Keep Gradle setup-action v5#953
Merged
Merged
Conversation
Member
Author
raboof
approved these changes
Jun 22, 2026
| gradle/actions/setup-gradle: | ||
| 0723195856401067f7a2779048b490ace7a47d7c: | ||
| tag: v5.0.2 | ||
| expires_at: 2028-06-20 |
Member
There was a problem hiding this comment.
instead of adding an expiration far in the future, you could add keep: true and add a comment why we want to keep this older version.
Some project still use and want to stick with v5. Version 6 of gradle/actions changes the licensing model for the default caching behavior used by setup-gradle. The action repository is still mostly MIT licensed, but the default "enhanced" caching provider uses the [proprietary gradle-actions-caching](https://github.com/gradle/actions/blob/v6.1.0/licenses/gradle-actions-caching-license.txt) component. Gradle [documents](https://github.com/gradle/actions/blob/v6.1.0/DISTRIBUTION.md#3-usage-tiers) enhanced caching for public repositories as free, and private repository use as currently available in a free preview. The same documentation also says Gradle plans usage-based pricing for undefined "large-scale commercial organizations". Use of the proprietary caching component is governed by [Gradle's Terms of Use](https://gradle.com/legal/gradle-technologies-terms-of-use/), which may change over time. Version 6 also provides an opt-in ["basic"](https://github.com/gradle/actions/blob/v6.1.0/docs/setup-gradle.md#basic-caching) caching provider under the MIT license, but it is not equivalent to the default enhanced provider. Basic caching uses actions/cache directly and lacks [enhanced](https://github.com/gradle/actions/blob/v6.1.0/docs/setup-gradle.md#enhanced-caching) caching's fine-grained Gradle User Home caching, intelligent cleanup, deduplication, or restore-key behavior. For Polaris CI, especially the incremental cache workflow, that would likely mean lower cache reuse and more cache growth over time. This is difficult for Polaris because contributors may run CI in private repositories, including private forks used for security work. With v6 defaults, those workflows would depend on proprietary, mutable terms whose future private repository terms and limits are not yet defined. Switching v6 to basic caching avoids the proprietary component, but gives up caching behavior that the workflow currently relies on.
snazy
force-pushed
the
keep-gradle-setup-v5
branch
from
07f6bec to
eb30661
Compare
Contributor
|
+1, Groovy and Grails are using 6 with the basic provider but good to know we'd have a fallback if we find issues with that provider down the track. |
Member
Author
|
Could we get this merged? Polaris CI is currently broken, as v5 is currently not allowed. |
potiuk
approved these changes
Jun 22, 2026
Member
|
Makes sense. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Some project still use and want to stick with v5.
Version 6 of gradle/actions changes the licensing model for the default caching behavior used by setup-gradle. The action repository is still mostly MIT licensed, but the default "enhanced" caching provider uses the proprietary gradle-actions-caching component.
Gradle documents enhanced caching for public repositories as free, and private repository use as currently available in a free preview. The same documentation also says Gradle plans usage-based pricing for undefined "large-scale commercial organizations". Use of the proprietary caching component is governed by Gradle's Terms of Use, which may change over time.
Version 6 also provides an opt-in "basic" caching provider under the MIT license, but it is not equivalent to the default enhanced provider. Basic caching uses actions/cache directly and lacks enhanced caching's fine-grained Gradle User Home caching, intelligent cleanup, deduplication, or restore-key behavior. For Polaris CI, especially the incremental cache workflow, that would likely mean lower cache reuse and more cache growth over time.
This is difficult for Polaris because contributors may run CI in private repositories, including private forks used for security work. With v6 defaults, those workflows would depend on proprietary, mutable terms whose future private repository terms and limits are not yet defined. Switching v6 to basic caching avoids the proprietary component, but gives up caching behavior that the workflow currently relies on.