|
| 1 | +/* |
| 2 | + * Shared remote HTTP Gradle build cache for Meshtastic KMP libraries. |
| 3 | + * |
| 4 | + * Credentials come from the GRADLE_CACHE_URL / GRADLE_CACHE_USERNAME / |
| 5 | + * GRADLE_CACHE_PASSWORD environment variables (CI secrets), or a |
| 6 | + * local.properties / config.properties entry for local use. Writes to the |
| 7 | + * cache happen only from trusted events (local dev, push, merge_group) with |
| 8 | + * credentials present, so pull-request runs (and credential-less fork PRs) |
| 9 | + * stay pull-only and cannot poison the cache. |
| 10 | + */ |
| 11 | + |
| 12 | +def getMeshProperty(String key) { |
| 13 | + def env = System.getenv(key) |
| 14 | + if (env) return env |
| 15 | + def currentDir = settingsDir |
| 16 | + while (currentDir != null) { |
| 17 | + for (name in ["local.properties", "config.properties"]) { |
| 18 | + def f = new File(currentDir, name) |
| 19 | + if (f.exists()) { |
| 20 | + def props = new Properties() |
| 21 | + f.withInputStream { props.load(it) } |
| 22 | + if (props.containsKey(key)) return props.getProperty(key) |
| 23 | + } |
| 24 | + } |
| 25 | + currentDir = currentDir.parentFile |
| 26 | + } |
| 27 | + return null |
| 28 | +} |
| 29 | + |
| 30 | +buildCache { |
| 31 | + local { |
| 32 | + enabled = true |
| 33 | + } |
| 34 | + remote(HttpBuildCache) { |
| 35 | + // Some cache servers return 403 on "Expect: 100-continue". |
| 36 | + useExpectContinue = false |
| 37 | + def cacheUrl = getMeshProperty("GRADLE_CACHE_URL")?.trim() |
| 38 | + def cacheUsername = getMeshProperty("GRADLE_CACHE_USERNAME")?.trim() |
| 39 | + def cachePassword = getMeshProperty("GRADLE_CACHE_PASSWORD")?.trim() |
| 40 | + if (cacheUrl) { |
| 41 | + // HTTPS + valid TLS enforced (no allowInsecureProtocol / no |
| 42 | + // allowUntrustedServer): the cache server must present a trusted |
| 43 | + // certificate over TLS. |
| 44 | + url = cacheUrl.endsWith("/") ? cacheUrl : "${cacheUrl}/" |
| 45 | + if (cacheUsername && cachePassword) { |
| 46 | + credentials { |
| 47 | + username = cacheUsername |
| 48 | + password = cachePassword |
| 49 | + } |
| 50 | + } |
| 51 | + // Write only from trusted events (local dev, push to a protected |
| 52 | + // branch, or the merge queue) with credentials — never from |
| 53 | + // pull_request runs, so unmerged code can't poison the cache. |
| 54 | + def eventName = System.getenv("GITHUB_EVENT_NAME") |
| 55 | + def trustedForPush = eventName == null || eventName == "push" || eventName == "merge_group" |
| 56 | + push = (cacheUsername && cachePassword && trustedForPush) |
| 57 | + enabled = true |
| 58 | + } else { |
| 59 | + enabled = false |
| 60 | + } |
| 61 | + } |
| 62 | +} |
0 commit comments