Repository navigation
fix(ci): run only gradlew build for the Gradle plugin - #2474
Merged
Merged
Conversation
Release Please PRs (e.g. #2473) change the plugin version to a non-SNAPSHOT value. build.gradle applies maven-publish only for SNAPSHOT versions, so the publishToMavenLocal task does not exist and CI fails. Nothing in CI uses the artifact that publishToMavenLocal installs.
The GitHub Actions Scan runs zizmor on PRs that change workflow files. - Pin actions/checkout, actions/setup-java, and actions/cache to commit SHAs (mandatory unpinned-uses check). - Set persist-credentials: false on checkout (artipacked). - Set top-level permissions to contents: read (excessive-permissions).
hj690
changed the title
gradlew build for the Gradle plugingradlew build for the Gradle plugin
hj690
marked this pull request as ready for review
October 21, 2026 19:14
blakeli0
approved these changes
Oct 21, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
This PR changes
./gradlew build publishToMavenLocalto./gradlew buildin the 3 CI scripts that build the Gradle plugin. It fixes theunits (8)andunits (11)failures on Release Please PRs, such as #2473.Problem
The
units (8)job on #2473 fails with this error:gradle-plugin/build.gradleapplies themaven-publishplugin only whenversioncontainsSNAPSHOT. Themaven-publishplugin registers thepublishToMavenLocaltask.versioningradle-plugin/build.gradle. In chore(master): release dependencies 1.5.16 #2473, it changes1.5.16-SNAPSHOTto1.5.16.publishToMavenLocal. On a release version, Gradle does not applymaven-publish, so the task does not exist and the build fails.Why it is safe to remove
publishToMavenLocalpublishToMavenLocalonly copies the plugin into the CI machine's~/.m2. Nothing in CI reads it from there. The Gradle step is the last step, the functional tests load the plugin with TestKit withPluginClasspath(), and the release publishes with publishPlugins, not maven-publish. Removing the task loses no test coverage. It also fixes CI on Release Please PRs, where the version has no -SNAPSHOT suffix and the task does not exist.Zizmor fixes in
ci.yamlThe GitHub Actions Scan runs zizmor on PRs that change workflow files. This PR changes
ci.yaml, so the scan found existing problems in that file. So I also fixed them:unpinned-uses: Pinactions/checkout(v4.4.0),actions/setup-java(v1.4.5), andactions/cache(v4.3.0) to commit SHAs. The versions do not change.artipacked: Setpersist-credentials: falseonactions/checkout. No step uses git credentials after checkout.excessive-permissions: Set top-levelpermissions: contents: read. The job only reads the repository.