chore: ignore gradle/actions/setup-gradle v6 in dependabot#317
chore: ignore gradle/actions/setup-gradle v6 in dependabot#317curfew-marathon merged 1 commit intomainfrom
Conversation
|
Important Review skippedAuto incremental reviews are disabled on this repository. Please check the settings in the CodeRabbit UI or the ⚙️ Run configurationConfiguration used: Organization UI Review profile: CHILL Plan: Pro Run ID: You can disable this status message by setting the Use the checkbox below for a quick retry:
WalkthroughAdded an ignore rule to the Dependabot GitHub Actions configuration to skip updates for gradle/actions/setup-gradle dependency versions in the 6.x range. Changes
Estimated code review effort🎯 1 (Trivial) | ⏱️ ~2 minutes Suggested reviewers
🚥 Pre-merge checks | ✅ 3✅ Passed checks (3 passed)
✏️ Tip: You can configure your own custom pre-merge checks in the settings. ✨ Finishing Touches🧪 Generate unit tests (beta)
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
There was a problem hiding this comment.
Pull request overview
Updates Dependabot configuration to prevent automatic upgrades to gradle/actions/setup-gradle@v6 due to pending legal/licensing/ToS concerns, keeping CI pinned to v5 until clarified.
Changes:
- Add a Dependabot ignore rule for
gradle/actions/setup-gradleversion range6.x.
💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
gradle/actions/setup-gradle v6 introduced a licensing change requiring acceptance of new Terms of Use tied to a proprietary caching component. The ToS language is broad and legally ambiguous, raising concerns about IP rights over cached build artifacts (e.g. sources.jar). Key concerns: - ToS grants Gradle broad rights over "user submissions", unclear scope - Disabling the new caching also disables Gradle distribution caching (known bug) - No clear legal guidance for private/commercial repos yet Gradle maintainers have stated no data is currently sent to Gradle and plan to clarify the ToS, but until that happens we stay on v5 to avoid accidental acceptance of unclear terms.
95ff443 to
ba7fc6f
Compare
Codecov Report✅ All modified and coverable lines are covered by tests. ❌ Your project status has failed because the head coverage (38.05%) is below the target coverage (80.00%). You can increase the head coverage or adjust the target coverage. Additional details and impacted files@@ Coverage Diff @@
## main #317 +/- ##
=========================================
Coverage 38.05% 38.05%
Complexity 1259 1259
=========================================
Files 198 198
Lines 7646 7646
Branches 885 885
=========================================
Hits 2910 2910
Misses 4598 4598
Partials 138 138 ☔ View full report in Codecov by Sentry. 🚀 New features to boost your workflow:
|
gradle/actions/setup-gradle v6 introduced a licensing change that requires acceptance of new Terms of Use tied to a proprietary caching component. The ToS language is broad and legally ambiguous — raising concerns about IP rights over cached build artifacts (e.g. sources.jar).
Key concerns:
Gradle maintainers have stated no data is currently sent to Gradle and plan to clarify the ToS, but until that happens we stay on v5 to avoid accidental acceptance of unclear terms.
Ref: gradle/actions#917
Description
What problem is being solved?
How is it being solved?
What changes are made to solve it?
References
Review Checklist
mainSummary by CodeRabbit