observations, we have attempted to identify which Gradle User Home content is worth saving and restoring between build invocations. We considered both the respective size of the content and the impact this content has on build times. As well as the obvious candidates like downloaded dependencies, we saw that compiled build scripts, transformed Jar files and other content can also have a significant impact.
+
+In the end, we opted to save and restore as much content as is practical, including:
+- `caches/<version>/generated-gradle-jars`: These files are generated on first use of a particular Gradle version, and are expensive to recreate
+- `caches/<version>/kotlin-dsl` and `caches/<version>/scripts`: These are the compiled build scripts. The Kotlin ones in particular can benefit from caching.
+- `caches/modules-2`: The downloaded dependencies
+- `caches/transforms-3`: The results of artifact transforms
+- `caches/jars-9`: Jar files that have been processed/instrumented by Gradle
+- `caches/build-cache-1`: The local build cache
+
+In certain cases a particular section of Gradle User Home will be too large to make caching effective. In these cases, particular subdirectories can be excluded from caching. See [Exclude content from Gradle User Home cache](#exclude-content-from-gradle-user-home-cache).
+
+### Cache keys
+
+The actual content of the Gradle User Home after a build is the result of many factors, including:
+- Core Gradle build files (`settngs.gradle[.kts]`, `build.gradle[.kts]`, `gradle.properties`)
+- Associated Gradle configuration files (`gradle-wrapper.properties`, `dependencies.toml`, etc)
+- The entire content of `buildSrc` or any included builds that provide plugins.
+- The entire content of the repository, in the case of the local build cache.
+- The actual build command that was invoked, including system properties and environment variables.
+
+For this reason, it's very difficult to create a cache key that will deterministically map to a saved Gradle User Home state. So instead of trying to reliably hash all of these inputs to generate a cache key, the Gradle User Home cache key is based on the currently executing Job and the current commit hash for the repository.
+
+The Gradle User Home cache key is composed of:
+- The current operating system (`RUNNER_OS`)
+- The workflow name and Job ID
+- A hash of the Job matrix parameters
+- The git SHA for the latest commit
+
+Specifically, the cache key is: `${cache-protocol}-gradle|${runner-os}|${workflow-name}-${job-id}[${hash-of-job-matrix}]-${git-sha}`
+
+As such, the cache key is likely to change on each subsequent run of GitHub actions. 
+This allows the most recent state to always be available in the GitHub actions cache.
+
+### Finding a matching cache entry
+
+In most cases, no exact match will exist for the cache key. Instead, the Gradle User Home will be restored for the closest matching cache entry, using a set of "restore keys". The entries will be matched with the following precedence:
+- An exact match on OS, workflow, job, matrix and Git SHA
+- The most recent entry saved for the same OS, workflow, job and matrix values
+- The most recent entry saved for the same OS, workflow and job
+- The most recent entry saved for the same OS
+
+Due to branch scoping of cache entries, the above match will be first performed for entries from the same branch, and then for the default ('main') branch.
+
+After the Job is complete, the current Gradle User Home state will be collected and written as a new cache entry with the complete cache key. Old entries will be expunged from the GitHub Actions cache on a least-recently-used basis.
+
+Note that while effective, this mechanism is not inherently efficient. It requires the entire Gradle User Home directory to be stored separately for each branch, for every OS+Job+Matrix combination. In addition, a new cache entry to be written on every GitHub Actions run. 
+
+This inefficiency is effectively mitigated by [Deduplication of Gradle User Home cache entries](#deduplication-of-gradle-user-home-cache-entries), and can be further optimized for a workflow using the techniques described in [Optimizing cache effectiveness](#optimizing-cache-effectiveness).
+
+### Deduplication of Gradle User Home cache entries
+
+To reduce duplication between cache entries, certain artifacts in Gradle User Home are extracted and cached independently based on their identity. This allows each Gradle User Home cache entry to be relatively small, sharing common elements between them without duplication.
+
+Artifacts that are cached independently include:
+- Downloaded dependencies
+- Downloaded wrapper distributions
+- Generated Gradle API jars
+- Downloaded Java Toolchains
+
+For example, this means that all jobs executing a particular version of the Gradle wrapper will share a single common entry for this wrapper distribution and one for each of the generated Gradle API jars.
+
+### Stopping the Gradle daemon
+
+By default, the action will stop all running Gradle daemons in the post-action step, prior to saving the Gradle User Home state. 
+This allows for any Gradle User Home cleanup to occur, and avoid file-locking issues on Windows.
+
+If caching is disabled or the cache is in read-only mode, the daemon will not be stopped and will continue running after the job is completed.
+
+## Optimizing cache effectiveness
+
+Cache storage space for GitHub actions is limited, and writing new cache entries can trigger the deletion of existing entries.
+Eviction of shared cache entries can reduce cache effectiveness, slowing down your `gradle-build-action` steps.
+
+There are a number of actions you can take if your cache use is less effective due to entry eviction.
+
+At the end of a Job, the `gradle-build-action` will write a summary of the Gradle builds executed, together with a detailed report of the cache entries that were read and written during the Job. This report can provide valuable insights that may help to determine the right way to optimize the cache usage for your workflow.
+
+### Select which jobs should write to the cache
+
+Consider a workflow that first runs a Job "compile-and-unit-test" to compile the code and run some basic unit tests, which is followed by a matrix of parallel "integration-test" jobs that each run a set of integration tests for the repository. Each "integration test" Job requires all of the dependencies required by "compile-and-unit-test", and possibly one or 2 additional dependencies.
+
+By default, a new cache entry will be written on completion of each integration test job. If no additional dependencies were downloaded then this cache entry will share the "dependencies" entry with the "compile-and-unit-test" job, but if a single dependency was downloaded then an entire new "dependencies" entry would be written. (The `gradle-build-action` does not _yet_ support a layered cache that could do this more efficiently). If each of these "integration-test" entries with their different "dependencies" entries is too large, then it could result in other important entries being evicted from the GitHub Actions cache.
+
+There are some techniques that can be used to avoid/mitigate this issue:
+- Configure the "integration-test" jobs with `cache-read-only: true`, meaning that the Job will use the entry written by the "compile-and-unit-test" job. This will avoid the overhead of cache entries for each of these jobs, at the expense of re-downloading any additional dependencies required by "integration-test".
+- Add an additional step to the "compile-and-unit-test" job which downloads all dependencies required by the integration-test jobs but does not execute the tests. This will allow the "dependencies" entry for "compile-and-unit-test" to be shared among all cache entries for "integration-test". The resulting "integration-test" entries should be much smaller, reducing the potential for eviction.
+- Combine the above 2 techniques, so that no cache entry is written by "integration-test" jobs, but all required dependencies are already present from the restored "compile-and-unit-test" entry.
+
+### Select which branches should write to the cache
+
+GitHub cache entries are not shared between builds on different branches. 
+This means that each PR branch will have it's own Gradle User Home cache, and will not benefit from cache entries written by other PR branches.
+An exception to this is that cache entries written in parent and upstream branches are visible to child branches, and cache entries for the default (`master`/`main`) branch can be read by actions invoked for any other branch.
+
+By default, the `gradle-build-action` will only _write_ to the cache for builds run on the default (`master`/`main`) branch. 
+Jobs run on other branches will only read from the cache. In most cases, this is the desired behaviour, 
+because Jobs run against other branches will benefit from the cache Gradle User Home from `main`, 
+without writing private cache entries that could lead to evicting shared entries.
+
+If you have other long-lived development branches that would benefit from writing to the cache, 
+you can configure these by overriding the `cache-read-only` action parameter. 
+See [Using the caches read-only](#using-the-caches-read-only) for more details.
+
+Similarly, you could use `cache-read-only` for certain jobs in the workflow, and instead have these jobs reuse the cache content from upstream jobs.
+
+### Exclude content from Gradle User Home cache
+
+As well as any wrapper distributions, the action will attempt to save and restore the `caches` and `notifications` directories from Gradle User Home.
+
+Each build is different, and some builds produce more Gradle User Home content than others.
+[Cache debugging ](#cache-debugging-and-analysis) can provide insight into which cache entries are the largest,
+and the contents to be cached can be fine tuned by including and excluding certain paths within Gradle User Home.
+
+```yaml
+# Cache downloaded JDKs in addition to the default directories.
+gradle-home-cache-includes: |
+    caches
+    notifications
+    jdks
+# Exclude the local build-cache and keyrings from the directories cached.
+gradle-home-cache-excludes: |
+    caches/build-cache-1
+    caches/keyrings
+```
+
+You can specify any number of fixed paths or patterns to include or exclude. 
+File pattern support is documented at https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#patterns-to-match-file-paths.
+
+### Remove unused files from Gradle User Home before saving to cache
+
+The Gradle User Home directory has a tendency to grow over time. When you switch to a new Gradle wrapper version or upgrade a dependency version
+the old files are not automatically and immediately removed. While this can make sense in a local environment, in a GitHub Actions environment
+it can lead to ever-larger Gradle User Home cache entries being saved and restored.
+
+In order to avoid this situation, the `gradle-build-action` supports the `gradle-home-cache-cleanup` parameter. 
+When enabled, this feature will attempt to delete any files in the Gradle User Home that were not used by Gradle during the GitHub Actions workflow, 
+prior to saving the Gradle User Home to the GitHub Actions cache.
+
+Gradle Home cache cleanup is considered experimental and is disabled by default.  You can enable this feature for the action as follows:
+```yaml
+gradle-home-cache-cleanup: true
+```
+
+## Build reporting
+
+The `gradle-build-action` collects information about any Gradle executions that occur in a workflow, and reports these via
+a Job Summary, visible in the GitHub Actions UI. For each Gradle execution, details about the invocation are listed, together with
+a link to any Build Scan® published.
+
+Generation of a Job Summary is enabled by default. If this is not desired, it can be disable as follows:
+```yaml
+generate-job-summary: false
+```
+
+Note that the action collects information about Gradle invocations via an [Initialization Script](https://docs.gradle.org/current/userguide/init_scripts.html#sec:using_an_init_script)
+located at `USER_HOME/.gradle/init.d/build-result-capture.init.gradle`.
+If you are using init scripts for the [Gradle Enterprise Gradle Plugin](https://plugins.gradle.org/plugin/com.gradle.enterprise) like
+[`scans-init.gradle` or `gradle-enterprise-init.gradle`](https://docs.gradle.com/enterprise/gradle-plugin/#scans_gradle_com),
+you'll need to ensure these files are applied prior to `build-result-capture.init.gradle`.
+Since Gradle applies init scripts in alphabetical order, one way to ensure this is via file naming.
+
+### Build Scan® link as Step output
+
+As well as reporting the [Build Scan](https://gradle.com/build-scans/) link in the Job Summary,
+the `gradle-build-action` action makes this link available as a Step output named `build-scan-url`.
+
+You can then use that link in subsequent actions of your workflow. For example:
+
+```yaml
+# .github/workflows/gradle-build-pr.yml
+name: Run Gradle on PRs
+on: pull_request
+jobs:
+  gradle:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout project sources
+      uses: actions/checkout@v3
+    - name: Setup Gradle
+      uses: gradle/gradle-build-action@v2
+    - name: Run build with Gradle wrapper
+      id: gradle
+      run: ./gradlew build --scan
+    - name: "Add Build Scan URL as PR comment"
+      uses: actions/github-script@v5
+      if: github.event_name == 'pull_request' && failure()
+      with:
+        github-token: ${{secrets.GITHUB_TOKEN}}
+        script: |
+          github.rest.issues.createComment({
+            issue_number: context.issue.number,
+            owner: context.repo.owner,
+            repo: context.repo.repo,
+            body: '❌ ${{ github.workflow }} failed: ${{ steps.gradle.outputs.build-scan-url }}'
+          })
+```
+
+### Saving build outputs
+
+By default, a GitHub Actions workflow using `gradle-build-action` will record the log output and any Build Scan links for your build,
+but any output files generated by the build will not be saved.
+
+To save selected files from your build execution, you can use the core [Upload-Artifact](https://github.com/actions/upload-artifact) action.
+For example:
+
+```yaml
+jobs:   
+  gradle:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Checkout project sources
+      uses: actions/checkout@v3
+    - name: Setup Gradle
+      uses: gradle/gradle-build-action@v2
+    - name: Run build with Gradle wrapper
+      run: ./gradlew build --scan
+    - name: Upload build reports
+      uses: actions/upload-artifact@v3
+      with:
+        name: build-reports
+        path: build/reports/
+```
+
+## Use the action to invoke Gradle
+
+If the `gradle-build-action` is configured with an `arguments` input, then Gradle will execute a Gradle build with the arguments provided. NOTE: We recommend using the `gradle-build-action` as a "Setup Gradle" step as described above, with Gradle being invoked via a regular `run` command.
 
 If no `arguments` are provided, the action will not execute Gradle, but will still cache Gradle state and configure build-scan capture for all subsequent Gradle executions.
 
@@ -190,211 +519,362 @@ Use the `gradle-executable` input to execute using a specific Gradle installatio
 
 This mechanism can also be used to target a Gradle wrapper script that is located in a non-default location.
 
-## Caching
-
-By default, this action aims to cache any and all reusable state that may be speed up a subsequent build invocation. 
-
-The state that is cached includes:
-- Any distributions downloaded to satisfy a `gradle-version` parameter ;
-- A subset of the Gradle User Home directory, including downloaded dependencies, wrapper distributions, and the local build cache ;
-- Any [configuration-cache](https://docs.gradle.org/nightly/userguide/configuration_cache.html) data stored in the project `.gradle` directory. (Only supported for Gradle 7 or higher.)
-
-To reduce the space required for caching, this action makes a best effort to reduce duplication in cache entries.
-
-Caching is enabled by default. You can disable caching for the action as follows:
-```yaml
-cache-disabled: true
-```
-### Cache keys
-
-Distributions downloaded to satisfy a `gradle-version` parameter are stored outside of Gradle User Home and cached separately. The cache key is unique to the downloaded distribution and will not change over time.
-
-The state of the Gradle User Home and configuration-cache are highly dependent on the Gradle execution, so the cache key is composed of the current commit hash and the GitHub actions job id.
-As such, the cache key is likely to change on each subsequent run of GitHub actions. 
-This allows the most recent state to always be available in the GitHub actions cache.
-
-To reduce duplication between cache entries, certain artifacts are cached independently based on their identity.
-Artifacts that are cached independently include downloaded dependencies, downloaded wrapper distributions and generated Gradle API jars.
-For example, this means that all jobs executing a particular version of the Gradle wrapper will share common entries for wrapper distributions and for generated Gradle API jars.
-
-### Using the caches read-only
-
-By default, the `gradle-build-action` will only write to the cache from Jobs on the default (`main`/`master`) branch.
-Jobs on other branches will read entries from the cache but will not write updated entries. 
-See [Optimizing cache effectiveness](#optimizing-cache-effectiveness) for a more detailed explanation.
-
-In some circumstances it makes sense to change this default, and to configure a workflow Job to read existing cache entries but not to write changes back.
-
-You can configure read-only caching for the `gradle-build-action` as follows:
-
-```yaml
-# Only write to the cache for builds on the 'main' and 'release' branches. (Default is 'main' only.)
-# Builds on other branches will only read existing entries from the cache.
-cache-read-only: ${{ github.ref != 'refs/heads/main' && github.ref != 'refs/heads/release' }}
-```
-
-### Stopping the Gradle daemon
-
-By default, the action will stop all running Gradle daemons in the post-action step, prior to saving the Gradle User Home state. 
-This allows for any Gradle User Home cleanup to occur, and avoid file-locking issues on Windows.
-
-If caching is unavailable or the cache is in read-only mode, the daemon will not be stopped and will continue running after the job is completed.
-
-### Gradle User Home cache tuning
-
-As well as any wrapper distributions, the action will attempt to save and restore the `caches` and `notifications` directories from Gradle User Home.
-
-The contents to be cached can be fine tuned by including and excluding certain paths with Gradle User Home.
-
-```yaml
-# Cache downloaded JDKs in addition to the default directories.
-gradle-home-cache-includes: |
-    caches
-    notifications
-    jdks
-# Exclude the local build-cache from the directories cached.
-gradle-home-cache-excludes: |
-    caches/build-cache-1
-```
-
-You can specify any number of fixed paths or patterns to include or exclude. 
-File pattern support is documented at https://docs.github.com/en/actions/learn-github-actions/workflow-syntax-for-github-actions#patterns-to-match-file-paths.
-
-### Cache debugging and analysis
-
-Gradle User Home state will be restored from the cache during the first `gradle-build-action` step for any workflow job. 
-This state will be saved back to the cache at the end of the job, after all Gradle executions have completed.
-A report of all cache entries restored and saved is printed to the Job Summary when saving the cache entries. 
-This report can provide valuable insignt into how much cache space is being used.
-
-It is possible to enable additional debug logging for cache operations. You do via the `GRADLE_BUILD_ACTION_CACHE_DEBUG_ENABLED` environment variable:
-
-```yaml
-env:
-  GRADLE_BUILD_ACTION_CACHE_DEBUG_ENABLED: true
-```
-
-Note that this setting will also prevent certain cache operations from running in parallel, further assisting with debugging.
-
-### Optimizing cache effectiveness
-
-Cache storage space for GitHub actions is limited, and writing new cache entries can trigger the deletion of existing entries.
-Eviction of shared cache entries can reduce cache effectiveness, slowing down your `gradle-build-action` steps.
-
-There are a number of actions you can take if your cache use is less effective due to entry eviction.
-
-#### Select branches that should write to the cache
-
-GitHub cache entries are not shared between builds on different branches. 
-This means that each PR branch will have it's own Gradle User Home cache, and will not benefit from cache entries written by other PR branches.
-An exception to this is that cache entries written in parent and upstream branches are visible to child branches, and cache entries for the default (`master`/`main`) branch can be read by actions invoked for any other branch.
-
-By default, the `gradle-build-action` will only _write_ to the cache for builds run on the default (`master`/`main`) branch. 
-Jobs run on other branches will only read from the cache. In most cases, this is the desired behaviour, 
-because Jobs run against other branches will benefit from the cache Gradle User Home from `main`, 
-without writing private cache entries that could lead to evicting shared entries.
-
-If you have other long-lived development branches that would benefit from writing to the cache, 
-you can configure these by overriding the `cache-read-only` action parameter. 
-See [Using the caches read-only](#using-the-caches-read-only) for more details.
-
-Similarly, you could use `cache-read-only` for certain jobs in the workflow, and instead have these jobs reuse the cache content from upstream jobs.
-
-#### Exclude content from Gradle User Home cache
-
-Each build is different, and some builds produce more Gradle User Home content than others.
-[Cache debugging ](#cache-debugging-and-analysis) can provide insight into which cache entries are the largest,
-and you can selectively [exclude content using `gradle-home-cache-exclude`](#gradle-user-home-cache-tuning).
-
-#### Removing unused files from Gradle User Home before saving to cache
-
-The Gradle User Home directory has a tendency to grow over time. When you switch to a new Gradle wrapper version or upgrade a dependency version
-the old files are not automatically and immediately removed. While this can make sense in a local environment, in a GitHub Actions environment
-it can lead to ever-larger Gradle User Home cache entries being saved and restored.
-
-In order to avoid this situation, the `gradle-build-action` supports the `gradle-home-cache-cleanup` parameter. 
-When enabled, this feature will attempt to delete any files in the Gradle User Home that were not used by Gradle during the GitHub Actions workflow, 
-prior to saving the Gradle User Home to the GitHub Actions cache.
-
-Gradle Home cache cleanup is disabled by default.  You can enable this feature for the action as follows:
-```yaml
-gradle-home-cache-cleanup: true
-```
-
-## Saving build outputs
-
-By default, a GitHub Actions workflow using `gradle-build-action` will record the log output and any Build Scan links for your build,
-but any output files generated by the build will not be saved.
-
-To save selected files from your build execution, you can use the core [Upload-Artifact](https://github.com/actions/upload-artifact) action.
-For example:
-
-```yaml
-jobs:   
-  gradle:
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout project sources
-      uses: actions/checkout@v3
-    - name: Setup Gradle
-      uses: gradle/gradle-build-action@v2
-    - name: Run build with Gradle wrapper
-      run: ./gradlew build --scan
-    - name: Upload build reports
-      uses: actions/upload-artifact@v3
-      with:
-        name: build-reports
-        path: build/reports/
-```
-
-## Build scans
-
-If your build publishes a [build scan](https://gradle.com/build-scans/) the `gradle-build-action` action will:
-- Add a notice with the link to the GitHub Actions user interface
-- For each step that executes Gradle, adds the link to the published build scan as a Step output named `build-scan-url`.
-
-You can then use that link in subsequent actions of your workflow. For example:
-
-```yaml
-# .github/workflows/gradle-build-pr.yml
-name: Run Gradle on PRs
-on: pull_request
-jobs:
-  gradle:
-    runs-on: ubuntu-latest
-    steps:
-    - name: Checkout project sources
-      uses: actions/checkout@v3
-    - name: Setup Gradle
-      uses: gradle/gradle-build-action@v2
-    - name: Run build with Gradle wrapper
-      id: gradle
-      run: ./gradlew build --scan
-    - name: "Add build scan URL as PR comment"
-      uses: actions/github-script@v5
-      if: github.event_name == 'pull_request' && failure()
-      with:
-        github-token: ${{secrets.GITHUB_TOKEN}}
-        script: |
-          github.rest.issues.createComment({
-            issue_number: context.issue.number,
-            owner: context.repo.owner,
-            repo: context.repo.repo,
-            body: '❌ ${{ github.workflow }} failed: ${{ steps.gradle.outputs.build-scan-url }}'
-          })
-```
-
-Note that the build scan capturing utilizes the [Initialization Script](https://docs.gradle.org/current/userguide/init_scripts.html#sec:using_an_init_script)
-in the `USER_HOME/.gradle/init.d/` directory, with the file named `build-result-capture.init.gradle`.
-So, if you are using the init scripts for the [Gradle Enterprise Gradle Plugin](https://plugins.gradle.org/plugin/com.gradle.enterprise) like
-[`scans-init.gradle` or `gradle-enterprise-init.gradle`](https://docs.gradle.com/enterprise/gradle-plugin/#scans_gradle_com),
-make sure that its file names have earlier alphabetical order to the `build-result-capture.init.gradle`,
-since configuring capture requires Gradle Enterprise Gradle Plugin to be applied already.
-
 ## Support for GitHub Enterprise Server (GHES)
 
