Skip to content

chore: ignore gradle/actions/setup-gradle v6 in dependabot#317

Merged
curfew-marathon merged 1 commit intomainfrom
chore/dependabot-ignore-setup-gradle-v6
Apr 1, 2026
Merged

chore: ignore gradle/actions/setup-gradle v6 in dependabot#317
curfew-marathon merged 1 commit intomainfrom
chore/dependabot-ignore-setup-gradle-v6

Conversation

@curfew-marathon
Copy link
Copy Markdown
Contributor

@curfew-marathon curfew-marathon commented Apr 1, 2026

gradle/actions/setup-gradle v6 introduced a licensing change that requires acceptance of new Terms of Use tied to a proprietary caching component. The ToS language is broad and legally ambiguous — raising concerns about IP rights over cached build artifacts (e.g. sources.jar).

Key concerns:

  • ToS grants Gradle broad rights over "user submissions", unclear scope
  • Disabling the new caching also disables Gradle distribution caching (known bug)
  • No clear legal guidance for private/commercial repos yet

Gradle maintainers have stated no data is currently sent to Gradle and plan to clarify the ToS, but until that happens we stay on v5 to avoid accidental acceptance of unclear terms.

Ref: gradle/actions#917

Description

What problem is being solved?

How is it being solved?

What changes are made to solve it?

References

Review Checklist

  • I have clicked on "allow edits by maintainers".
  • I have added documentation for new/changed functionality in this PR or in a PR to openfga.dev [Provide a link to any relevant PRs in the references section above]
  • The correct base branch is being used, if not main
  • I have added tests to validate that the change in functionality is working as expected

Summary by CodeRabbit

  • Chores
    • Updated GitHub Actions dependency management configuration to refine automated update handling.

Copilot AI review requested due to automatic review settings April 1, 2026 16:17
@curfew-marathon curfew-marathon requested a review from a team as a code owner April 1, 2026 16:17
@coderabbitai
Copy link
Copy Markdown
Contributor

coderabbitai bot commented Apr 1, 2026

Important

Review skipped

Auto incremental reviews are disabled on this repository.

Please check the settings in the CodeRabbit UI or the .coderabbit.yaml file in this repository. To trigger a single review, invoke the @coderabbitai review command.

⚙️ Run configuration

Configuration used: Organization UI

Review profile: CHILL

Plan: Pro

Run ID: f2a305a6-eb9f-4025-a914-9f8cb3e8bac2

You can disable this status message by setting the reviews.review_status to false in the CodeRabbit configuration file.

Use the checkbox below for a quick retry:

  • 🔍 Trigger review

Walkthrough

Added an ignore rule to the Dependabot GitHub Actions configuration to skip updates for gradle/actions/setup-gradle dependency versions in the 6.x range.

Changes

Cohort / File(s) Summary
Dependabot Configuration
.github/dependabot.yaml
Added ignore rule for gradle/actions/setup-gradle dependency to exclude version 6.x updates from Dependabot processing.

Estimated code review effort

🎯 1 (Trivial) | ⏱️ ~2 minutes

Suggested reviewers

  • rhamzeh
🚥 Pre-merge checks | ✅ 3
✅ Passed checks (3 passed)
Check name Status Explanation
Description Check ✅ Passed Check skipped - CodeRabbit’s high-level summary is enabled.
Title check ✅ Passed The title clearly and concisely describes the main change: adding a Dependabot ignore rule for gradle/actions/setup-gradle v6.
Docstring Coverage ✅ Passed No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.

✏️ Tip: You can configure your own custom pre-merge checks in the settings.

✨ Finishing Touches
🧪 Generate unit tests (beta)
  • Create PR with unit tests
  • Commit unit tests in branch chore/dependabot-ignore-setup-gradle-v6

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

Comment @coderabbitai help to get the list of available commands and usage tips.

Copy link
Copy Markdown
Contributor

Copilot AI left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Updates Dependabot configuration to prevent automatic upgrades to gradle/actions/setup-gradle@v6 due to pending legal/licensing/ToS concerns, keeping CI pinned to v5 until clarified.

Changes:

  • Add a Dependabot ignore rule for gradle/actions/setup-gradle version range 6.x.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

gradle/actions/setup-gradle v6 introduced a licensing change requiring
acceptance of new Terms of Use tied to a proprietary caching component.
The ToS language is broad and legally ambiguous, raising concerns about
IP rights over cached build artifacts (e.g. sources.jar).

Key concerns:
- ToS grants Gradle broad rights over "user submissions", unclear scope
- Disabling the new caching also disables Gradle distribution caching (known bug)
- No clear legal guidance for private/commercial repos yet

Gradle maintainers have stated no data is currently sent to Gradle and
plan to clarify the ToS, but until that happens we stay on v5 to avoid
accidental acceptance of unclear terms.
@curfew-marathon curfew-marathon force-pushed the chore/dependabot-ignore-setup-gradle-v6 branch from 95ff443 to ba7fc6f Compare April 1, 2026 16:46
@codecov-commenter
Copy link
Copy Markdown

codecov-commenter commented Apr 1, 2026

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 38.05%. Comparing base (6ba951a) to head (ba7fc6f).

❌ Your project status has failed because the head coverage (38.05%) is below the target coverage (80.00%). You can increase the head coverage or adjust the target coverage.

Additional details and impacted files
@@            Coverage Diff            @@
##               main     #317   +/-   ##
=========================================
  Coverage     38.05%   38.05%           
  Complexity     1259     1259           
=========================================
  Files           198      198           
  Lines          7646     7646           
  Branches        885      885           
=========================================
  Hits           2910     2910           
  Misses         4598     4598           
  Partials        138      138           

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:
  • ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

@curfew-marathon curfew-marathon added this pull request to the merge queue Apr 1, 2026
Merged via the queue into main with commit 14305a3 Apr 1, 2026
23 of 26 checks passed
@curfew-marathon curfew-marathon deleted the chore/dependabot-ignore-setup-gradle-v6 branch April 1, 2026 17:21
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

4 participants