 You can use the `gradle-build-action` on GitHub Enterprise Server, and benefit from the improved integration with Gradle. Depending on the version of GHES you are running, certain features may be limited:
-- Build scan links are captured and displayed in the GitHub Actions UI
+- Build Scan links are captured and displayed in the GitHub Actions UI
 - Easily run your build with different versions of Gradle
 - Save/restore of Gradle User Home (requires GHES v3.5+ : GitHub Actions cache was introduced in GHES 3.5)
 - Support for GitHub Actions Job Summary (requires GHES 3.6+ : GitHub Actions Job Summary support was introduced in GHES 3.6). In earlier versions of GHES the build-results summary and caching report will be written to the workflow log, as part of the post-action step.
+
+# GitHub Dependency Graph support
+
+The `gradle-build-action` has support for submitting a [GitHub Dependency Graph](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/about-the-dependency-graph) snapshot via the [GitHub Dependency Submission API](https://docs.github.com/en/rest/dependency-graph/dependency-submission?apiVersion=2022-11-28).
+
+The dependency graph snapshot is generated via integration with the [GitHub Dependency Graph Gradle Plugin](https://plugins.gradle.org/plugin/org.gradle.github-dependency-graph-gradle-plugin), and saved as a workflow artifact. The generated snapshot files can be submitted either in the same job, or in a subsequent job (in the same or a dependent workflow).
+
+The generated dependency graph snapshot reports all of the dependencies that were resolved during a bulid execution, and is used by GitHub to generate [Dependabot Alerts](https://docs.github.com/en/code-security/dependabot/dependabot-alerts/about-dependabot-alerts) for vulnerable dependencies, as well as to populate the [Dependency Graph insights view](https://docs.github.com/en/code-security/supply-chain-security/understanding-your-software-supply-chain/exploring-the-dependencies-of-a-repository#viewing-the-dependency-graph).
+
+## Enable Dependency Graph generation for a workflow
+ 
+You enable GitHub Dependency Graph support by setting the `dependency-graph` action parameter. Valid values are:
+
+| Option | Behaviour |
+| --- | --- |
+| `disabled`            | Do not generate a dependency graph for any build invocations.<p>This is the default. |
+| `generate`            | Generate a dependency graph snapshot for each build invocation, saving as a workflow artifact. |
+| `generate-and-submit` | As per `generate`, but any generated dependency graph snapshots will be submitted at the end of the job. |
+| `download-and-submit` | Download any previously saved dependency graph snapshots, submitting them via the Dependency Submission API. This can be useful to collect all snapshots in a matrix of builds and submit them in one step. |
+
+Example of a simple workflow that generates and submits a dependency graph:
+```yaml
+name: Submit dependency graph
+on:
+  push:
+  
+permissions:
+  contents: write
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+    - name: Setup Gradle to generate and submit dependency graphs
+      uses: gradle/gradle-build-action@v2
+      with:
+        dependency-graph: generate-and-submit
+    - name: Run a build and generate the dependency graph which will be submitted post-job
+      run: ./gradlew build
+```
+
+The `contents: write` permission is not required to generate the dependency graph, but is required in order to submit the graph via the GitHub API. This permission will need to be explicitly enabled in the workflow file for dependency graph submission to succeed.
+
+> [!IMPORTANT]
+> The above configuration will work for workflows that run as a result of commits to a repository branch, 
+> but not when a workflow is triggered by a PR from a repository fork.
+> This is because the `contents: write` permission is not available when executing a workflow 
+> for a PR submitted from a forked repository.
+> For a configuration that supports this setup, see [Dependency Graphs for pull request workflows](#dependency-graphs-for-pull-request-workflows).
+
+### Integrating the `dependency-review-action`
+
+The GitHub [dependency-review-action](https://github.com/actions/dependency-review-action) helps you 
+understand dependency changes (and the security impact of these changes) for a pull request.
+For the `dependency-review-action` to succeed, it must run _after_ the dependency graph has been submitted for a PR.
+
+When using `generate-and-submit`, dependency graph files are submitted at the end of the job, after all steps have been
+executed. For this reason, the `dependency-review-action` must be executed in a dependent job,
+and not as a subsequent step in the job that generates the dependency graph.
+
+Example of a pull request workflow that executes a build for a pull request and runs the `dependency-review-action`:
+
+```yaml
+name: PR check
+
+on:
+  pull_request:
+  
+permissions:
+  contents: write
+  # Note that this permission will not be available if the PR is from a forked repository
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+    - name: Setup Gradle to generate and submit dependency graphs
+      uses: gradle/gradle-build-action@v2
+      with:
+        dependency-graph: generate-and-submit
+    - name: Run a build and generate the dependency graph which will be submitted post-job
+      run: ./gradlew build
+
+  dependency-review:
+    needs: build
+    runs-on: ubuntu-latest
+    - name: Perform dependency review
+      uses: actions/dependency-review-action@v3
+```
+
+See [Dependency Graphs for pull request workflows](#dependency-graphs-for-pull-request-workflows) for a more complex
+(and less functional) example that will work for pull requests submitted from forked repositories.
+
+## Limiting the scope of the dependency graph
+
+At times it is helpful to limit the dependencies reported to GitHub, in order to security alerts for dependencies that don't form a critical part of your product.
+For example, a vulnerability in the tool you use to generate documentation is unlikely to be as important as a vulnerability in one of your runtime dependencies.
+
+There are a number of techniques you can employ to limit the scope of the generated dependency graph:
+- [Don't generate a dependency graph for all Gradle executions](#choosing-which-gradle-invocations-will-generate-a-dependency-graph)
+- [For a Gradle execution, filter which Gradle projects and configurations will contribute dependencies](#filtering-which-gradle-configurations-contribute-to-the-dependency-graph)
+- [Use a separate workflow that only resolves the required dependencies](#use-a-dedicated-workflow-for-dependency-graph-generation)
+
+> [!NOTE]
+> Ideally, all dependencies involved in building and testing a project will be extracted and reported in a dependency graph. 
+> These dependencies would be assigned to different scopes (eg development, runtime, testing) and the GitHub UI would make it easy to opt-in to security alerts for different dependency scopes.
+> However, this functionality does not yet exist.
+
+### Choosing which Gradle invocations will generate a dependency graph
+
+Once you enable the dependency graph support for a workflow job (via the `dependency-graph` parameter), dependencies will be collected and reported for all subsequent Gradle invocations.
+If you have a Gradle build step that you want to exclude from dependency graph generation, you can set the `GITHUB_DEPENDENCY_GRAPH_ENABLED` environment variable to `false`.
+
+```yaml
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+    - name: Setup Gradle to generate and submit dependency graphs
+      uses: gradle/gradle-build-action@v2
+      with:
+        dependency-graph: generate-and-submit
+    - name: Build the app, generating a graph of dependencies required
+      run: ./gradlew :my-app:assemble
+    - name: Run all checks, disabling dependency graph generation
+      run: ./gradlew check
+      env:
+        GITHUB_DEPENDENCY_GRAPH_ENABLED: false
+```
+
+### Filtering which Gradle Configurations contribute to the dependency graph
+
+If you do not want the dependency graph to include every dependency configuration in every project in your build, you can limit the
+dependency extraction to a subset of these.
+
+To restrict which Gradle subprojects contribute to the report, specify which projects to include via a regular expression.
+You can provide this value via the `DEPENDENCY_GRAPH_INCLUDE_PROJECTS` environment variable or system property.
+
+To restrict which Gradle configurations contribute to the report, you can filter configurations by name using a regular expression.
+You can provide this value via the `DEPENDENCY_GRAPH_INCLUDE_CONFIGURATIONS` environment variable or system property.
+
+For example, if you want to exclude dependencies in the `buildSrc` project, and only report on dependencies from the `runtimeClasspath` configuration,
+you would use the following configuration:
+
+```yaml
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+    - name: Setup Gradle to generate and submit dependency graphs
+      uses: gradle/gradle-build-action@v2
+      with:
+        dependency-graph: generate-and-submit
+    - name: Run a build, generating the dependency graph from 'runtimeClasspath' configurations
+      run: ./gradlew build
+      env:
+        DEPENDENCY_GRAPH_INCLUDE_PROJECTS: "^:(?!buildSrc).*"
+        DEPENDENCY_GRAPH_INCLUDE_CONFIGURATIONS: runtimeClasspath
+```
+
+### Use a dedicated workflow for dependency graph generation
+
+Instead of generating a dependency graph from your existing CI workflow, it's possible to create a separate dedicated workflow (or Job) that is solely intended for generating a dependency graph.
+Such a workflow will still need to execute Gradle, but can do so in a way that is targeted at resolving exactly the dependencies required.
+
+For example, the following workflow will report only those dependencies that are part of the `runtimeClasspath` or the `my-app` project. 
+
+```yaml
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+    - name: Setup Gradle to generate and submit dependency graphs
+      uses: gradle/gradle-build-action@v2
+      with:
+        dependency-graph: generate-and-submit
+    - name: Extract the 'runtimeClasspath' dependencies for 'my-app'
+      run: ./gradlew :my-app:dependencies --configuration runtimeClasspath
+```
+
+Note that the above example will also include `buildSrc` dependencies, since these are resolved as part of running the `dependencies` task.
+If this isn't desirable, you will still need to use the filtering mechanism described above.
+
+## Dependency Graphs for pull request workflows
+
+This `contents: write` permission is not available for any workflow that is triggered by a pull request submitted from a forked repository, since it would permit a malicious pull request to make repository changes. 
+
+Because of this restriction, it is not possible to `generate-and-submit` a dependency graph generated for a pull-request that comes from a repository fork. In order to do so, 2 workflows will be required:
+1. The first workflow runs directly against the pull request sources and will generate the dependency graph snapshot.
+2. The second workflow is triggered on `workflow_run` of the first workflow, and will submit the previously saved dependency snapshots.
+
+Note: when `download-and-submit` is used in a workflow triggered via [workflow_run](https://docs.github.com/en/actions/using-workflows/events-that-trigger-workflows#workflow_run), the action will download snapshots saved in the triggering workflow.
+
+***Main workflow file***
+```yaml
+name: run-build-and-generate-dependency-snapshot
+
+on:
+  pull_request:
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+    - name: Setup Gradle to generate and submit dependency graphs
+      uses: gradle/gradle-build-action@v2
+      with:
+        dependency-graph: generate # Only generate in this job
+    - name: Run a build, generating the dependency graph snapshot which will be submitted
+      run: ./gradlew build
+
+  dependency-review:
+    needs: build
+    runs-on: ubuntu-latest
+    - name: Perform dependency review
+      uses: actions/dependency-review-action@v3
+      
+```
+
+***Dependent workflow file***
+```yaml
+name: submit-dependency-snapshot
+
+on:
+  workflow_run:
+    workflows: ['run-build-and-generate-dependency-snapshot']
+    types: [completed]
+
+jobs:
+  submit-dependency-graph:
+    runs-on: ubuntu-latest
+    steps:
+    - name: Retrieve dependency graph artifact and submit
+      uses: gradle/gradle-build-action@v2
+      with:
+        dependency-graph: download-and-submit
+```
+
+### Integrating `dependency-review-action` for pull request workflows
+
+The GitHub [dependency-review-action](https://github.com/actions/dependency-review-action) helps you 
+understand dependency changes (and the security impact of these changes) for a pull request.
+
+To integrate the `dependency-review-action` into the pull request workflows above, a separate workflow should be added.
+This workflow will be triggered directly on `pull_request`, but will need to wait until the dependency graph results are
+submitted before the dependency review can complete. How long to wait is controlled by the `retry-on-snapshot-warnings` input parameters.
+
+Here's an example of a separate "Dependency Review" workflow that will wait for 10 minutes for the PR check workflow to complete.
+
+```yaml
+name: dependency-review
+on:
+  pull_request:
+
+permissions:
+  contents: read
+  pull-requests: write
+
+jobs:
+  dependency-review:
+    runs-on: ubuntu-latest
+    steps:
+    - name: 'Dependency Review'
+      uses: actions/dependency-review-action@v3
+      with:
+        retry-on-snapshot-warnings: true
+        retry-on-snapshot-warnings-timeout: 600
+```
+
+The `retry-on-snapshot-warnings-timeout` (in seconds) needs to be long enough to allow the entire `run-build-and-generate-dependency-snapshot` and `submit-dependency-snapshot` workflows (above) to complete.
+
+## Gradle version compatibility
+
+The GitHub Dependency Graph plugin should be compatible with all versions of Gradle >= 5.0, and has been tested against 
+Gradle versions "5.6.4", "6.9.4", "7.0.2", "7.6.2", "8.0.2" and the current Gradle release.
+
+The plugin is compatible with running Gradle with the configuration-cache enabled. However, this support is
+limited to Gradle "8.1.0" and later:
+- With Gradle "8.0", the build should run successfully, but an empty dependency graph will be generated.
+- With Gradle <= "7.6.4", the plugin will cause the build to fail with configuration-cache enabled.
+
+To use this plugin with versions of Gradle older than "8.1.0", you'll need to invoke Gradle with the
+configuration-cache disabled.
+
+# Gradle Enterprise plugin injection
+
+The `gradle-build-action` provides support for injecting and configuring the Gradle Enterprise Gradle plugin into any Gradle build, without any modification to the project sources.
+This is achieved via an init-script installed into Gradle User Home, which is enabled and parameterized via environment variables.
+
+The same auto-injection behavior is available for the Common Custom User Data Gradle plugin, which enriches any build scans published with additional useful information.
+
+## Enabling Gradle Enterprise injection
+
+In order to enable Gradle Enterprise for your build, you must provide the required configuration via environment variables. 
+
+Here's a minimal example:
+
+```yaml
+name: Run build with Gradle Enterprise injection
+  
+env:
+  GRADLE_ENTERPRISE_INJECTION_ENABLED: true
+  GRADLE_ENTERPRISE_URL: https://ge.gradle.org
+  GRADLE_ENTERPRISE_PLUGIN_VERSION: 3.15
+  GRADLE_ENTERPRISE_ACCESS_KEY: ${{ secrets.GE_ACCESS_KEY }} # Required to publish scans to ge.gradle.org
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v3
+    - name: Setup Gradle
+      uses: gradle/gradle-build-action@v2
+    - name: Run a Gradle build with Gradle Enterprise injection enabled
+      run: ./gradlew build
+```
+
+This configuration will automatically apply `v3.15` of the [Gradle Enterprise Gradle plugin](https://docs.gradle.com/enterprise/gradle-plugin/), and publish build scans to https://ge.gradle.org.
+
+Note that the `ge.gradle.org` server requires authentication in order to publish scans. The provided `GRADLE_ENTERPRISE_ACCESS_KEY` isn't required by the Gradle Enterprise injection script, 
+but will be used by the GE plugin in order to authenticate with the server.
+
+## Configuring Gradle Enterprise injection
+
+The `init-script` supports a number of additional configuration parameters that you may fine useful. All configuration options (required and optional) are detailed below:
+
+| Variable | Required | Description |
+| --- | --- | --- |
+| GRADLE_ENTERPRISE_INJECTION_ENABLED | :white_check_mark: | enables Gradle Enterprise injection |
+| GRADLE_ENTERPRISE_URL | :white_check_mark: | the URL of the Gradle Enterprise server |
+| GRADLE_ENTERPRISE_ALLOW_UNTRUSTED_SERVER | | allow communication with an untrusted server; set to _true_ if your Gradle Enterprise instance is using a self-signed certificate |
+| GRADLE_ENTERPRISE_ENFORCE_URL | | enforce the configured Gradle Enterprise URL over a URL configured in the project's build; set to _true_ to enforce publication of build scans to the configured Gradle Enterprise URL |
+| GRADLE_ENTERPRISE_PLUGIN_VERSION | :white_check_mark: | the version of the [Gradle Enterprise Gradle plugin](https://docs.gradle.com/enterprise/gradle-plugin/) to apply |
+| GRADLE_ENTERPRISE_CCUD_PLUGIN_VERSION |  | the version of the [Common Custom User Data Gradle plugin](https://github.com/gradle/common-custom-user-data-gradle-plugin) to apply, if any |
+| GRADLE_ENTERPRISE_PLUGIN_REPOSITORY_URL |  | the URL of the repository to use when resolving the GE and CCUD plugins; the Gradle Plugin Portal is used by default |
+
+## Publishing to scans.gradle.com
+
+Gradle Enterprise injection is designed to enable publishing of build scans to a Gradle Enterprise instance,
+and is not suitable for publishing to the public Build Scans instance (https://scans.gradle.com).
+
+In order to publish Build Scans to scans.gradle.com, you need to:
+- Apply the Gradle Enterprise plugin to your build configuration ([see docs](https://docs.gradle.com/enterprise/get-started/#applying_the_plugin))
+- Programmatically accept the Terms of Service for scans.gradle.com ([see docs](https://docs.gradle.com/enterprise/gradle-plugin/#connecting_to_scans_gradle_com))
+- Execute the build with `--scan` or configure your build with `publishAlways()` ([see docs](https://docs.gradle.com/enterprise/get-started/#always_publishing_a_build_scan))
+

action.yml

@@ -1,11 +1,19 @@
 name: "Gradle Build Action"
-description: 'Configures Gradle for use in GitHub actions, caching useful state in the GitHub actions cache'
+description: 'Configures Gradle for GitHub actions, caching state and generating a dependency graph via Dependency Submission.'
 
 # https://help.github.com/en/articles/metadata-syntax-for-github-actions
 
 inputs:
   gradle-version:
-    description: Gradle version to use
+    description: Gradle version to use. If specified, this Gradle version will be downloaded, added to the PATH and used for invoking Gradle.
+    required: false
+
+  gradle-executable:
+    description: Path to the Gradle executable. If specified, this executable will be added to the PATH and used for invoking Gradle.
+    required: false
+
+  build-root-directory:
+    description: Path to the root directory of the build. Default is the root of the GitHub workspace.
     required: false
 
   cache-disabled:
@@ -27,6 +35,11 @@ inputs:
     required: false
     default: false
 
+  cache-overwrite-existing:
+    description: When 'true', a pre-existing Gradle User Home will not prevent the cache from being restored.
+    required: false
+    default: false
+
   gradle-home-cache-includes:
     description: Paths within Gradle User Home to cache.
     required: false
@@ -45,19 +58,16 @@ inputs:
     description: Gradle command line arguments (supports multi-line input)
     required: false
 
-  build-root-directory:
-    description: Path to the root directory of the build
-    required: false
-
-  gradle-executable:
-    description: Path to the Gradle executable
-    required: false
-
   generate-job-summary:
     description: When 'false', no Job Summary will be generated for the Job.
     required: false
     default: true
 
+  dependency-graph:
+    description: Specifies if a GitHub dependency snapshot should be generated for each Gradle build, and if so, how. Valid values are 'disabled' (default), 'generate', 'generate-and-submit' and 'download-and-submit'.
+    required: false
+    default: 'disabled'
+
   # EXPERIMENTAL & INTERNAL ACTION INPUTS
   # The following action properties allow fine-grained tweaking of the action caching behaviour.
   # These properties are experimental and not (yet) designed for production use, and may change without notice in a subsequent release of `gradle-build-action`.
@@ -75,9 +85,18 @@ inputs:
     required: false
     default: false
 
+  github-token:
+    description: The GitHub token used to authenticate when submitting via the Dependency Submission API.
+    default: ${{ github.token }}
+    required: false
+
 outputs:
   build-scan-url:
-    description: Link to the build scan if any
+    description: Link to the Build Scan® generated by a Gradle build. Note that this output applies to a Step executing Gradle, not to the `gradle-build-action` Step itself.
+  dependency-graph-file:
+    description: Path to the GitHub Dependency Graph snapshot file generated by a Gradle build. Note that this output applies to a Step executing Gradle, not to the `gradle-build-action` Step itself.
+  gradle-version:
+    description: Version of Gradle that was setup by the action
 
 runs:
   using: 'node16'

actions/clear-dependency-graph/action.yml

@@ -0,0 +1,24 @@
+name: 'Clear dependency graph for a correlator'
+
+inputs:
+  job-correlator:
+    required: true
+
+runs:
+  using: "composite"
+  steps:
+  - name: Set current timestamp as env variable
+    shell: bash
+    run: echo "NOW=$(date -Iseconds)" >> $GITHUB_ENV
+  - name: Submit empty dependency graph
+    shell: bash
+    run: |
+      curl -L \
+      -X POST \
+      -H "Accept: application/vnd.github+json" \
+      -H "Authorization: Bearer ${{ github.token }}" \
+      -H "X-GitHub-Api-Version: 2022-11-28" \
+      https://api.github.com/repos/${{ github.repository }}/dependency-graph/snapshots \
+      -d '{ "version" : 0, "job" : { "id" : "${{ github.run_id }}", "correlator" : "${{ inputs.job-correlator }} " }, "sha" : "${{ github.sha }}", "ref" : "${{ github.ref }}",  "detector" : { "name" : "GitHub Dependency Graph Gradle Plugin", "version" : "0.0.3", "url" : "https://github.com/gradle/github-dependency-graph-gradle-plugin" }, "manifests" : {}, "scanned" : "${{ env.NOW }}" }'
+  - run: echo "::notice ::Cleared dependency graph for job correlator '${{ inputs.job-correlator }}'"
+    shell: bash

package.json

@@ -8,7 +8,11 @@
     "format": "prettier --write **/*.ts",
     "format-check": "prettier --check **/*.ts",
     "lint": "eslint src/**/*.ts",
-    "compile": "ncc build src/main.ts --out dist/main --source-map --no-source-map-register && ncc build src/post.ts --out dist/post --source-map --no-source-map-register",
+
+    "compile-main": "ncc build src/main.ts --out dist/main --source-map --no-source-map-register",
+    "compile-post": "ncc build src/post.ts --out dist/post --source-map --no-source-map-register",
+    "compile": "npm run compile-main && npm run compile-post",
+
     "test": "jest",
     "check": "npm run format && npm run lint",
     "build": "npm run check && npm run compile",
@@ -26,29 +30,33 @@
   ],
   "license": "MIT",
   "dependencies": {
-    "@actions/cache": "3.1.3",
-    "@actions/core": "1.10.0",
+    "@actions/artifact": "1.1.2",
+    "@actions/cache": "3.2.2",
+    "@actions/core": "1.10.1",
     "@actions/exec": "1.1.1",
     "@actions/github": "5.1.1",
     "@actions/glob": "0.4.0",
-    "@actions/http-client": "2.0.1",
+    "@actions/http-client": "2.1.1",
     "@actions/tool-cache": "2.0.1",
-    "string-argv": "0.3.1"
+    "@octokit/rest": "19.0.13",
+    "@octokit/webhooks-types": "7.3.1",
+    "string-argv": "0.3.2"
   },
   "devDependencies": {
-    "@types/jest": "28.1.7",
-    "@types/node": "16.11.21",
-    "@types/unzipper": "0.10.5",
-    "@typescript-eslint/parser": "5.52.0",
-    "@vercel/ncc": "0.36.1",
-    "eslint": "8.34.0",
-    "eslint-plugin-github": "4.6.0",
-    "eslint-plugin-jest": "27.2.1",
-    "jest": "28.1.3",
+    "@types/node": "16.18.38",
+    "@types/jest": "29.5.5",
+    "@types/unzipper": "0.10.7",
+    "@typescript-eslint/parser": "6.7.3",
+    "@vercel/ncc": "0.38.0",
+    "eslint": "8.50.0",
+    "eslint-plugin-github": "4.10.0",
+    "eslint-plugin-jest": "27.4.0",
+    "eslint-plugin-prettier": "5.0.0",
+    "jest": "29.7.0",
     "js-yaml": "4.1.0",
-    "patch-package": "6.5.1",
-    "prettier": "2.8.4",
-    "ts-jest": "28.0.8",
-    "typescript": "4.9.5"
+    "patch-package": "8.0.0",
+    "prettier": "3.0.3",
+    "ts-jest": "29.1.1",
+    "typescript": "5.2.2"
   }
 }

patches/@actions+cache+3.2.2.patch

@@ -26,23 +26,12 @@ index 4658366..b796e58 100644
 +    constructor(key: string, size?: number);
 +}
 diff --git a/node_modules/@actions/cache/lib/cache.js b/node_modules/@actions/cache/lib/cache.js
-index 0fa9df3..5f0b173 100644
+index 9d636aa..a176bd7 100644
 --- a/node_modules/@actions/cache/lib/cache.js
 +++ b/node_modules/@actions/cache/lib/cache.js
-@@ -97,26 +97,18 @@ function restoreCache(paths, primaryKey, restoreKeys, options, enableCrossOsArch
-             }
-             archivePath = path.join(yield utils.createTempDirectory(), utils.getCacheFileName(compressionMethod));
-             core.debug(`Archive Path: ${archivePath}`);
-+            const restoredEntry = new CacheEntry(cacheEntry.cacheKey);
-             // Download the cache from the cache entry
-             yield cacheHttpClient.downloadCache(cacheEntry.archiveLocation, archivePath, options);
-             if (core.isDebug()) {
-                 yield tar_1.listTar(archivePath, compressionMethod);
-             }
-             const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath);
-+            restoredEntry.size = archiveFileSize;
+@@ -127,18 +127,21 @@ function restoreCache(paths, primaryKey, restoreKeys, options, enableCrossOsArch
              core.info(`Cache Size: ~${Math.round(archiveFileSize / (1024 * 1024))} MB (${archiveFileSize} B)`);
-             yield tar_1.extractTar(archivePath, compressionMethod);
+             yield (0, tar_1.extractTar)(archivePath, compressionMethod);
              core.info('Cache restored successfully');
 -            return cacheEntry.cacheKey;
 -        }
@@ -55,29 +44,31 @@ index 0fa9df3..5f0b173 100644
 -                // Supress all non-validation cache related errors because caching should be optional
 -                core.warning(`Failed to restore: ${error.message}`);
 -            }
-+            return restoredEntry;
++
++            // PATCHED - Return more inforamtion about restored entry
++            return new CacheEntry(cacheEntry.cacheKey, archiveFileSize);;
          }
++        // PATCHED - propagate errors
++        // catch (error) {
++        //     const typedError = error;
++        //     if (typedError.name === ValidationError.name) {
++        //         throw error;
++        //     }
++        //     else {
++        //         // Supress all non-validation cache related errors because caching should be optional
++        //         core.warning(`Failed to restore: ${error.message}`);
++        //     }
++        // }
          finally {
              // Try to delete the archive to save space
-@@ -156,6 +148,7 @@ function saveCache(paths, key, options, enableCrossOsArchive = false) {
-         const archiveFolder = yield utils.createTempDirectory();
-         const archivePath = path.join(archiveFolder, utils.getCacheFileName(compressionMethod));
-         core.debug(`Archive Path: ${archivePath}`);
-+        const savedEntry = new CacheEntry(key);
              try {
-             yield tar_1.createTar(archiveFolder, cachePaths, compressionMethod);
-             if (core.isDebug()) {
-@@ -163,6 +156,7 @@ function saveCache(paths, key, options, enableCrossOsArchive = false) {
+@@ -206,19 +209,23 @@ function saveCache(paths, key, options, enableCrossOsArchive = false) {
              }
-             const fileSizeLimit = 10 * 1024 * 1024 * 1024; // 10GB per repo limit
-             const archiveFileSize = utils.getArchiveFileSizeInBytes(archivePath);
-+            savedEntry.size = archiveFileSize;
-             core.debug(`File Size: ${archiveFileSize}`);
-             // For GHES, this check will take place in ReserveCache API with enterprise file size limit
-             if (archiveFileSize > fileSizeLimit && !utils.isGhes()) {
-@@ -186,18 +180,6 @@ function saveCache(paths, key, options, enableCrossOsArchive = false) {
              core.debug(`Saving Cache (ID: ${cacheId})`);
              yield cacheHttpClient.saveCache(cacheId, archivePath, options);
++
++            // PATCHED - Return more inforamtion about saved entry
++            return new CacheEntry(key, archiveFileSize);
          }
 -        catch (error) {
 -            const typedError = error;
@@ -91,15 +82,23 @@ index 0fa9df3..5f0b173 100644
 -                core.warning(`Failed to save: ${typedError.message}`);
 -            }
 -        }
++        // PATCHED - propagate errors
++        // catch (error) {
++        //     const typedError = error;
++        //     if (typedError.name === ValidationError.name) {
++        //         throw error;
++        //     }
++        //     else if (typedError.name === ReserveCacheError.name) {
++        //         core.info(`Failed to save: ${typedError.message}`);
++        //     }
++        //     else {
++        //         core.warning(`Failed to save: ${typedError.message}`);
++        //     }
++        // }
          finally {
              // Try to delete the archive to save space
              try {
-@@ -207,8 +189,15 @@ function saveCache(paths, key, options, enableCrossOsArchive = false) {
-                 core.debug(`Failed to delete archive: ${error}`);
-             }
-         }
--        return cacheId;
-+        return savedEntry;
+@@ -232,4 +239,11 @@ function saveCache(paths, key, options, enableCrossOsArchive = false) {
      });
  }
  exports.saveCache = saveCache;

patches/@azure+logger+1.0.4.patch

@@ -1,8 +1,18 @@
-# Patch removes logging of the AZURE_LOG_LEVEL env var value
-# This logging triggers a high severity Warning from CodeQL, which can prevent organizational users from adopting the action.
-
+diff --git a/node_modules/@azure/logger/dist-esm/src/debug.js b/node_modules/@azure/logger/dist-esm/src/debug.js
+index d202779..30e8313 100644
+--- a/node_modules/@azure/logger/dist-esm/src/debug.js
++++ b/node_modules/@azure/logger/dist-esm/src/debug.js
+@@ -7,7 +7,7 @@ let enabledNamespaces = [];
+ let skippedNamespaces = [];
+ const debuggers = [];
+ if (debugEnvVariable) {
+-    enable(debugEnvVariable);
++    // enable(debugEnvVariable);
+ }
+ const debugObj = Object.assign((namespace) => {
+     return createDebugger(namespace);
 diff --git a/node_modules/@azure/logger/dist-esm/src/index.js b/node_modules/@azure/logger/dist-esm/src/index.js
-index 116b59e..cf87f3c 100644
+index cc25720..2925db5 100644
 --- a/node_modules/@azure/logger/dist-esm/src/index.js
 +++ b/node_modules/@azure/logger/dist-esm/src/index.js
 @@ -20,7 +20,7 @@ if (logLevelFromEnv) {
@@ -15,10 +25,19 @@ index 116b59e..cf87f3c 100644
  }
  /**
 diff --git a/node_modules/@azure/logger/dist/index.js b/node_modules/@azure/logger/dist/index.js
-index 327fbdb..4432d73 100644
+index 81e97c3..a415e2f 100644
 --- a/node_modules/@azure/logger/dist/index.js
 +++ b/node_modules/@azure/logger/dist/index.js
-@@ -122,7 +122,7 @@ if (logLevelFromEnv) {
+@@ -21,7 +21,7 @@ let enabledNamespaces = [];
+ let skippedNamespaces = [];
+ const debuggers = [];
+ if (debugEnvVariable) {
+-    enable(debugEnvVariable);
++    // enable(debugEnvVariable);
+ }
+ const debugObj = Object.assign((namespace) => {
+     return createDebugger(namespace);
+@@ -125,7 +125,7 @@ if (logLevelFromEnv) {
          setLogLevel(logLevelFromEnv);
      }
      else {

src/cache-base.ts

@@ -2,15 +2,14 @@ import * as core from '@actions/core'
 import * as exec from '@actions/exec'
 import path from 'path'
 import fs from 'fs'
+import * as params from './input-params'
 import {CacheListener} from './cache-reporting'
 import {saveCache, restoreCache, cacheDebug, isCacheDebuggingEnabled, tryDelete, generateCacheKey} from './cache-utils'
-import {ConfigurationCacheEntryExtractor, GradleHomeEntryExtractor} from './cache-extract-entries'
+import {GradleHomeEntryExtractor} from './cache-extract-entries'
 
 const RESTORED_CACHE_KEY_KEY = 'restored-cache-key'
 
 export const META_FILE_DIR = '.gradle-build-action'
-const INCLUDE_PATHS_PARAMETER = 'gradle-home-cache-includes'
-const EXCLUDE_PATHS_PARAMETER = 'gradle-home-cache-excludes'
 
 export class GradleStateCache {
     private cacheName: string
@@ -80,7 +79,7 @@ export class GradleStateCache {
     async afterRestore(listener: CacheListener): Promise<void> {
         await this.debugReportGradleUserHomeSize('as restored from cache')
         await new GradleHomeEntryExtractor(this.gradleUserHome).restore(listener)
-        await new ConfigurationCacheEntryExtractor(this.gradleUserHome).restore(listener)
+        // await new ConfigurationCacheEntryExtractor(this.gradleUserHome).restore(listener)
         await this.debugReportGradleUserHomeSize('after restoring common artifacts')
     }
 
@@ -130,8 +129,8 @@ export class GradleStateCache {
         await this.debugReportGradleUserHomeSize('before saving common artifacts')
         this.deleteExcludedPaths()
         await Promise.all([
-            new GradleHomeEntryExtractor(this.gradleUserHome).extract(listener),
-            new ConfigurationCacheEntryExtractor(this.gradleUserHome).extract(listener)
+            new GradleHomeEntryExtractor(this.gradleUserHome).extract(listener)
+            // new ConfigurationCacheEntryExtractor(this.gradleUserHome).extract(listener)
         ])
         await this.debugReportGradleUserHomeSize(
             "after extracting common artifacts (only 'caches' and 'notifications' will be stored)"
@@ -142,7 +141,7 @@ export class GradleStateCache {
      * Delete any file paths that are excluded by the `gradle-home-cache-excludes` parameter.
      */
     private deleteExcludedPaths(): void {
-        const rawPaths: string[] = core.getMultilineInput(EXCLUDE_PATHS_PARAMETER)
+        const rawPaths: string[] = params.getCacheExcludes()
         const resolvedPaths = rawPaths.map(x => path.resolve(this.gradleUserHome, x))
 
         for (const p of resolvedPaths) {
@@ -157,7 +156,7 @@ export class GradleStateCache {
      * but this can be overridden by the `gradle-home-cache-includes` parameter.
      */
     protected getCachePath(): string[] {
-        const rawPaths: string[] = core.getMultilineInput(INCLUDE_PATHS_PARAMETER)
+        const rawPaths: string[] = params.getCacheIncludes()
         rawPaths.push(META_FILE_DIR)
         const resolvedPaths = rawPaths.map(x => this.resolveCachePath(x))
         cacheDebug(`Using cache paths: ${resolvedPaths}`)
@@ -173,7 +172,29 @@ export class GradleStateCache {
     }
 
     private initializeGradleUserHome(gradleUserHome: string, initScriptsDir: string): void {
-        const initScriptFilenames = ['build-result-capture.init.gradle', 'build-result-capture-service.plugin.groovy']
+        // Ensure that pre-installed java versions are detected. Only add property if it isn't already defined.
+        const gradleProperties = path.resolve(gradleUserHome, 'gradle.properties')
+        const existingGradleProperties = fs.existsSync(gradleProperties)
+            ? fs.readFileSync(gradleProperties, 'utf8')
+            : ''
+        if (!existingGradleProperties.includes('org.gradle.java.installations.fromEnv=')) {
+            fs.appendFileSync(
+                gradleProperties,
+                `
+# Auto-detect pre-installed JDKs
+org.gradle.java.installations.fromEnv=JAVA_HOME_8_X64,JAVA_HOME_11_X64,JAVA_HOME_17_X64
+`
+            )
+        }
+
+        // Copy init scripts from src/resources
+        const initScriptFilenames = [
+            'gradle-build-action.build-result-capture.init.gradle',
+            'gradle-build-action.build-result-capture-service.plugin.groovy',
+            'gradle-build-action.github-dependency-graph.init.gradle',
+            'gradle-build-action.github-dependency-graph-gradle-plugin-apply.groovy',
+            'gradle-build-action.inject-gradle-enterprise.init.gradle'
+        ]
         for (const initScriptFilename of initScriptFilenames) {
             const initScriptContent = this.readInitScriptAsString(initScriptFilename)
             const initScriptPath = path.resolve(initScriptsDir, initScriptFilename)

src/cache-cleaner.ts

@@ -42,13 +42,14 @@ export class CacheCleaner {
         )
         fs.writeFileSync(path.resolve(cleanupProjectDir, 'build.gradle'), 'task("noop") {}')
 
-        await exec.exec(`gradle -g ${this.gradleUserHome} --no-daemon --build-cache --no-scan --quiet noop`, [], {
+        const gradleCommand = `gradle -g ${this.gradleUserHome} --no-daemon --build-cache --no-scan --quiet -DGITHUB_DEPENDENCY_GRAPH_ENABLED=false noop`
+        await exec.exec(gradleCommand, [], {
             cwd: cleanupProjectDir
         })
     }
 
     private async ageAllFiles(fileName = '*'): Promise<void> {
-        core.debug(`Aging all files in Gradle User Homee with name ${fileName}`)
+        core.debug(`Aging all files in Gradle User Home with name ${fileName}`)
         await this.setUtimes(`${this.gradleUserHome}/**/${fileName}`, new Date(0))
     }
 

src/cache-extract-entries.ts

@@ -3,17 +3,11 @@ import fs from 'fs'
 import * as core from '@actions/core'
 import * as glob from '@actions/glob'
 
+import * as params from './input-params'
+
 import {META_FILE_DIR} from './cache-base'
 import {CacheEntryListener, CacheListener} from './cache-reporting'
-import {
-    cacheDebug,
-    getCacheKeyPrefix,
-    hashFileNames,
-    isCacheDebuggingEnabled,
-    restoreCache,
-    saveCache,
-    tryDelete
-} from './cache-utils'
+import {cacheDebug, getCacheKeyPrefix, hashFileNames, restoreCache, saveCache, tryDelete} from './cache-utils'
 import {loadBuildResults} from './build-results'
 
 const SKIP_RESTORE_VAR = 'GRADLE_BUILD_ACTION_SKIP_RESTORE'
@@ -246,7 +240,7 @@ abstract class AbstractEntryExtractor {
 
     // Run actions sequentially if debugging is enabled
     private async awaitForDebugging(p: Promise<ExtractedCacheEntry>): Promise<ExtractedCacheEntry> {
-        if (isCacheDebuggingEnabled()) {
+        if (params.isCacheDebuggingEnabled()) {
             await p
         }
         return p

src/cache-reporting.ts

@@ -10,6 +10,7 @@ export class CacheListener {
     cacheReadOnly = false
     cacheWriteOnly = false
     cacheDisabled = false
+    cacheDisabledReason = 'disabled'
 
     get fullyRestored(): boolean {
         return this.cacheEntries.every(x => !x.wasRequestedButNotRestored())
@@ -17,7 +18,7 @@ export class CacheListener {
 
     get cacheStatus(): string {
         if (!cache.isFeatureAvailable()) return 'not available'
-        if (this.cacheDisabled) return 'disabled'
+        if (this.cacheDisabled) return this.cacheDisabledReason
         if (this.cacheWriteOnly) return 'write-only'
         if (this.cacheReadOnly) return 'read-only'
         return 'enabled'

src/cache-utils.ts

@@ -7,17 +7,11 @@ import * as crypto from 'crypto'
 import * as path from 'path'
 import * as fs from 'fs'
 
+import * as params from './input-params'
+
 import {CacheEntryListener} from './cache-reporting'
 
-const CACHE_PROTOCOL_VERSION = 'v6-'
-
-const JOB_CONTEXT_PARAMETER = 'workflow-job-context'
-const CACHE_DISABLED_PARAMETER = 'cache-disabled'
-const CACHE_READONLY_PARAMETER = 'cache-read-only'
-const CACHE_WRITEONLY_PARAMETER = 'cache-write-only'
-const STRICT_CACHE_MATCH_PARAMETER = 'gradle-home-cache-strict-match'
-const CACHE_CLEANUP_ENABLED_PARAMETER = 'gradle-home-cache-cleanup'
-const CACHE_DEBUG_VAR = 'GRADLE_BUILD_ACTION_CACHE_DEBUG_ENABLED'
+const CACHE_PROTOCOL_VERSION = 'v8-'
 
 const CACHE_KEY_PREFIX_VAR = 'GRADLE_BUILD_ACTION_CACHE_KEY_PREFIX'
 const CACHE_KEY_OS_VAR = 'GRADLE_BUILD_ACTION_CACHE_KEY_ENVIRONMENT'
@@ -32,23 +26,27 @@ export function isCacheDisabled(): boolean {
     if (!cache.isFeatureAvailable()) {
         return true
     }
-    return core.getBooleanInput(CACHE_DISABLED_PARAMETER)
+    return params.isCacheDisabled()
 }
 
 export function isCacheReadOnly(): boolean {
-    return !isCacheWriteOnly() && core.getBooleanInput(CACHE_READONLY_PARAMETER)
+    return !isCacheWriteOnly() && params.isCacheReadOnly()
 }
 
 export function isCacheWriteOnly(): boolean {
-    return core.getBooleanInput(CACHE_WRITEONLY_PARAMETER)
+    return params.isCacheWriteOnly()
+}
+
+export function isCacheOverwriteExisting(): boolean {
+    return params.isCacheOverwriteExisting()
 }
 
 export function isCacheDebuggingEnabled(): boolean {
-    return process.env[CACHE_DEBUG_VAR] ? true : false
+    return params.isCacheDebuggingEnabled()
 }
 
 export function isCacheCleanupEnabled(): boolean {
-    return core.getBooleanInput(CACHE_CLEANUP_ENABLED_PARAMETER)
+    return params.isCacheCleanupEnabled()
 }
 
 /**
@@ -72,7 +70,7 @@ export class CacheKey {
  * - The cache protocol version
  * - The name of the cache
  * - The runner operating system
- * - The name of the Job being executed
+ * - The name of the workflow and Job being executed
  * - The matrix values for the Job being executed (job context)
  * - The SHA of the commit being executed
  *
@@ -97,7 +95,7 @@ export function generateCacheKey(cacheName: string): CacheKey {
     // Exact match on Git SHA
     const cacheKey = `${cacheKeyForJobContext}-${getCacheKeyJobExecution()}`
 
-    if (core.getBooleanInput(STRICT_CACHE_MATCH_PARAMETER)) {
+    if (params.isCacheStrictMatch()) {
         return new CacheKey(cacheKey, [cacheKeyForJobContext])
     }
 
@@ -115,8 +113,12 @@ function getCacheKeyEnvironment(): string {
 }
 
 function getCacheKeyJob(): string {
-    // Prefix can be used to force change all cache keys (defaults to cache protocol version)
-    return process.env[CACHE_KEY_JOB_VAR] || github.context.job
+    return process.env[CACHE_KEY_JOB_VAR] || getCacheKeyForJob(github.context.workflow, github.context.job)
+}
+
+export function getCacheKeyForJob(workflowName: string, jobId: string): string {
+    const sanitizedWorkflow = workflowName.replace(/,/g, '').toLowerCase()
+    return `${sanitizedWorkflow}-${jobId}`
 }
 
 function getCacheKeyJobInstance(): string {
@@ -127,10 +129,25 @@ function getCacheKeyJobInstance(): string {
 
     // By default, we hash the full `matrix` data for the run, to uniquely identify this job invocation
     // The only way we can obtain the `matrix` data is via the `workflow-job-context` parameter in action.yml.
-    const workflowJobContext = core.getInput(JOB_CONTEXT_PARAMETER)
+    const workflowJobContext = params.getJobMatrix()
     return hashStrings([workflowJobContext])
 }
 
+export function getUniqueLabelForJobInstance(): string {
+    return getUniqueLabelForJobInstanceValues(github.context.workflow, github.context.job, params.getJobMatrix())
+}
+
+export function getUniqueLabelForJobInstanceValues(workflow: string, jobId: string, matrixJson: string): string {
+    const matrix = JSON.parse(matrixJson)
+    const matrixString = Object.values(matrix).join('-')
+    const label = matrixString ? `${workflow}-${jobId}-${matrixString}` : `${workflow}-${jobId}`
+    return sanitize(label)
+}
+
+function sanitize(value: string): string {
+    return value.replace(/[^a-zA-Z0-9_-]/g, '').toLowerCase()
+}
+
 function getCacheKeyJobExecution(): string {
     // Used to associate a cache key with a particular execution (default is bound to the git commit sha)
     return process.env[CACHE_KEY_JOB_EXECUTION_VAR] || github.context.sha

src/caches.ts

@@ -1,5 +1,11 @@
 import * as core from '@actions/core'
-import {isCacheCleanupEnabled, isCacheDisabled, isCacheReadOnly, isCacheWriteOnly} from './cache-utils'
+import {
+    isCacheCleanupEnabled,
+    isCacheDisabled,
+    isCacheReadOnly,
+    isCacheWriteOnly,
+    isCacheOverwriteExisting
+} from './cache-utils'
 import {CacheListener} from './cache-reporting'
 import {DaemonController} from './daemon-controller'
 import {GradleStateCache} from './cache-base'
@@ -26,11 +32,16 @@ export async function restore(gradleUserHome: string, cacheListener: CacheListen
     }
 
     if (gradleStateCache.cacheOutputExists()) {
+        if (!isCacheOverwriteExisting()) {
             core.info('Gradle User Home already exists: will not restore from cache.')
             // Initialize pre-existing Gradle User Home.
             gradleStateCache.init()
+            cacheListener.cacheDisabled = true
+            cacheListener.cacheDisabledReason = 'disabled due to pre-existing Gradle User Home'
             return
         }
+        core.info('Gradle User Home already exists: will overwrite with cached contents.')
+    }
 
     gradleStateCache.init()
     // Mark the state as restored so that post-action will perform save.

src/dependency-graph.ts

@@ -0,0 +1,219 @@
+import * as core from '@actions/core'
+import * as artifact from '@actions/artifact'
+import * as github from '@actions/github'
+import * as glob from '@actions/glob'
+import * as toolCache from '@actions/tool-cache'
+import {GitHub} from '@actions/github/lib/utils'
+import {RequestError} from '@octokit/request-error'
+import type {PullRequestEvent} from '@octokit/webhooks-types'
+
+import * as path from 'path'
+import fs from 'fs'
+
+import * as layout from './repository-layout'
+import {DependencyGraphOption, getJobMatrix} from './input-params'
+
+const DEPENDENCY_GRAPH_ARTIFACT = 'dependency-graph'
+
+export async function setup(option: DependencyGraphOption): Promise<void> {
+    if (option === DependencyGraphOption.Disabled) {
+        return
+    }
+    // Download and submit early, for compatability with dependency review.
+    if (option === DependencyGraphOption.DownloadAndSubmit) {
+        await downloadAndSubmitDependencyGraphs()
+        return
+    }
+
+    core.info('Enabling dependency graph generation')
+    core.exportVariable('GITHUB_DEPENDENCY_GRAPH_ENABLED', 'true')
+    core.exportVariable('GITHUB_DEPENDENCY_GRAPH_JOB_CORRELATOR', getJobCorrelator())
+    core.exportVariable('GITHUB_DEPENDENCY_GRAPH_JOB_ID', github.context.runId)
+    core.exportVariable('GITHUB_DEPENDENCY_GRAPH_REF', github.context.ref)
+    core.exportVariable('GITHUB_DEPENDENCY_GRAPH_SHA', getShaFromContext())
+    core.exportVariable('GITHUB_DEPENDENCY_GRAPH_WORKSPACE', layout.workspaceDirectory())
+    core.exportVariable(
+        'DEPENDENCY_GRAPH_REPORT_DIR',
+        path.resolve(layout.workspaceDirectory(), 'dependency-graph-reports')
+    )
+}
+
+export async function complete(option: DependencyGraphOption): Promise<void> {
+    switch (option) {
+        case DependencyGraphOption.Disabled:
+        case DependencyGraphOption.DownloadAndSubmit: // Performed in setup
+            return
+        case DependencyGraphOption.Generate:
+            await uploadDependencyGraphs()
+            return
+        case DependencyGraphOption.GenerateAndSubmit:
+            await submitDependencyGraphs(await uploadDependencyGraphs())
+            return
+    }
+}
+
+async function uploadDependencyGraphs(): Promise<string[]> {
+    const workspaceDirectory = layout.workspaceDirectory()
+    const graphFiles = await findDependencyGraphFiles(workspaceDirectory)
+
+    const relativeGraphFiles = graphFiles.map(x => getRelativePathFromWorkspace(x))
+    core.info(`Uploading dependency graph files: ${relativeGraphFiles}`)
+
+    const artifactClient = artifact.create()
+    artifactClient.uploadArtifact(DEPENDENCY_GRAPH_ARTIFACT, graphFiles, workspaceDirectory)
+
+    return graphFiles
+}
+
+async function downloadAndSubmitDependencyGraphs(): Promise<void> {
+    const workspaceDirectory = layout.workspaceDirectory()
+    submitDependencyGraphs(await retrieveDependencyGraphs(workspaceDirectory))
+}
+
+async function submitDependencyGraphs(dependencyGraphFiles: string[]): Promise<void> {
+    for (const jsonFile of dependencyGraphFiles) {
+        try {
+            await submitDependencyGraphFile(jsonFile)
+        } catch (error) {
+            if (error instanceof RequestError) {
+                const relativeJsonFile = getRelativePathFromWorkspace(jsonFile)
+                core.warning(
+                    `Failed to submit dependency graph ${relativeJsonFile}.\n` +
+                        "Please ensure that the 'contents: write' permission is available for the workflow job.\n" +
+                        "Note that this permission is never available for a 'pull_request' trigger from a repository fork."
+                )
+            } else {
+                throw error
+            }
+        }
+    }
+}
+
+async function submitDependencyGraphFile(jsonFile: string): Promise<void> {
+    const octokit = getOctokit()
+    const jsonContent = fs.readFileSync(jsonFile, 'utf8')
+
+    const jsonObject = JSON.parse(jsonContent)
+    jsonObject.owner = github.context.repo.owner
+    jsonObject.repo = github.context.repo.repo
+    const response = await octokit.request('POST /repos/{owner}/{repo}/dependency-graph/snapshots', jsonObject)
+
+    const relativeJsonFile = getRelativePathFromWorkspace(jsonFile)
+    core.notice(`Submitted ${relativeJsonFile}: ${response.data.message}`)
+}
+
+async function retrieveDependencyGraphs(workspaceDirectory: string): Promise<string[]> {
+    if (github.context.payload.workflow_run) {
+        return await retrieveDependencyGraphsForWorkflowRun(github.context.payload.workflow_run.id, workspaceDirectory)
+    }
+    return retrieveDependencyGraphsForCurrentWorkflow(workspaceDirectory)
+}
+
+async function retrieveDependencyGraphsForWorkflowRun(runId: number, workspaceDirectory: string): Promise<string[]> {
+    const octokit = getOctokit()
+
+    // Find the workflow run artifacts named "dependency-graph"
+    const artifacts = await octokit.rest.actions.listWorkflowRunArtifacts({
+        owner: github.context.repo.owner,
+        repo: github.context.repo.repo,
+        run_id: runId
+    })
+
+    const matchArtifact = artifacts.data.artifacts.find(candidate => {
+        return candidate.name === DEPENDENCY_GRAPH_ARTIFACT
+    })
+
+    if (matchArtifact === undefined) {
+        throw new Error(`Dependency graph artifact not found. Has it been generated by workflow run '${runId}'?`)
+    }
+
+    // Download the dependency-graph artifact
+    const download = await octokit.rest.actions.downloadArtifact({
+        owner: github.context.repo.owner,
+        repo: github.context.repo.repo,
+        artifact_id: matchArtifact.id,
+        archive_format: 'zip'
+    })
+
+    const downloadBuffer = download.data as ArrayBuffer
+    const downloadZip = path.resolve(workspaceDirectory, 'dependency-graph.zip')
+    fs.writeFileSync(downloadZip, Buffer.from(downloadBuffer))
+
+    // Expance the dependency-graph zip and locate each dependency-graph JSON file
+    const extractDir = path.resolve(workspaceDirectory, 'dependency-graph')
+    const extracted = await toolCache.extractZip(downloadZip, extractDir)
+    core.info(`Extracted dependency graph artifacts to ${extracted}: ${fs.readdirSync(extracted)}`)
+
+    return findDependencyGraphFiles(extracted)
+}
+
+async function retrieveDependencyGraphsForCurrentWorkflow(workspaceDirectory: string): Promise<string[]> {
+    const artifactClient = artifact.create()
+    const downloadPath = path.resolve(workspaceDirectory, 'dependency-graph')
+    await artifactClient.downloadArtifact(DEPENDENCY_GRAPH_ARTIFACT, downloadPath)
+    return await findDependencyGraphFiles(downloadPath)
+}
+
+async function findDependencyGraphFiles(dir: string): Promise<string[]> {
+    const globber = await glob.create(`${dir}/dependency-graph-reports/*.json`)
+    const graphFiles = globber.glob()
+    return graphFiles
+}
+
+function getOctokit(): InstanceType<typeof GitHub> {
+    return github.getOctokit(getGithubToken())
+}
+
+function getGithubToken(): string {
+    return core.getInput('github-token', {required: true})
+}
+
+function getRelativePathFromWorkspace(file: string): string {
+    const workspaceDirectory = layout.workspaceDirectory()
+    return path.relative(workspaceDirectory, file)
+}
+
+function getShaFromContext(): string {
+    const context = github.context
+    const pullRequestEvents = [
+        'pull_request',
+        'pull_request_comment',
+        'pull_request_review',
+        'pull_request_review_comment'
+        // Note that pull_request_target is omitted here.
+        // That event runs in the context of the base commit of the PR,
+        // so the snapshot should not be associated with the head commit.
+    ]
+    if (pullRequestEvents.includes(context.eventName)) {
+        const pr = (context.payload as PullRequestEvent).pull_request
+        return pr.head.sha
+    } else {
+        return context.sha
+    }
+}
+
+function getJobCorrelator(): string {
+    return constructJobCorrelator(github.context.workflow, github.context.job, getJobMatrix())
+}
+
+export function constructJobCorrelator(workflow: string, jobId: string, matrixJson: string): string {
+    const matrixString = describeMatrix(matrixJson)
+    const label = matrixString ? `${workflow}-${jobId}-${matrixString}` : `${workflow}-${jobId}`
+    return sanitize(label)
+}
+
+function describeMatrix(matrixJson: string): string {
+    core.debug(`Got matrix json: ${matrixJson}`)
+    const matrix = JSON.parse(matrixJson)
+    if (matrix) {
+        return Object.values(matrix).join('-')
+    }
+    return ''
+}
+
+function sanitize(value: string): string {
+    return value
+        .replace(/[^a-zA-Z0-9_-\s]/g, '')
+        .replace(/\s+/g, '_')
+        .toLowerCase()
+}

src/execution.ts

@@ -1,12 +1,11 @@
 import * as core from '@actions/core'
 import * as exec from '@actions/exec'
-import fs from 'fs'
 import * as gradlew from './gradlew'
 
 export async function executeGradleBuild(executable: string | undefined, root: string, args: string[]): Promise<void> {
     // Use the provided executable, or look for a Gradle wrapper script to run
-    const toExecute = executable ?? gradlew.locateGradleWrapperScript(root)
-    verifyIsExecutableScript(toExecute)
+    const toExecute = executable ?? gradlew.gradleWrapperScript(root)
+
     const status: number = await exec.exec(toExecute, args, {
         cwd: root,
         ignoreReturnCode: true
@@ -16,11 +15,3 @@ export async function executeGradleBuild(executable: string | undefined, root: s
         core.setFailed(`Gradle build failed: see console output for details`)
     }
 }
-
-function verifyIsExecutableScript(toExecute: string): void {
-    try {
-        fs.accessSync(toExecute, fs.constants.X_OK)
-    } catch (err) {
-        throw new Error(`Gradle script '${toExecute}' is not executable.`)
-    }
-}

src/gradlew.ts

@@ -4,23 +4,39 @@ import fs from 'fs'
 const IS_WINDOWS = process.platform === 'win32'
 
 export function wrapperScriptFilename(): string {
-    return IS_WINDOWS ? 'gradlew.bat' : 'gradlew'
+    return IS_WINDOWS ? './gradlew.bat' : './gradlew'
 }
 
 export function installScriptFilename(): string {
     return IS_WINDOWS ? 'gradle.bat' : 'gradle'
 }
 
-export function locateGradleWrapperScript(buildRootDirectory: string): string {
+export function gradleWrapperScript(buildRootDirectory: string): string {
     validateGradleWrapper(buildRootDirectory)
-    return path.resolve(buildRootDirectory, wrapperScriptFilename())
+    return wrapperScriptFilename()
 }
 
 function validateGradleWrapper(buildRootDirectory: string): void {
+    const wrapperScript = path.resolve(buildRootDirectory, wrapperScriptFilename())
+    verifyExists(wrapperScript, 'Gradle Wrapper script')
+    verifyIsExecutableScript(wrapperScript)
+
     const wrapperProperties = path.resolve(buildRootDirectory, 'gradle/wrapper/gradle-wrapper.properties')
-    if (!fs.existsSync(wrapperProperties)) {
+    verifyExists(wrapperProperties, 'Gradle wrapper properties file')
+}
+
+function verifyExists(file: string, description: string): void {
+    if (!fs.existsSync(file)) {
         throw new Error(
-            `Cannot locate a Gradle wrapper properties file at '${wrapperProperties}'. Specify 'gradle-version' or 'gradle-executable' for projects without Gradle wrapper configured.`
+            `Cannot locate ${description} at '${file}'. Specify 'gradle-version' or 'gradle-executable' for projects without Gradle wrapper configured.`
         )
     }
 }
+
+function verifyIsExecutableScript(toExecute: string): void {
+    try {
+        fs.accessSync(toExecute, fs.constants.X_OK)
+    } catch (err) {
+        throw new Error(`Gradle script '${toExecute}' is not executable.`)
+    }
+}

src/input-params.ts

@@ -0,0 +1,109 @@
+import * as core from '@actions/core'
+import {parseArgsStringToArgv} from 'string-argv'
+
+export function isCacheDisabled(): boolean {
+    return getBooleanInput('cache-disabled')
+}
+
+export function isCacheReadOnly(): boolean {
+    return getBooleanInput('cache-read-only')
+}
+
+export function isCacheWriteOnly(): boolean {
+    return getBooleanInput('cache-write-only')
+}
+
+export function isCacheOverwriteExisting(): boolean {
+    return getBooleanInput('cache-overwrite-existing')
+}
+
+export function isCacheStrictMatch(): boolean {
+    return getBooleanInput('gradle-home-cache-strict-match')
+}
+
+export function isCacheDebuggingEnabled(): boolean {
+    return process.env['GRADLE_BUILD_ACTION_CACHE_DEBUG_ENABLED'] ? true : false
+}
+
+export function isCacheCleanupEnabled(): boolean {
+    return getBooleanInput('gradle-home-cache-cleanup')
+}
+
+export function getCacheIncludes(): string[] {
+    return core.getMultilineInput('gradle-home-cache-includes')
+}
+
+export function getCacheExcludes(): string[] {
+    return core.getMultilineInput('gradle-home-cache-excludes')
+}
+
+export function getBuildRootDirectory(): string {
+    return core.getInput('build-root-directory')
+}
+
+export function getGradleVersion(): string {
+    return core.getInput('gradle-version')
+}
+
+export function getGradleExecutable(): string {
+    return core.getInput('gradle-executable')
+}
+
+export function getArguments(): string[] {
+    const input = core.getInput('arguments')
+    return parseArgsStringToArgv(input)
+}
+
+// Internal parameters
+export function getJobMatrix(): string {
+    return core.getInput('workflow-job-context')
+}
+
+export function getGithubToken(): string {
+    return core.getInput('github-token', {required: true})
+}
+
+export function isJobSummaryEnabled(): boolean {
+    return getBooleanInput('generate-job-summary', true)
+}
+
+export function isDependencyGraphEnabled(): boolean {
+    return getBooleanInput('generate-dependency-graph', true)
+}
+
+export function getDependencyGraphOption(): DependencyGraphOption {
+    const val = core.getInput('dependency-graph')
+    switch (val.toLowerCase().trim()) {
+        case 'disabled':
+            return DependencyGraphOption.Disabled
+        case 'generate':
+            return DependencyGraphOption.Generate
+        case 'generate-and-submit':
+            return DependencyGraphOption.GenerateAndSubmit
+        case 'download-and-submit':
+            return DependencyGraphOption.DownloadAndSubmit
+    }
+    throw TypeError(
+        `The value '${val} is not valid for 'dependency-graph. Valid values are: [disabled, generate-and-upload, generate-and-submit, download-and-submit]. The default value is 'disabled'.`
+    )
+}
+
+function getBooleanInput(paramName: string, paramDefault = false): boolean {
+    const paramValue = core.getInput(paramName)
+    switch (paramValue.toLowerCase().trim()) {
+        case '':
+            return paramDefault
+        case 'false':
+            return false
+        case 'true':
+            return true
+    }
+    throw TypeError(`The value '${paramValue} is not valid for '${paramName}. Valid values are: [true, false]`)
+}
+
+export enum DependencyGraphOption {
+    Disabled,
+    Generate,
+    GenerateAndSubmit,
+    DownloadAndSubmit
+}

src/job-summary.ts

@@ -36,7 +36,7 @@ function writeSummaryTable(results: BuildResult[]): void {
         <th>Requested Tasks</th>
         <th>Gradle Version</th>
         <th>Build Outcome</th>
-        <th>Build Scan™</th>
+        <th>Build Scan®</th>
     </tr>${results.map(result => renderBuildResultRow(result)).join('')}
 </table>
     `)
@@ -72,7 +72,7 @@ function renderBuildScan(result: BuildResult): string {
 }
 
 function renderBuildScanBadge(outcomeText: string, outcomeColor: string, targetUrl: string): string {
-    const badgeUrl = `https://img.shields.io/badge/Build%20Scan%E2%84%A2-${outcomeText}-${outcomeColor}?logo=Gradle`
+    const badgeUrl = `https://img.shields.io/badge/Build%20Scan%C2%AE-${outcomeText}-${outcomeColor}?logo=Gradle`
     const badgeHtml = `<img src="${badgeUrl}" alt="Build Scan ${outcomeText}" />`
     return `<a href="${targetUrl}" rel="nofollow">${badgeHtml}</a>`
 }
@@ -81,7 +81,7 @@ function logSummaryTable(results: BuildResult[]): void {
     core.info('============================')
     core.info('Gradle Builds')
     core.info('----------------------------')
-    core.info('Root Project | Requested Tasks | Gradle Version | Build Outcome | Build Scan™')
+    core.info('Root Project | Requested Tasks | Gradle Version | Build Outcome | Build Scan®')
     core.info('----------------------------')
     for (const result of results) {
         core.info(

src/main.ts

@@ -1,30 +1,26 @@
 import * as core from '@actions/core'
-import * as path from 'path'
-import {parseArgsStringToArgv} from 'string-argv'
 
 import * as setupGradle from './setup-gradle'
 import * as execution from './execution'
-import * as provision from './provision'
+import * as provisioner from './provision'
+import * as layout from './repository-layout'
+import * as params from './input-params'
 
 /**
  * The main entry point for the action, called by Github Actions for the step.
  */
 export async function run(): Promise<void> {
     try {
-        const workspaceDirectory = process.env[`GITHUB_WORKSPACE`] || ''
-        const buildRootDirectory = resolveBuildRootDirectory(workspaceDirectory)
+        // Configure Gradle environment (Gradle User Home)
+        await setupGradle.setup()
 
-        await setupGradle.setup(buildRootDirectory)
-
-        const executable = await provisionGradle(workspaceDirectory)
-        // executable will be undefined if using Gradle wrapper
-        if (executable !== undefined) {
-            core.addPath(path.dirname(executable))
-        }
+        // Download and install Gradle if required
+        const executable = await provisioner.provisionGradle()
 
         // Only execute if arguments have been provided
-        const args: string[] = parseCommandLineArguments()
+        const args: string[] = params.getArguments()
         if (args.length > 0) {
+            const buildRootDirectory = layout.buildRootDirectory()
             await execution.executeGradleBuild(executable, buildRootDirectory, args)
         }
     } catch (error) {
@@ -36,29 +32,3 @@ export async function run(): Promise<void> {
 }
 
 run()
-
-async function provisionGradle(workspaceDirectory: string): Promise<string | undefined> {
-    const gradleVersion = core.getInput('gradle-version')
-    if (gradleVersion !== '' && gradleVersion !== 'wrapper') {
-        return path.resolve(await provision.gradleVersion(gradleVersion))
-    }
-
-    const gradleExecutable = core.getInput('gradle-executable')
-    if (gradleExecutable !== '') {
-        return path.resolve(workspaceDirectory, gradleExecutable)
-    }
-
-    return undefined
-}
-
-function resolveBuildRootDirectory(baseDirectory: string): string {
-    const buildRootDirectory = core.getInput('build-root-directory')
-    const resolvedBuildRootDirectory =
-        buildRootDirectory === '' ? path.resolve(baseDirectory) : path.resolve(baseDirectory, buildRootDirectory)
-    return resolvedBuildRootDirectory
-}
-
-function parseCommandLineArguments(): string[] {
-    const input = core.getInput('arguments')
-    return parseArgsStringToArgv(input)
-}

src/provision.ts

@@ -7,14 +7,43 @@ import * as cache from '@actions/cache'
 import * as toolCache from '@actions/tool-cache'
 
 import * as gradlew from './gradlew'
+import * as params from './input-params'
+import * as layout from './repository-layout'
 import {handleCacheFailure, isCacheDisabled, isCacheReadOnly} from './cache-utils'
 
 const gradleVersionsBaseUrl = 'https://services.gradle.org/versions'
 
 /**
- * @return Gradle executable path
+ * Install any configured version of Gradle, adding the executable to the PATH.
+ * @return Installed Gradle executable or undefined if no version configured.
  */
-export async function gradleVersion(version: string): Promise<string> {
+export async function provisionGradle(): Promise<string | undefined> {
+    const gradleVersion = params.getGradleVersion()
+    if (gradleVersion !== '' && gradleVersion !== 'wrapper') {
+        return addToPath(path.resolve(await installGradle(gradleVersion)))
+    }
+
+    const gradleExecutable = params.getGradleExecutable()
+    if (gradleExecutable !== '') {
+        const workspaceDirectory = layout.workspaceDirectory()
+        return addToPath(path.resolve(workspaceDirectory, gradleExecutable))
+    }
+
+    return undefined
+}
+
+async function addToPath(executable: string): Promise<string> {
+    core.addPath(path.dirname(executable))
+    return executable
+}
+
+async function installGradle(version: string): Promise<string> {
+    const versionInfo = await resolveGradleVersion(version)
+    core.setOutput('gradle-version', versionInfo.version)
+    return installGradleVersion(versionInfo)
+}
+
+async function resolveGradleVersion(version: string): Promise<GradleVersionInfo> {
     switch (version) {
         case 'current':
             return gradleCurrent()
@@ -32,36 +61,33 @@ export async function gradleVersion(version: string): Promise<string> {
     }
 }
 
-async function gradleCurrent(): Promise<string> {
-    const versionInfo = await gradleVersionDeclaration(`${gradleVersionsBaseUrl}/current`)
-    return provisionGradle(versionInfo)
+async function gradleCurrent(): Promise<GradleVersionInfo> {
+    return await gradleVersionDeclaration(`${gradleVersionsBaseUrl}/current`)
 }
 
-async function gradleReleaseCandidate(): Promise<string> {
+async function gradleReleaseCandidate(): Promise<GradleVersionInfo> {
     const versionInfo = await gradleVersionDeclaration(`${gradleVersionsBaseUrl}/release-candidate`)
     if (versionInfo && versionInfo.version && versionInfo.downloadUrl) {
-        return provisionGradle(versionInfo)
+        return versionInfo
     }
     core.info('No current release-candidate found, will fallback to current')
     return gradleCurrent()
 }
 
-async function gradleNightly(): Promise<string> {
-    const versionInfo = await gradleVersionDeclaration(`${gradleVersionsBaseUrl}/nightly`)
-    return provisionGradle(versionInfo)
+async function gradleNightly(): Promise<GradleVersionInfo> {
+    return await gradleVersionDeclaration(`${gradleVersionsBaseUrl}/nightly`)
 }
 
-async function gradleReleaseNightly(): Promise<string> {
-    const versionInfo = await gradleVersionDeclaration(`${gradleVersionsBaseUrl}/release-nightly`)
-    return provisionGradle(versionInfo)
+async function gradleReleaseNightly(): Promise<GradleVersionInfo> {
+    return await gradleVersionDeclaration(`${gradleVersionsBaseUrl}/release-nightly`)
 }
 
-async function gradle(version: string): Promise<string> {
+async function gradle(version: string): Promise<GradleVersionInfo> {
     const versionInfo = await findGradleVersionDeclaration(version)
     if (!versionInfo) {
         throw new Error(`Gradle version ${version} does not exists`)
     }
-    return provisionGradle(versionInfo)
+    return versionInfo
 }
 
 async function gradleVersionDeclaration(url: string): Promise<GradleVersionInfo> {
@@ -75,7 +101,7 @@ async function findGradleVersionDeclaration(version: string): Promise<GradleVers
     })
 }
 
-async function provisionGradle(versionInfo: GradleVersionInfo): Promise<string> {
+async function installGradleVersion(versionInfo: GradleVersionInfo): Promise<string> {
     return core.group(`Provision Gradle ${versionInfo.version}`, async () => {
         return locateGradleAndDownloadIfRequired(versionInfo)
     })

src/repository-layout.ts

@@ -0,0 +1,16 @@
+import * as params from './input-params'
+import * as path from 'path'
+
+export function workspaceDirectory(): string {
+    return process.env[`GITHUB_WORKSPACE`] || ''
+}
+
+export function buildRootDirectory(): string {
+    const baseDirectory = workspaceDirectory()
+    const buildRootDirectoryInput = params.getBuildRootDirectory()
+    const resolvedBuildRootDirectory =
+        buildRootDirectoryInput === ''
+            ? path.resolve(baseDirectory)
+            : path.resolve(baseDirectory, buildRootDirectoryInput)
+    return resolvedBuildRootDirectory
+}

src/resources/init-scripts/gradle-build-action.build-result-capture.init.gradle

@@ -16,26 +16,29 @@ if (isTopLevelBuild) {
     if (atLeastGradle6) {
         def useBuildService = version >= GradleVersion.version("6.6")
         settingsEvaluated { settings ->
-            // The `buildScanPublished` hook is the only way to capture the build scan URI.
-            if (settings.pluginManager.hasPlugin("com.gradle.enterprise")) {
-                captureUsingBuildScanPublished(settings.extensions["gradleEnterprise"].buildScan, settings.rootProject, invocationId)
-            }
-            // We also need to add hooks in case the plugin is applied but no build scan is published
-            // The `buildScanPublished` results will NOT be overwritten by these calls
+            // By default, use standard mechanisms to capture build results
             if (useBuildService) {
                 captureUsingBuildService(settings, invocationId)
             } else {
                 captureUsingBuildFinished(gradle, invocationId)
             }
+            
+            // The `buildScanPublished` hook allows the capture of the Build Scan URI.
+            // Results captured this way will overwrite any results from the other mechanism.
+            settings.pluginManager.withPlugin("com.gradle.enterprise") {
+                captureUsingBuildScanPublished(settings.extensions["gradleEnterprise"].buildScan, settings.rootProject, invocationId)
+            }
         }
     } else if (atLeastGradle3) {
         projectsEvaluated { gradle ->
-            if (gradle.rootProject.pluginManager.hasPlugin("com.gradle.build-scan")) {
+            // By default, use 'buildFinished' to capture build results
+            captureUsingBuildFinished(gradle, invocationId)
+
+            // The `buildScanPublished` hook allows the capture of the Build Scan URI.
+            // Results captured this way will overwrite any results from 'buildFinished'.
+            gradle.rootProject.pluginManager.withPlugin("com.gradle.build-scan") {
                 captureUsingBuildScanPublished(gradle.rootProject.extensions["buildScan"], gradle.rootProject, invocationId)
             }
-            // Always attempt to capture in buildFinished in case the plugin is applied but no build scan is published
-            // The `buildScanPublished` results will NOT be overwritten by this call
-            captureUsingBuildFinished(gradle, invocationId)
         }
     }
 }
@@ -70,6 +73,7 @@ def captureUsingBuildScanPublished(buildScanExtension, rootProject, invocationId
 
 def captureUsingBuildFinished(gradle, invocationId) {
     gradle.buildFinished { result ->
+        println "Got buildFinished: ${result}"
         def buildResults = new BuildResults(invocationId, gradle, gradle.rootProject)
         buildResults.setBuildResult(result)
         buildResults.writeToResultsFile(false)
@@ -78,7 +82,7 @@ def captureUsingBuildFinished(gradle, invocationId) {
 
 def captureUsingBuildService(settings, invocationId) {
     gradle.ext.invocationId = invocationId
-    apply from: 'build-result-capture-service.plugin.groovy'
+    apply from: 'gradle-build-action.build-result-capture-service.plugin.groovy'
 }
 
 class BuildResults {

src/resources/init-scripts/gradle-build-action.github-dependency-graph-gradle-plugin-apply.groovy

@@ -0,0 +1,9 @@
+buildscript {
+  repositories {
+    maven { url "https://plugins.gradle.org/m2/" }
+  }
+  dependencies {
+    classpath "org.gradle:github-dependency-graph-gradle-plugin:0.4.1"
+  }
+}
+apply plugin: org.gradle.github.GitHubDependencyGraphPlugin

src/resources/init-scripts/gradle-build-action.github-dependency-graph.init.gradle

@@ -0,0 +1,66 @@
+import org.gradle.util.GradleVersion
+
+// Only run when dependency graph is explicitly enabled
+if (getVariable('GITHUB_DEPENDENCY_GRAPH_ENABLED') != "true") {
+  return
+}
+
+// Do not run for unsupported versions of Gradle
+if (GradleVersion.current().baseVersion < GradleVersion.version("5.0")) {
+  println "::warning::Dependency Graph is not supported for Gradle versions < 5.0. No dependency snapshot will be generated."
+  return
+}
+
+// Attempt to find a unique job correlator to use based on the environment variable
+// This is only required for top-level builds
+def isTopLevelBuild = gradle.getParent() == null
+if (isTopLevelBuild) {
+  def reportFile = getUniqueReportFile(getVariable('GITHUB_DEPENDENCY_GRAPH_JOB_CORRELATOR'))
+
+  if (reportFile == null) {
+    println "::warning::No dependency snapshot generated for step. Could not determine unique job correlator - specify GITHUB_DEPENDENCY_GRAPH_JOB_CORRELATOR var for this step."
+    return
+  }
+
+  def githubOutput = System.getenv("GITHUB_OUTPUT")
+  if (githubOutput) {
+      new File(githubOutput) << "dependency-graph-file=${reportFile.absolutePath}\n"
+  }
+
+
+  println "Generating dependency graph into '${reportFile}'"
+}
+
+apply from: 'gradle-build-action.github-dependency-graph-gradle-plugin-apply.groovy'
+
+/**
+ * Using the supplied jobCorrelator value:
+ * - Checks if report file already exists
+ * - If so, tries to find a unique value that does not yet have a corresponding report file.
+ * - When found, this value is set as a System property override.
+ */
+File getUniqueReportFile(String jobCorrelator) {
+    def reportDir = getVariable('DEPENDENCY_GRAPH_REPORT_DIR')
+    def reportFile = new File(reportDir, jobCorrelator + ".json")
+    if (!reportFile.exists()) return reportFile
+
+    // Try at most 100 suffixes
+    for (int i = 1; i < 100; i++) {
+        def candidateCorrelator = jobCorrelator + "-" + i
+        def candidateFile = new File(reportDir, candidateCorrelator + ".json")
+        if (!candidateFile.exists()) {
+           System.properties['GITHUB_DEPENDENCY_GRAPH_JOB_CORRELATOR'] = candidateCorrelator
+           return candidateFile
+        }
+    }
+
+    // Could not determine unique job correlator
+    return null
+}
+
+/**
+* Return the environment variable value, or equivalent system property (if set)
+*/
+String getVariable(String name) {
+  return System.properties[name] ?: System.getenv(name)
+}

src/resources/init-scripts/gradle-build-action.inject-gradle-enterprise.init.gradle

@@ -0,0 +1,192 @@
+import org.gradle.util.GradleVersion
+
+// note that there is no mechanism to share code between the initscript{} block and the main script, so some logic is duplicated
+
+// conditionally apply the GE / Build Scan plugin to the classpath so it can be applied to the build further down in this script
+initscript {
+    def isTopLevelBuild = !gradle.parent
+    if (!isTopLevelBuild) {
+        return
+    }
+
+    def getInputParam = { String name ->
+        def envVarName = name.toUpperCase().replace('.', '_').replace('-', '_')
+        return System.getProperty(name) ?: System.getenv(envVarName)
+    }
+
+    // finish early if injection is disabled
+    def gradleInjectionEnabled = getInputParam("gradle-enterprise.injection-enabled")
+    if (gradleInjectionEnabled != "true") {
+        return
+    }
+
+    def pluginRepositoryUrl = getInputParam('gradle-enterprise.plugin-repository.url')
+    def gePluginVersion = getInputParam('gradle-enterprise.plugin.version')
+    def ccudPluginVersion = getInputParam('gradle-enterprise.ccud-plugin.version')
+
+    def atLeastGradle5 = GradleVersion.current() >= GradleVersion.version('5.0')
+    def atLeastGradle4 = GradleVersion.current() >= GradleVersion.version('4.0')
+
+    if (gePluginVersion || ccudPluginVersion && atLeastGradle4) {
+        pluginRepositoryUrl = pluginRepositoryUrl ?: 'https://plugins.gradle.org/m2'
+        logger.quiet("Gradle Enterprise plugins resolution: $pluginRepositoryUrl")
+
+        repositories {
+            maven { url pluginRepositoryUrl }
+        }
+    }
+
+    dependencies {
+        if (gePluginVersion) {
+            classpath atLeastGradle5 ?
+                "com.gradle:gradle-enterprise-gradle-plugin:$gePluginVersion" :
+                "com.gradle:build-scan-plugin:1.16"
+        }
+
+        if (ccudPluginVersion && atLeastGradle4) {
+            classpath "com.gradle:common-custom-user-data-gradle-plugin:$ccudPluginVersion"
+        }
+    }
+}
+
+def BUILD_SCAN_PLUGIN_ID = 'com.gradle.build-scan'
+def BUILD_SCAN_PLUGIN_CLASS = 'com.gradle.scan.plugin.BuildScanPlugin'
+
+def GRADLE_ENTERPRISE_PLUGIN_ID = 'com.gradle.enterprise'
+def GRADLE_ENTERPRISE_PLUGIN_CLASS = 'com.gradle.enterprise.gradleplugin.GradleEnterprisePlugin'
+def GRADLE_ENTERPRISE_EXTENSION_CLASS = 'com.gradle.enterprise.gradleplugin.GradleEnterpriseExtension'
+def CI_AUTO_INJECTION_CUSTOM_VALUE_NAME = 'CI auto injection'
+def CI_AUTO_INJECTION_CUSTOM_VALUE_VALUE = 'gradle-build-action'
+def CCUD_PLUGIN_ID = 'com.gradle.common-custom-user-data-gradle-plugin'
+def CCUD_PLUGIN_CLASS = 'com.gradle.CommonCustomUserDataGradlePlugin'
+
+def isTopLevelBuild = !gradle.parent
+if (!isTopLevelBuild) {
+    return
+}
+
+def getInputParam = { String name ->
+    def envVarName = name.toUpperCase().replace('.', '_').replace('-', '_')
+    return System.getProperty(name) ?: System.getenv(envVarName)
+}
+
+// finish early if injection is disabled
+def gradleInjectionEnabled = getInputParam("gradle-enterprise.injection-enabled")
+if (gradleInjectionEnabled != "true") {
+    return
+}
+
+def geUrl = getInputParam('gradle-enterprise.url')
+def geAllowUntrustedServer = Boolean.parseBoolean(getInputParam('gradle-enterprise.allow-untrusted-server'))
+def geEnforceUrl = Boolean.parseBoolean(getInputParam('gradle-enterprise.enforce-url'))
+def buildScanUploadInBackground = Boolean.parseBoolean(getInputParam('gradle-enterprise.build-scan.upload-in-background'))
+def gePluginVersion = getInputParam('gradle-enterprise.plugin.version')
+def ccudPluginVersion = getInputParam('gradle-enterprise.ccud-plugin.version')
+
+def atLeastGradle4 = GradleVersion.current() >= GradleVersion.version('4.0')
+
+// finish early if configuration parameters passed in via system properties are not valid/supported
+if (ccudPluginVersion && isNotAtLeast(ccudPluginVersion, '1.7')) {
+    logger.warn("Common Custom User Data Gradle plugin must be at least 1.7. Configured version is $ccudPluginVersion.")
+    return
+}
+
+// register buildScanPublished listener and optionally apply the GE / Build Scan plugin
+if (GradleVersion.current() < GradleVersion.version('6.0')) {
+    rootProject {
+        buildscript.configurations.getByName("classpath").incoming.afterResolve { ResolvableDependencies incoming ->
+            def resolutionResult = incoming.resolutionResult
+
+            if (gePluginVersion) {
+                def scanPluginComponent = resolutionResult.allComponents.find {
+                    it.moduleVersion.with { group == "com.gradle" && (name == "build-scan-plugin" || name == "gradle-enterprise-gradle-plugin") }
+                }
+                if (!scanPluginComponent) {
+                    logger.quiet("Applying $BUILD_SCAN_PLUGIN_CLASS via init script")
+                    logger.quiet("Connection to Gradle Enterprise: $geUrl, allowUntrustedServer: $geAllowUntrustedServer")
+                    applyPluginExternally(pluginManager, BUILD_SCAN_PLUGIN_CLASS)
+                    buildScan.server = geUrl
+                    buildScan.allowUntrustedServer = geAllowUntrustedServer
+                    buildScan.publishAlways()
+                    if (buildScan.metaClass.respondsTo(buildScan, 'setUploadInBackground', Boolean)) buildScan.uploadInBackground = buildScanUploadInBackground  // uploadInBackground not available for build-scan-plugin 1.16
+                    buildScan.value CI_AUTO_INJECTION_CUSTOM_VALUE_NAME, CI_AUTO_INJECTION_CUSTOM_VALUE_VALUE
+                }
+
+                if (geUrl && geEnforceUrl) {
+                    pluginManager.withPlugin(BUILD_SCAN_PLUGIN_ID) {
+                        afterEvaluate {
+                            logger.quiet("Enforcing Gradle Enterprise: $geUrl, allowUntrustedServer: $geAllowUntrustedServer")
+                            buildScan.server = geUrl
+                            buildScan.allowUntrustedServer = geAllowUntrustedServer
+                        }
+                    }
+                }
+            }
+
+            if (ccudPluginVersion && atLeastGradle4) {
+                def ccudPluginComponent = resolutionResult.allComponents.find {
+                    it.moduleVersion.with { group == "com.gradle" && name == "common-custom-user-data-gradle-plugin" }
+                }
+                if (!ccudPluginComponent) {
+                    logger.quiet("Applying $CCUD_PLUGIN_CLASS via init script")
+                    pluginManager.apply(initscript.classLoader.loadClass(CCUD_PLUGIN_CLASS))
+                }
+            }
+        }
+    }
+} else {
+    gradle.settingsEvaluated { settings ->
+        if (gePluginVersion) {
+            if (!settings.pluginManager.hasPlugin(GRADLE_ENTERPRISE_PLUGIN_ID)) {
+                logger.quiet("Applying $GRADLE_ENTERPRISE_PLUGIN_CLASS via init script")
+                logger.quiet("Connection to Gradle Enterprise: $geUrl, allowUntrustedServer: $geAllowUntrustedServer")
+                applyPluginExternally(settings.pluginManager, GRADLE_ENTERPRISE_PLUGIN_CLASS)
+                extensionsWithPublicType(settings, GRADLE_ENTERPRISE_EXTENSION_CLASS).collect { settings[it.name] }.each { ext ->
+                    ext.server = geUrl
+                    ext.allowUntrustedServer = geAllowUntrustedServer
+                    ext.buildScan.publishAlways()
+                    ext.buildScan.uploadInBackground = buildScanUploadInBackground
+                    ext.buildScan.value CI_AUTO_INJECTION_CUSTOM_VALUE_NAME, CI_AUTO_INJECTION_CUSTOM_VALUE_VALUE
+                }
+            }
+
+            if (geUrl && geEnforceUrl) {
+                extensionsWithPublicType(settings, GRADLE_ENTERPRISE_EXTENSION_CLASS).collect { settings[it.name] }.each { ext ->
+                    logger.quiet("Enforcing Gradle Enterprise: $geUrl, allowUntrustedServer: $geAllowUntrustedServer")
+                    ext.server = geUrl
+                    ext.allowUntrustedServer = geAllowUntrustedServer
+                }
+            }
+        }
+
+        if (ccudPluginVersion) {
+            if (!settings.pluginManager.hasPlugin(CCUD_PLUGIN_ID)) {
+                logger.quiet("Applying $CCUD_PLUGIN_CLASS via init script")
+                settings.pluginManager.apply(initscript.classLoader.loadClass(CCUD_PLUGIN_CLASS))
+            }
+        }
+    }
+}
+
+void applyPluginExternally(PluginManager pluginManager, String pluginClassName) {
+    def externallyApplied = 'gradle.enterprise.externally-applied'
+    def oldValue = System.getProperty(externallyApplied)
+    System.setProperty(externallyApplied, 'true')
+    try {
+        pluginManager.apply(initscript.classLoader.loadClass(pluginClassName))
+    } finally {
+        if (oldValue == null) {
+            System.clearProperty(externallyApplied)
+        } else {
+            System.setProperty(externallyApplied, oldValue)
+        }
+    }
+}
+
+static def extensionsWithPublicType(def container, String publicType) {
+    container.extensions.extensionsSchema.elements.findAll { it.publicType.concreteClass.name == publicType }
+}
+
+static boolean isNotAtLeast(String versionUnderTest, String referenceVersion) {
+    GradleVersion.version(versionUnderTest) < GradleVersion.version(referenceVersion)
+}

src/setup-gradle.ts

@@ -4,6 +4,9 @@ import {SUMMARY_ENV_VAR} from '@actions/core/lib/summary'
 import * as path from 'path'
 import * as os from 'os'
 import * as caches from './caches'
+import * as layout from './repository-layout'
+import * as params from './input-params'
+import * as dependencyGraph from './dependency-graph'
 
 import {logJobSummary, writeJobSummary} from './job-summary'
 import {loadBuildResults} from './build-results'
@@ -13,19 +16,9 @@ import {DaemonController} from './daemon-controller'
 const GRADLE_SETUP_VAR = 'GRADLE_BUILD_ACTION_SETUP_COMPLETED'
 const GRADLE_USER_HOME = 'GRADLE_USER_HOME'
 const CACHE_LISTENER = 'CACHE_LISTENER'
-const JOB_SUMMARY_ENABLED_PARAMETER = 'generate-job-summary'
 
-function shouldGenerateJobSummary(): boolean {
-    // Check if Job Summary is supported on this platform
-    if (!process.env[SUMMARY_ENV_VAR]) {
-        return false
-    }
-
-    return core.getBooleanInput(JOB_SUMMARY_ENABLED_PARAMETER)
-}
-
-export async function setup(buildRootDirectory: string): Promise<void> {
-    const gradleUserHome = await determineGradleUserHome(buildRootDirectory)
+export async function setup(): Promise<void> {
+    const gradleUserHome = await determineGradleUserHome()
 
     // Bypass setup on all but first action step in workflow.
     if (process.env[GRADLE_SETUP_VAR]) {
@@ -44,6 +37,8 @@ export async function setup(buildRootDirectory: string): Promise<void> {
     await caches.restore(gradleUserHome, cacheListener)
 
     core.saveState(CACHE_LISTENER, cacheListener.stringify())
+
+    await dependencyGraph.setup(params.getDependencyGraphOption())
 }
 
 export async function complete(): Promise<void> {
@@ -66,11 +61,14 @@ export async function complete(): Promise<void> {
     } else {
         logJobSummary(buildResults, cacheListener)
     }
+
+    await dependencyGraph.complete(params.getDependencyGraphOption())
 }
 
-async function determineGradleUserHome(rootDir: string): Promise<string> {
+async function determineGradleUserHome(): Promise<string> {
     const customGradleUserHome = process.env['GRADLE_USER_HOME']
     if (customGradleUserHome) {
+        const rootDir = layout.workspaceDirectory()
         return path.resolve(rootDir, customGradleUserHome)
     }
 
@@ -93,3 +91,12 @@ async function determineUserHome(): Promise<string> {
     core.debug(`Determined user.home from java -version output: '${userHome}'`)
     return userHome
 }
+
+function shouldGenerateJobSummary(): boolean {
+    // Check if Job Summary is supported on this platform
+    if (!process.env[SUMMARY_ENV_VAR]) {
+        return false
+    }
+
+    return params.isJobSummaryEnabled()
+}

test/init-scripts/build.gradle

@@ -20,8 +20,7 @@ dependencies {
     testImplementation ('io.ratpack:ratpack-groovy-test:1.9.0') {
         exclude group: 'org.codehaus.groovy', module: 'groovy-all'
     }
-    testImplementation 'com.fasterxml.jackson.dataformat:jackson-dataformat-smile:2.14.2'
-
+    testImplementation 'com.fasterxml.jackson.dataformat:jackson-dataformat-smile:2.15.2'
 }
 
 test {

test/init-scripts/gradle/wrapper/gradle-wrapper.properties

@@ -1,5 +1,8 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-7.5.1-bin.zip
+distributionSha256Sum=591855b517fc635b9e04de1d05d5e76ada3f89f5fc76f87978d1b245b4f69225
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.3-bin.zip
+networkTimeout=10000
+validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists

test/init-scripts/gradlew

@@ -55,7 +55,7 @@
 #       Darwin, MinGW, and NonStop.
 #
 #   (3) This script is generated from the Groovy template
-#       https://github.com/gradle/gradle/blob/master/subprojects/plugins/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       https://github.com/gradle/gradle/blob/HEAD/subprojects/plugins/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
 #       within the Gradle project.
 #
 #       You can find Gradle at https://github.com/gradle/gradle/.
@@ -80,13 +80,11 @@ do
     esac
 done
 
-APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit
-
-APP_NAME="Gradle"
+# This is normally unused
+# shellcheck disable=SC2034
 APP_BASE_NAME=${0##*/}
-
-# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+# Discard cd standard output in case $CDPATH is set (https://github.com/gradle/gradle/issues/25036)
+APP_HOME=$( cd "${APP_HOME:-./}" > /dev/null && pwd -P ) || exit
 
 # Use the maximum available, or set MAX_FD != -1 to use that value.
 MAX_FD=maximum
@@ -133,22 +131,29 @@ location of your Java installation."
     fi
 else
     JAVACMD=java
-    which java >/dev/null 2>&1 || die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
+    if ! command -v java >/dev/null 2>&1
+    then
+        die "ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
 
 Please set the JAVA_HOME variable in your environment to match the
 location of your Java installation."
     fi
+fi
 
 # Increase the maximum file descriptors if we can.
 if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
     case $MAX_FD in #(
       max*)
+        # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC3045
         MAX_FD=$( ulimit -H -n ) ||
             warn "Could not query maximum file descriptor limit"
     esac
     case $MAX_FD in  #(
       '' | soft) :;; #(
       *)
+        # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC3045
         ulimit -n "$MAX_FD" ||
             warn "Could not set maximum file descriptor limit to $MAX_FD"
     esac
@@ -193,6 +198,10 @@ if "$cygwin" || "$msys" ; then
     done
 fi
 
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
 # Collect all arguments for the java command;
 #   * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of
 #     shell script including quotes and variable substitutions, so put them in
@@ -205,6 +214,12 @@ set -- \
         org.gradle.wrapper.GradleWrapperMain \
         "$@"
 
+# Stop when "xargs" is not available.
+if ! command -v xargs >/dev/null 2>&1
+then
+    die "xargs is not available"
+fi
+
 # Use "xargs" to parse quoted args.
 #
 # With -n1 it outputs one arg per line, with the quotes and backslashes removed.

test/init-scripts/gradlew.bat

@@ -26,6 +26,7 @@ if "%OS%"=="Windows_NT" setlocal
 
 set DIRNAME=%~dp0
 if "%DIRNAME%"=="" set DIRNAME=.
+@rem This is normally unused
 set APP_BASE_NAME=%~n0
 set APP_HOME=%DIRNAME%
 
@@ -40,7 +41,7 @@ if defined JAVA_HOME goto findJavaFromJavaHome
 
 set JAVA_EXE=java.exe
 %JAVA_EXE% -version >NUL 2>&1
-if "%ERRORLEVEL%" == "0" goto execute
+if %ERRORLEVEL% equ 0 goto execute
 
 echo.
 echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
@@ -75,13 +76,15 @@ set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
 
 :end
 @rem End local scope for the variables with windows NT shell
-if "%ERRORLEVEL%"=="0" goto mainEnd
+if %ERRORLEVEL% equ 0 goto mainEnd
 
 :fail
 rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
 rem the _cmd.exe /c_ return code!
-if  not "" == "%GRADLE_EXIT_CONSOLE%" exit 1
-exit /b 1
+set EXIT_CODE=%ERRORLEVEL%
+if %EXIT_CODE% equ 0 set EXIT_CODE=1
+if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
+exit /b %EXIT_CODE%
 
 :mainEnd
 if "%OS%"=="Windows_NT" endlocal

test/init-scripts/settings.gradle

@@ -1,6 +1,6 @@
 plugins {
-    id "com.gradle.enterprise" version "3.12.3"
-    id "com.gradle.common-custom-user-data-gradle-plugin" version "1.8.2"
+    id "com.gradle.enterprise" version "3.15"
+    id "com.gradle.common-custom-user-data-gradle-plugin" version "1.11.2"
 }
 
 gradleEnterprise {

test/init-scripts/src/test/groovy/com/gradle/gradlebuildaction/BaseInitScriptTest.groovy

@@ -16,14 +16,17 @@ import java.nio.file.Files
 import java.util.zip.GZIPOutputStream
 
 class BaseInitScriptTest extends Specification {
+    static final String GE_PLUGIN_VERSION = '3.15'
+    static final String CCUD_PLUGIN_VERSION = '1.11.2'
 
     static final TestGradleVersion GRADLE_3_X = new TestGradleVersion(GradleVersion.version('3.5.1'), 7, 9)
     static final TestGradleVersion GRADLE_4_X = new TestGradleVersion(GradleVersion.version('4.10.3'), 7, 10)
     static final TestGradleVersion GRADLE_5_X = new TestGradleVersion(GradleVersion.version('5.6.4'), 8, 12)
     static final TestGradleVersion GRADLE_6_NO_BUILD_SERVICE = new TestGradleVersion(GradleVersion.version('6.5.1'), 8, 14)
-    static final TestGradleVersion GRADLE_6_X = new TestGradleVersion(GradleVersion.version('6.9.3'), 8, 15)
-    static final TestGradleVersion GRADLE_7_X = new TestGradleVersion(GradleVersion.version('7.6'), 8, 19)
-    static final TestGradleVersion GRADLE_8_X = new TestGradleVersion(GradleVersion.version('8.0.1'), 8, 19)
+    static final TestGradleVersion GRADLE_6_X = new TestGradleVersion(GradleVersion.version('6.9.4'), 8, 15)
+    static final TestGradleVersion GRADLE_7_X = new TestGradleVersion(GradleVersion.version('7.6.2'), 8, 19)
+    static final TestGradleVersion GRADLE_8_0 = new TestGradleVersion(GradleVersion.version('8.0.2'), 8, 19)
+    static final TestGradleVersion GRADLE_8_X = new TestGradleVersion(GradleVersion.version('8.3'), 8, 19)
 
     static final List<TestGradleVersion> ALL_VERSIONS = [
         GRADLE_3_X, // First version where TestKit supports environment variables
@@ -32,11 +35,15 @@ class BaseInitScriptTest extends Specification {
         GRADLE_6_NO_BUILD_SERVICE, // Last version without build service support
         GRADLE_6_X,
         GRADLE_7_X,
+        GRADLE_8_0,
         GRADLE_8_X,
     ]
 
     static final List<TestGradleVersion> CONFIGURATION_CACHE_VERSIONS =
-        [GRADLE_7_X, GRADLE_8_X]
+        [GRADLE_7_X, GRADLE_8_0, GRADLE_8_X]
+
+    static final List<TestGradleVersion> SETTINGS_PLUGIN_VERSIONS =
+        [GRADLE_6_X, GRADLE_7_X, GRADLE_8_0, GRADLE_8_X]
 
     static final String PUBLIC_BUILD_SCAN_ID = 'i2wepy2gr7ovw'
     static final String DEFAULT_SCAN_UPLOAD_TOKEN = 'scan-upload-token'
@@ -121,12 +128,17 @@ class BaseInitScriptTest extends Specification {
         buildFile << ''
     }
 
-    def declareGePluginApplication(GradleVersion gradleVersion) {
-        settingsFile.text = maybeAddPluginsToSettings(gradleVersion) + settingsFile.text
-        buildFile.text = maybeAddPluginsToRootProject(gradleVersion) + buildFile.text
+    def declareGePluginApplication(GradleVersion gradleVersion, URI serverUrl = mockScansServer.address) {
+        settingsFile.text = maybeAddPluginsToSettings(gradleVersion, null, serverUrl) + settingsFile.text
+        buildFile.text = maybeAddPluginsToRootProject(gradleVersion, null, serverUrl) + buildFile.text
     }
 
-    String maybeAddPluginsToSettings(GradleVersion gradleVersion) {
+    def declareGePluginAndCcudPluginApplication(GradleVersion gradleVersion, URI serverUrl = mockScansServer.address) {
+        settingsFile.text = maybeAddPluginsToSettings(gradleVersion, CCUD_PLUGIN_VERSION, serverUrl) + settingsFile.text
+        buildFile.text = maybeAddPluginsToRootProject(gradleVersion, CCUD_PLUGIN_VERSION, serverUrl) + buildFile.text
+    }
+
+    String maybeAddPluginsToSettings(GradleVersion gradleVersion, String ccudPluginVersion, URI serverUri) {
         if (gradleVersion < GradleVersion.version('5.0')) {
             '' // applied in build.gradle
         } else if (gradleVersion < GradleVersion.version('6.0')) {
@@ -134,10 +146,11 @@ class BaseInitScriptTest extends Specification {
         } else {
             """
               plugins {
-                id 'com.gradle.enterprise' version '3.12.3'
+                id 'com.gradle.enterprise' version '${GE_PLUGIN_VERSION}'
+                ${ccudPluginVersion ? "id 'com.gradle.common-custom-user-data-gradle-plugin' version '$ccudPluginVersion'" : ""}
               }
               gradleEnterprise {
-                server = '$mockScansServer.address'
+                server = '$serverUri'
                 buildScan {
                   publishAlways()
                 }
@@ -146,24 +159,26 @@ class BaseInitScriptTest extends Specification {
         }
     }
 
-    String maybeAddPluginsToRootProject(GradleVersion gradleVersion) {
+    String maybeAddPluginsToRootProject(GradleVersion gradleVersion, String ccudPluginVersion, URI serverUrl) {
         if (gradleVersion < GradleVersion.version('5.0')) {
             """
               plugins {
                 id 'com.gradle.build-scan' version '1.16'
+                ${ccudPluginVersion ? "id 'com.gradle.common-custom-user-data-gradle-plugin' version '$ccudPluginVersion'" : ""}
               }
               buildScan {
-                server = '$mockScansServer.address'
+                server = '$serverUrl'
                 publishAlways()
               }
             """
         } else if (gradleVersion < GradleVersion.version('6.0')) {
             """
               plugins {
-                id 'com.gradle.build-scan' version '3.12.3'
+                id 'com.gradle.build-scan' version '${GE_PLUGIN_VERSION}'
+                ${ccudPluginVersion ? "id 'com.gradle.common-custom-user-data-gradle-plugin' version '$ccudPluginVersion'" : ""}
               }
               gradleEnterprise {
-                server = '$mockScansServer.address'
+                server = '$serverUrl'
                 buildScan {
                   publishAlways()
                 }

test/init-scripts/src/test/groovy/com/gradle/gradlebuildaction/TestBuildResultRecorder.groovy

@@ -5,7 +5,7 @@ import groovy.json.JsonSlurper
 import static org.junit.Assume.assumeTrue
 
 class TestBuildResultRecorder extends BaseInitScriptTest {
-    def initScript = 'build-result-capture.init.gradle'
+    def initScript = 'gradle-build-action.build-result-capture.init.gradle'
 
     def "produces build results file for build with #testGradleVersion"() {
         assumeTrue testGradleVersion.compatibleWithCurrentJvm
@@ -148,6 +148,34 @@ class TestBuildResultRecorder extends BaseInitScriptTest {
         testGradleVersion << ALL_VERSIONS
     }
 
+    def "produces build results file with build scan when GE plugin is applied in settingsEvaluated"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        settingsFile.text = """
+            plugins {
+                id 'com.gradle.enterprise' version '3.15' apply(false)
+            }
+            gradle.settingsEvaluated {
+                apply plugin: 'com.gradle.enterprise'
+                gradleEnterprise {
+                    server = '$mockScansServer.address'
+                    buildScan {
+                        publishAlways()
+                    }
+                }
+            }
+        """ + settingsFile.text
+        
+        run(['help'], initScript, testGradleVersion.gradleVersion)
+
+        then:
+        assertResults('help', testGradleVersion, false, true)
+
+        where:
+        testGradleVersion << SETTINGS_PLUGIN_VERSIONS
+    }
+
     void assertResults(String task, TestGradleVersion testGradleVersion, boolean hasFailure, boolean hasBuildScan, boolean scanUploadFailed = false) {
         def results = new JsonSlurper().parse(buildResultFile)
         assert results['rootProjectName'] == ROOT_PROJECT_NAME

test/init-scripts/src/test/groovy/com/gradle/gradlebuildaction/TestDependencyGraph.groovy

@@ -0,0 +1,134 @@
+package com.gradle.gradlebuildaction
+
+import static org.junit.Assume.assumeTrue
+
+class TestDependencyGraph extends BaseInitScriptTest {
+    def initScript = 'gradle-build-action.github-dependency-graph.init.gradle'
+
+    static final List<TestGradleVersion> NO_DEPENDENCY_GRAPH_VERSIONS = [GRADLE_3_X, GRADLE_4_X]
+    static final List<TestGradleVersion> DEPENDENCY_GRAPH_VERSIONS = ALL_VERSIONS - NO_DEPENDENCY_GRAPH_VERSIONS
+
+    def "does not produce dependency graph when not enabled"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        run(['help'], initScript, testGradleVersion.gradleVersion)
+
+        then:
+        assert !reportsDir.exists()
+
+        where:
+        testGradleVersion << ALL_VERSIONS
+    }
+
+    def "produces dependency graph when enabled"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        run(['help'], initScript, testGradleVersion.gradleVersion, [], envVars)
+
+        then:
+        assert reportFile.exists()
+        assert gitHubOutputFile.text == "dependency-graph-file=${reportFile.absolutePath}\n"
+
+        where:
+        testGradleVersion << [GRADLE_8_X]
+    }
+
+    def "produces dependency graph with configuration-cache on latest Gradle"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        run(['help', '--configuration-cache'], initScript, testGradleVersion.gradleVersion, [], envVars)
+
+        then:
+        assert reportFile.exists()
+
+        where:
+        // Dependency-graph plugin doesn't support config-cache for 8.0 of Gradle
+        testGradleVersion << [GRADLE_8_X]
+    }
+
+    def "warns and produces no dependency graph when enabled for older Gradle versions"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        def result = run(['help'], initScript, testGradleVersion.gradleVersion, [], envVars)
+
+        then:
+        assert !reportsDir.exists()
+        assert result.output.contains("::warning::Dependency Graph is not supported")
+
+        where:
+        testGradleVersion << NO_DEPENDENCY_GRAPH_VERSIONS
+    }
+
+    def "constructs unique job correlator for each build invocation"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        def reportFile1 = new File(reportsDir, "CORRELATOR-1.json")
+        def reportFile2 = new File(reportsDir, "CORRELATOR-2.json")
+
+        buildFile << """
+            task firstTask {
+                doLast {
+                    println "First"
+                }
+            }
+            task secondTask {
+                doLast {
+                    println "Second"
+                }
+            }
+        """
+
+        when:
+        run(['help'], initScript, testGradleVersion.gradleVersion, [], envVars)
+
+        then:
+        assert reportFile.exists()
+
+        when:
+        run(['first'], initScript, testGradleVersion.gradleVersion, [], envVars)
+
+        then:
+        assert reportFile.exists()
+        assert reportFile1.exists()
+        
+        when:
+        run(['second'], initScript, testGradleVersion.gradleVersion, [], envVars)
+
+        then:
+        assert reportFile.exists()
+        assert reportFile1.exists()
+        assert reportFile2.exists()
+        
+        where:
+        testGradleVersion << DEPENDENCY_GRAPH_VERSIONS
+    }
+
+    def getEnvVars() {
+        return [
+            GITHUB_DEPENDENCY_GRAPH_ENABLED: "true",
+            GITHUB_DEPENDENCY_GRAPH_JOB_CORRELATOR: "CORRELATOR",
+            GITHUB_DEPENDENCY_GRAPH_JOB_ID: "1",
+            GITHUB_DEPENDENCY_GRAPH_REF: "main",
+            GITHUB_DEPENDENCY_GRAPH_SHA: "123456",
+            GITHUB_DEPENDENCY_GRAPH_WORKSPACE: testProjectDir.absolutePath,
+            DEPENDENCY_GRAPH_REPORT_DIR: reportsDir.absolutePath,
+            GITHUB_OUTPUT: gitHubOutputFile.absolutePath
+        ]
+    }
+
+    def getReportsDir() {
+        return new File(testProjectDir, 'build/reports/github-dependency-graph-snapshots')
+    }
+
+    def getReportFile() {
+        return new File(reportsDir, "CORRELATOR.json")
+    }
+
+    def getGitHubOutputFile() {
+        return new File(testProjectDir, "GITHUB_OUTPUT")
+    }
+}

test/init-scripts/src/test/groovy/com/gradle/gradlebuildaction/TestGradleEnterpriseInjection.groovy

@@ -0,0 +1,401 @@
+package com.gradle.gradlebuildaction
+
+import org.gradle.testkit.runner.BuildResult
+import org.gradle.util.GradleVersion
+
+import static org.junit.Assume.assumeTrue
+
+class TestGradleEnterpriseInjection  extends BaseInitScriptTest {
+    static final List<TestGradleVersion> CCUD_COMPATIBLE_VERSIONS = ALL_VERSIONS - [GRADLE_3_X]
+
+    def initScript = 'gradle-build-action.inject-gradle-enterprise.init.gradle'
+
+    private static final GradleVersion GRADLE_6 = GradleVersion.version('6.0')
+
+    def "does not apply GE plugins when not requested"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        def result = run([], initScript, testGradleVersion.gradleVersion)
+
+        then:
+        outputMissesGePluginApplicationViaInitScript(result)
+        outputMissesCcudPluginApplicationViaInitScript(result)
+
+        where:
+        testGradleVersion << ALL_VERSIONS
+    }
+
+    def "does not override GE plugin when already defined in project"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        given:
+        declareGePluginApplication(testGradleVersion.gradleVersion)
+
+        when:
+        def result = run(testGradleVersion, testConfig())
+
+        then:
+        outputMissesGePluginApplicationViaInitScript(result)
+        outputMissesCcudPluginApplicationViaInitScript(result)
+
+        and:
+        outputContainsBuildScanUrl(result)
+
+        where:
+        testGradleVersion << ALL_VERSIONS
+    }
+
+    def "applies GE plugin via init script when not defined in project"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        def result = run(testGradleVersion, testConfig())
+
+        then:
+        outputContainsGePluginApplicationViaInitScript(result, testGradleVersion.gradleVersion)
+        outputMissesCcudPluginApplicationViaInitScript(result)
+
+        and:
+        outputContainsBuildScanUrl(result)
+
+        where:
+        testGradleVersion << ALL_VERSIONS
+    }
+
+    def "applies GE and CCUD plugins via init script when not defined in project"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        def result = run(testGradleVersion, testConfig().withCCUDPlugin())
+
+        then:
+        outputContainsGePluginApplicationViaInitScript(result, testGradleVersion.gradleVersion)
+        outputContainsCcudPluginApplicationViaInitScript(result)
+
+        and:
+        outputContainsBuildScanUrl(result)
+
+        where:
+        testGradleVersion << CCUD_COMPATIBLE_VERSIONS
+    }
+
+    def "applies CCUD plugin via init script where GE plugin already applied"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        given:
+        declareGePluginApplication(testGradleVersion.gradleVersion)
+
+        when:
+        def result = run(testGradleVersion, testConfig().withCCUDPlugin())
+
+        then:
+        outputMissesGePluginApplicationViaInitScript(result)
+        outputContainsCcudPluginApplicationViaInitScript(result)
+
+        and:
+        outputContainsBuildScanUrl(result)
+
+        where:
+        testGradleVersion << CCUD_COMPATIBLE_VERSIONS
+    }
+
+    def "does not override CCUD plugin when already defined in project"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        given:
+        declareGePluginAndCcudPluginApplication(testGradleVersion.gradleVersion)
+
+        when:
+        def result = run(testGradleVersion, testConfig().withCCUDPlugin())
+
+        then:
+        outputMissesGePluginApplicationViaInitScript(result)
+        outputMissesCcudPluginApplicationViaInitScript(result)
+
+        and:
+        outputContainsBuildScanUrl(result)
+
+        where:
+        testGradleVersion << CCUD_COMPATIBLE_VERSIONS
+    }
+
+    def "ignores GE URL and allowUntrustedServer when GE plugin is not applied by the init script"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        given:
+        declareGePluginApplication(testGradleVersion.gradleVersion)
+
+        when:
+        def config = testConfig().withServer(URI.create('https://ge-server.invalid'))
+        def result = run(testGradleVersion, config)
+
+        then:
+        outputMissesGePluginApplicationViaInitScript(result)
+        outputMissesCcudPluginApplicationViaInitScript(result)
+
+        and:
+        outputContainsBuildScanUrl(result)
+
+        where:
+        testGradleVersion << ALL_VERSIONS
+    }
+
+    def "configures GE URL and allowUntrustedServer when GE plugin is applied by the init script"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        def config = testConfig().withServer(mockScansServer.address)
+        def result = run(testGradleVersion, config)
+
+        then:
+        outputContainsGePluginApplicationViaInitScript(result, testGradleVersion.gradleVersion)
+        outputContainsGeConnectionInfo(result, mockScansServer.address.toString(), true)
+        outputMissesCcudPluginApplicationViaInitScript(result)
+        outputContainsPluginRepositoryInfo(result, 'https://plugins.gradle.org/m2')
+
+        and:
+        outputContainsBuildScanUrl(result)
+
+        where:
+        testGradleVersion << ALL_VERSIONS
+    }
+
+    def "enforces GE URL and allowUntrustedServer in project if enforce url parameter is enabled"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        given:
+        declareGePluginApplication(testGradleVersion.gradleVersion, URI.create('https://ge-server.invalid'))
+
+        when:
+        def config = testConfig().withServer(mockScansServer.address, true)
+        def result = run(testGradleVersion, config)
+
+        then:
+        outputMissesGePluginApplicationViaInitScript(result)
+        outputMissesCcudPluginApplicationViaInitScript(result)
+
+        and:
+        outputEnforcesGeUrl(result, mockScansServer.address.toString(), true)
+
+        and:
+        outputContainsBuildScanUrl(result)
+
+        where:
+        testGradleVersion << ALL_VERSIONS
+    }
+
+    def "can configure alternative repository for plugins when GE plugin is applied by the init script"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        def config = testConfig().withPluginRepository(new URI('https://plugins.grdev.net/m2'))
+        def result = run(testGradleVersion, config)
+
+        then:
+        outputContainsGePluginApplicationViaInitScript(result, testGradleVersion.gradleVersion)
+        outputContainsGeConnectionInfo(result, mockScansServer.address.toString(), true)
+        outputMissesCcudPluginApplicationViaInitScript(result)
+        outputContainsPluginRepositoryInfo(result, 'https://plugins.grdev.net/m2')
+
+        and:
+        outputContainsBuildScanUrl(result)
+
+        where:
+        testGradleVersion << ALL_VERSIONS
+    }
+
+    def "stops gracefully when requested CCUD plugin version is <1.7"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        def config = testConfig().withCCUDPlugin("1.6.6")
+        def result = run(testGradleVersion, config)
+
+        then:
+        outputMissesGePluginApplicationViaInitScript(result)
+        outputMissesCcudPluginApplicationViaInitScript(result)
+        result.output.contains('Common Custom User Data Gradle plugin must be at least 1.7. Configured version is 1.6.6.')
+
+        where:
+        testGradleVersion << ALL_VERSIONS
+    }
+
+    def "can configure GE via CCUD system property overrides when CCUD plugin is inject via init script"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        def config = testConfig().withCCUDPlugin().withServer(URI.create('https://ge-server.invalid'))
+        def result = run(testGradleVersion, config, ["help", "-Dgradle.enterprise.url=${mockScansServer.address}".toString()])
+
+        then:
+        outputContainsGePluginApplicationViaInitScript(result, testGradleVersion.gradleVersion)
+        outputContainsCcudPluginApplicationViaInitScript(result)
+
+        and:
+        outputContainsBuildScanUrl(result)
+
+        where:
+        testGradleVersion << CCUD_COMPATIBLE_VERSIONS
+    }
+
+    def "init script is configuration cache compatible"() {
+        assumeTrue testGradleVersion.compatibleWithCurrentJvm
+
+        when:
+        def config = testConfig().withCCUDPlugin()
+        def result = run(testGradleVersion, config, ["help", "--configuration-cache"])
+
+        then:
+        outputContainsGePluginApplicationViaInitScript(result, testGradleVersion.gradleVersion)
+        outputContainsCcudPluginApplicationViaInitScript(result)
+
+        and:
+        outputContainsBuildScanUrl(result)
+
+        when:
+        result = run(testGradleVersion, config, ["help", "--configuration-cache"])
+
+        then:
+        outputMissesGePluginApplicationViaInitScript(result)
+        outputMissesCcudPluginApplicationViaInitScript(result)
+
+        and:
+        outputContainsBuildScanUrl(result)
+
+        where:
+        testGradleVersion << CONFIGURATION_CACHE_VERSIONS
+    }
+
+    void outputContainsBuildScanUrl(BuildResult result) {
+        def message = "Publishing build scan...\n${mockScansServer.address}s/$PUBLIC_BUILD_SCAN_ID"
+        assert result.output.contains(message)
+        assert 1 == result.output.count(message)
+    }
+
+    void outputContainsGePluginApplicationViaInitScript(BuildResult result, GradleVersion gradleVersion) {
+        def pluginApplicationLogMsgGradle4And5 = "Applying com.gradle.scan.plugin.BuildScanPlugin via init script"
+        def pluginApplicationLogMsgGradle6AndHigher = "Applying com.gradle.enterprise.gradleplugin.GradleEnterprisePlugin via init script"
+        if (gradleVersion < GRADLE_6) {
+            assert result.output.contains(pluginApplicationLogMsgGradle4And5)
+            assert 1 == result.output.count(pluginApplicationLogMsgGradle4And5)
+            assert !result.output.contains(pluginApplicationLogMsgGradle6AndHigher)
+        } else {
+            assert result.output.contains(pluginApplicationLogMsgGradle6AndHigher)
+            assert 1 == result.output.count(pluginApplicationLogMsgGradle6AndHigher)
+            assert !result.output.contains(pluginApplicationLogMsgGradle4And5)
+        }
+    }
+
+    void outputMissesGePluginApplicationViaInitScript(BuildResult result) {
+        def pluginApplicationLogMsgGradle4And5 = "Applying com.gradle.scan.plugin.BuildScanPlugin via init script"
+        def pluginApplicationLogMsgGradle6AndHigher = "Applying com.gradle.enterprise.gradleplugin.GradleEnterprisePlugin via init script"
+        assert !result.output.contains(pluginApplicationLogMsgGradle4And5)
+        assert !result.output.contains(pluginApplicationLogMsgGradle6AndHigher)
+    }
+
+    void outputContainsCcudPluginApplicationViaInitScript(BuildResult result) {
+        def pluginApplicationLogMsg = "Applying com.gradle.CommonCustomUserDataGradlePlugin via init script"
+        assert result.output.contains(pluginApplicationLogMsg)
+        assert 1 == result.output.count(pluginApplicationLogMsg)
+    }
+
+    void outputMissesCcudPluginApplicationViaInitScript(BuildResult result) {
+        def pluginApplicationLogMsg = "Applying com.gradle.CommonCustomUserDataGradlePlugin via init script"
+        assert !result.output.contains(pluginApplicationLogMsg)
+    }
+
+    void outputContainsGeConnectionInfo(BuildResult result, String geUrl, boolean geAllowUntrustedServer) {
+        def geConnectionInfo = "Connection to Gradle Enterprise: $geUrl, allowUntrustedServer: $geAllowUntrustedServer"
+        assert result.output.contains(geConnectionInfo)
+        assert 1 == result.output.count(geConnectionInfo)
+    }
+
+    void outputContainsPluginRepositoryInfo(BuildResult result, String gradlePluginRepositoryUrl) {
+        def repositoryInfo = "Gradle Enterprise plugins resolution: ${gradlePluginRepositoryUrl}"
+        assert result.output.contains(repositoryInfo)
+        assert 1 == result.output.count(repositoryInfo)
+    }
+
+    void outputEnforcesGeUrl(BuildResult result, String geUrl, boolean geAllowUntrustedServer) {
+        def enforceUrl = "Enforcing Gradle Enterprise: $geUrl, allowUntrustedServer: $geAllowUntrustedServer"
+        assert result.output.contains(enforceUrl)
+        assert 1 == result.output.count(enforceUrl)
+    }
+
+    private BuildResult run(TestGradleVersion testGradleVersion, TestConfig config, List<String> args = ["help"]) {
+        if (testKitSupportsEnvVars(testGradleVersion.gradleVersion)) {
+            return run(args, initScript, testGradleVersion.gradleVersion, [], config.envVars)
+        } else {
+            return run(args, initScript, testGradleVersion.gradleVersion, config.jvmArgs, [:])
+        }
+    }
+
+    private boolean testKitSupportsEnvVars(GradleVersion gradleVersion) {
+        // TestKit supports env vars for Gradle 3.5+, except on M1 Mac where only 6.9+ is supported
+        def isM1Mac = System.getProperty("os.arch") == "aarch64"
+        if (isM1Mac) {
+            return gradleVersion >= GRADLE_6_X.gradleVersion
+        } else {
+            return gradleVersion >= GRADLE_3_X.gradleVersion
+        }
+    }
+
+    private TestConfig testConfig() {
+        new TestConfig()
+    }
+
+    class TestConfig {
+        String serverUrl = mockScansServer.address.toString()
+        boolean enforceUrl = false
+        String ccudPluginVersion = null
+        String pluginRepositoryUrl = null
+
+        TestConfig withCCUDPlugin(String version = CCUD_PLUGIN_VERSION) {
+            ccudPluginVersion = version
+            return this
+        }
+
+        TestConfig withServer(URI url, boolean enforceUrl = false) {
+            serverUrl = url.toASCIIString()
+            this.enforceUrl = enforceUrl
+            return this
+        }
+
+        TestConfig withPluginRepository(URI pluginRepositoryUrl) {
+            this.pluginRepositoryUrl = pluginRepositoryUrl
+            return this
+        }
+
+        def getEnvVars() {
+            Map<String, String> envVars = [
+                GRADLE_ENTERPRISE_INJECTION_ENABLED: "true",
+                GRADLE_ENTERPRISE_URL: serverUrl,
+                GRADLE_ENTERPRISE_ALLOW_UNTRUSTED_SERVER: "true",
+                GRADLE_ENTERPRISE_PLUGIN_VERSION: GE_PLUGIN_VERSION,
+                GRADLE_ENTERPRISE_BUILD_SCAN_UPLOAD_IN_BACKGROUND: "true" // Need to upload in background since our Mock server doesn't cope with foreground upload
+            ]
+            if (enforceUrl) envVars.put("GRADLE_ENTERPRISE_ENFORCE_URL", "true")
+            if (ccudPluginVersion != null) envVars.put("GRADLE_ENTERPRISE_CCUD_PLUGIN_VERSION", ccudPluginVersion)
+            if (pluginRepositoryUrl != null) envVars.put("GRADLE_ENTERPRISE_PLUGIN_REPOSITORY_URL", pluginRepositoryUrl)
+
+            return envVars
+        }
+
+        def getJvmArgs() {
+            List<String> jvmArgs = [
+                "-Dgradle-enterprise.injection-enabled=true",
+                "-Dgradle-enterprise.url=$serverUrl",
+                "-Dgradle-enterprise.allow-untrusted-server=true",
+                "-Dgradle-enterprise.plugin.version=$GE_PLUGIN_VERSION",
+                "-Dgradle-enterprise.build-scan.upload-in-background=true"
+            ]
+
+            if (enforceUrl) jvmArgs.add("-Dgradle-enterprise.enforce-url=true")
+            if (ccudPluginVersion != null) jvmArgs.add("-Dgradle-enterprise.ccud-plugin.version=$ccudPluginVersion")
+            if (pluginRepositoryUrl != null) jvmArgs.add("-Dgradle-enterprise.plugin-repository.url=$pluginRepositoryUrl")
+
+            return jvmArgs.collect { it.toString() } // Convert from GStrings
+        }
+    }
+}

test/jest/cache-cleanup.test.ts

@@ -47,18 +47,18 @@ test('will cleanup unused gradle versions', async () => {
     // Run with only one of these versions
     await runGradleBuild(projectRoot, 'build')
 
-    const gradle733 = path.resolve(gradleUserHome, "caches/7.3.3")
-    const wrapper733 = path.resolve(gradleUserHome, "wrapper/dists/gradle-7.3.3-bin")
-    const gradleCurrent = path.resolve(gradleUserHome, "caches/7.6")
+    const gradle802 = path.resolve(gradleUserHome, "caches/8.0.2")
+    const wrapper802 = path.resolve(gradleUserHome, "wrapper/dists/gradle-8.0.2-bin")
+    const gradleCurrent = path.resolve(gradleUserHome, "caches/8.3")
 
-    expect(fs.existsSync(gradle733)).toBe(true)
-    expect(fs.existsSync(wrapper733)).toBe(true)
+    expect(fs.existsSync(gradle802)).toBe(true)
+    expect(fs.existsSync(wrapper802)).toBe(true)
     expect(fs.existsSync(gradleCurrent)).toBe(true)
 
     await cacheCleaner.forceCleanup()
 
-    expect(fs.existsSync(gradle733)).toBe(false)
-    expect(fs.existsSync(wrapper733)).toBe(false)
+    expect(fs.existsSync(gradle802)).toBe(false)
+    expect(fs.existsSync(wrapper802)).toBe(false)
     expect(fs.existsSync(gradleCurrent)).toBe(true)
 })
 

test/jest/cache-utils.test.ts

@@ -17,4 +17,10 @@ describe('cacheUtils-utils', () => {
             expect(posixHash).toBe(windowsHash)
         })
     })
+    describe('sanitizes workflow name in cache key', () => {
+        it('with comma', () => {
+            const cacheKey = cacheUtils.getCacheKeyForJob("Workflow, with,commas", "JOB_ID")
+            expect(cacheKey).toBe('workflow withcommas-JOB_ID')
+        })
+    })
 })

test/jest/dependency-graph.test.ts

@@ -0,0 +1,34 @@
+import * as dependencyGraph from '../../src/dependency-graph'
+
+describe('dependency-graph', () => {
+    describe('constructs job correlator', () => {
+        it('removes commas from workflow name', () => {
+            const id = dependencyGraph.constructJobCorrelator('Workflow, with,commas', 'jobid', '{}')
+            expect(id).toBe('workflow_withcommas-jobid')
+        })
+        it('removes non word characters', () => {
+            const id = dependencyGraph.constructJobCorrelator('Workflow!_with()characters', 'job-*id', '{"foo": "bar!@#$%^&*("}')
+            expect(id).toBe('workflow_withcharacters-job-id-bar')
+        })
+        it('replaces spaces', () => {
+            const id = dependencyGraph.constructJobCorrelator('Workflow !_ with () characters, and   spaces', 'job-*id', '{"foo": "bar!@#$%^&*("}')
+            expect(id).toBe('workflow___with_characters_and_spaces-job-id-bar')
+        })
+        it('without matrix', () => {
+            const id = dependencyGraph.constructJobCorrelator('workflow', 'jobid', 'null')
+            expect(id).toBe('workflow-jobid')
+        })
+        it('with dashes in values', () => {
+            const id = dependencyGraph.constructJobCorrelator('workflow-name', 'job-id', '{"os": "ubuntu-latest"}')
+            expect(id).toBe('workflow-name-job-id-ubuntu-latest')
+        })
+        it('with single matrix value', () => {
+            const id = dependencyGraph.constructJobCorrelator('workflow', 'jobid', '{"os": "windows"}')
+            expect(id).toBe('workflow-jobid-windows')
+        })
+        it('with composite matrix value', () => {
+            const id = dependencyGraph.constructJobCorrelator('workflow', 'jobid', '{"os": "windows", "java-version": "21.1", "other": "Value, with COMMA"}')
+            expect(id).toBe('workflow-jobid-windows-211-value_with_comma')
+        })
+    })
+})

test/jest/resources/cache-cleanup/gradle/wrapper/gradle-wrapper.properties

@@ -1,7 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
 # Deliberately not using the latest Gradle version for cache cleanup testing
-distributionUrl=https\://services.gradle.org/distributions/gradle-7.3.3-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.0.2-bin.zip
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists
-        

test/jest/resources/cache-cleanup/gradlew

@@ -55,7 +55,7 @@
 #       Darwin, MinGW, and NonStop.
 #
 #   (3) This script is generated from the Groovy template
-#       https://github.com/gradle/gradle/blob/master/subprojects/plugins/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
+#       https://github.com/gradle/gradle/blob/HEAD/subprojects/plugins/src/main/resources/org/gradle/api/internal/plugins/unixStartScript.txt
 #       within the Gradle project.
 #
 #       You can find Gradle at https://github.com/gradle/gradle/.
@@ -80,13 +80,10 @@ do
     esac
 done
 
-APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit
-
-APP_NAME="Gradle"
+# This is normally unused
+# shellcheck disable=SC2034
 APP_BASE_NAME=${0##*/}
-
-# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
-DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+APP_HOME=$( cd "${APP_HOME:-./}" && pwd -P ) || exit
 
 # Use the maximum available, or set MAX_FD != -1 to use that value.
 MAX_FD=maximum
@@ -143,12 +140,16 @@ fi
 if ! "$cygwin" && ! "$darwin" && ! "$nonstop" ; then
     case $MAX_FD in #(
       max*)
+        # In POSIX sh, ulimit -H is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC3045
         MAX_FD=$( ulimit -H -n ) ||
             warn "Could not query maximum file descriptor limit"
     esac
     case $MAX_FD in  #(
       '' | soft) :;; #(
       *)
+        # In POSIX sh, ulimit -n is undefined. That's why the result is checked to see if it worked.
+        # shellcheck disable=SC3045
         ulimit -n "$MAX_FD" ||
             warn "Could not set maximum file descriptor limit to $MAX_FD"
     esac
@@ -193,6 +194,10 @@ if "$cygwin" || "$msys" ; then
     done
 fi
 
+
+# Add default JVM options here. You can also use JAVA_OPTS and GRADLE_OPTS to pass JVM options to this script.
+DEFAULT_JVM_OPTS='"-Xmx64m" "-Xms64m"'
+
 # Collect all arguments for the java command;
 #   * $DEFAULT_JVM_OPTS, $JAVA_OPTS, and $GRADLE_OPTS can contain fragments of
 #     shell script including quotes and variable substitutions, so put them in
@@ -205,6 +210,12 @@ set -- \
         org.gradle.wrapper.GradleWrapperMain \
         "$@"
 
+# Stop when "xargs" is not available.
+if ! command -v xargs >/dev/null 2>&1
+then
+    die "xargs is not available"
+fi
+
 # Use "xargs" to parse quoted args.
 #
 # With -n1 it outputs one arg per line, with the quotes and backslashes removed.

test/jest/resources/cache-cleanup/gradlew.bat

@@ -26,6 +26,7 @@ if "%OS%"=="Windows_NT" setlocal
 
 set DIRNAME=%~dp0
 if "%DIRNAME%"=="" set DIRNAME=.
+@rem This is normally unused
 set APP_BASE_NAME=%~n0
 set APP_HOME=%DIRNAME%
 
@@ -40,7 +41,7 @@ if defined JAVA_HOME goto findJavaFromJavaHome
 
 set JAVA_EXE=java.exe
 %JAVA_EXE% -version >NUL 2>&1
-if "%ERRORLEVEL%" == "0" goto execute
+if %ERRORLEVEL% equ 0 goto execute
 
 echo.
 echo ERROR: JAVA_HOME is not set and no 'java' command could be found in your PATH.
@@ -75,13 +76,15 @@ set CLASSPATH=%APP_HOME%\gradle\wrapper\gradle-wrapper.jar
 
 :end
 @rem End local scope for the variables with windows NT shell
-if "%ERRORLEVEL%"=="0" goto mainEnd
+if %ERRORLEVEL% equ 0 goto mainEnd
 
 :fail
 rem Set variable GRADLE_EXIT_CONSOLE if you need the _script_ return code instead of
 rem the _cmd.exe /c_ return code!
-if  not "" == "%GRADLE_EXIT_CONSOLE%" exit 1
-exit /b 1
+set EXIT_CODE=%ERRORLEVEL%
+if %EXIT_CODE% equ 0 set EXIT_CODE=1
+if not ""=="%GRADLE_EXIT_CONSOLE%" exit %EXIT_CODE%
+exit /b %EXIT_CODE%
 
 :mainEnd
 if "%OS%"=="Windows_NT" endlocal