gateway: bump gradle/actions from 6.0.1 to 6.1.0 by dependabot[bot] · Pull Request #681 · apache/infrastructure-actions

dependabot · 2026-04-08T13:36:33Z

Bumps gradle/actions from 6.0.1 to 6.1.0.

Release notes

Sourced from gradle/actions's releases.

v6.1.0

New: Basic Cache Provider

A new MIT-licensed Basic Caching provider is now available as an alternative to the proprietary Enhanced Caching provided by gradle-actions-caching. Choose Basic Caching by setting cache-provider: basic on setup-gradle or dependency-submission actions.

Built on @actions/cache -- fully open source

Caches ~/.gradle/caches and ~/.gradle/wrapper directories

Cache key derived from build files (*.gradle*, gradle-wrapper.properties, etc.)

Clean cache on build file changes (no restore keys, preventing stale entry accumulation)

Limitations vs Enhanced Caching: No cache cleanup, no deduplication of cached content, cached content is fixed unless build files change.

Revamped Licensing & Distribution Documentation

New DISTRIBUTION.md documents the licensing of each component (particularly Basic Caching vs Enhanced Caching)

Simplified licensing notices in README, docs, and runtime log output

Clear usage tiers: Enhanced Caching is free for public repos and in Free Preview for private repos

What's Changed

Use a unique cache entry for wrapper-validation test by @bigdaz in gradle/actions#921

Update Dependencies by @bigdaz in gradle/actions#922

Update dependencies and resolve npm vulnerabilities by @bigdaz in gradle/actions#933

Add open-source 'basic' cache provider and revamp licensing documentation by @bigdaz in gradle/actions#930

Restructure caching documentation for basic and enhanced providers by @bigdaz in gradle/actions#934

Full Changelog: gradle/actions@v6.0.1...v6.1.0

Commits

50e97c2 Link to docs for caching providers
f2e6298 Restructure caching documentation for basic and enhanced providers (#934)
b294b1e Really fix integ-test-full
83d3189 Revise license details for gradle-actions-caching
1d5db06 Update license link for gradle-actions-caching component
1c80961 Fix license link for Enhanced Caching component
9e99920 Fix integ-test-full workflow
bb8aaaf Fix workflow permissions
f5dfb43 [bot] Update dist directory
ff9ae24 Add open-source 'basic' cache provider and revamp licensing documentation (#930)
Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

@dependabot rebase will rebase this PR
@dependabot recreate will recreate this PR, overwriting any edits that have been made to it
@dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
@dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
@dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

Bumps [gradle/actions](https://github.com/gradle/actions) from 6.0.1 to 6.1.0. - [Release notes](https://github.com/gradle/actions/releases) - [Commits](gradle/actions@39e147c...50e97c2) --- updated-dependencies: - dependency-name: gradle/actions dependency-version: 6.1.0 dependency-type: direct:production update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com>

raboof · 2026-04-08T14:14:02Z

This action now contains proprietary 'Enhanced Caching' code. Not sure if we're comfortable with that?

potiuk · 2026-04-08T19:01:37Z

Agreed. I missed it in previous version but I think we should just not allow it.

dongjoon-hyun · 2026-04-08T21:35:53Z

6.1.0 introduced cache-provider: basic feature. Can we allow 6.1.0 with cache-provider: basic?

https://github.com/gradle/actions/releases/tag/v6.1.0

A new MIT-licensed Basic Caching provider is now available as an alternative to the proprietary Enhanced Caching provided by gradle-actions-caching. Choose Basic Caching by setting cache-provider: basic on setup-gradle or dependency-submission actions.

potiuk · 2026-04-08T23:38:33Z

6.1.0 introduced cache-provider: basic feature. Can we allow 6.1.0 with cache-provider: basic?

https://github.com/gradle/actions/releases/tag/v6.1.0

A new MIT-licensed Basic Caching provider is now available as an alternative to the proprietary Enhanced Caching provided by gradle-actions-caching. Choose Basic Caching by setting cache-provider: basic on setup-gradle or dependency-submission actions.

I guess that changes things - the only thing it is not default, and we have - currently no way to verify it - unless we add custom check on our actions scanner.

dongjoon-hyun · 2026-04-09T00:36:59Z

Got it. So, is this Gradle action v6.0.1 hash going to be removed from the approved pattern soon?

potiuk · 2026-04-09T00:59:07Z

Got it. So, is this Gradle action v6.0.1 hash going to be removed from the approved pattern soon?

I guess - if we agree to that.

raboof

Having slept on this I think it is OK to leave this for the projects to decide.

Since it is possible to use the action transparently, and Gradle is a 'trustworthy' partner so we don't expect shenanigans even in the proprietary cache implementation, I think we can allow the action here and leave it up to the individual projects to decide their risk appetite.

While adding this check to a scanner tool would be neat, it doesn't seem like a high priority - we're already overloading projects with information so we should be careful with that.

Approving, but not merging yet, would be good to have more consensus.

potiuk · 2026-04-09T07:46:16Z

Having slept on this I think it is OK to leave this for the projects to decide.

Since it is possible to use the action transparently, and Gradle is a 'trustworthy' partner so we don't expect shenanigans even in the proprietary cache implementation, I think we can allow the action here and leave it up to the individual projects to decide their risk appetite.

While adding this check to a scanner tool would be neat, it doesn't seem like a high priority - we're already overloading projects with information so we should be careful with that.

Approving, but not merging yet, would be good to have more consensus.

I am ok with that - maybe we can - indeed add some checks in our current (and updated in the future) action checker for ASF PMCs. That could be a warning initially or error later if we find that gradle action is miconfigured.

potiuk · 2026-04-09T07:48:15Z

Is 2 people enough for a consensus ? :)

raboof · 2026-04-09T08:23:32Z

:D since the license change is actually already there since the previous update and I saw no other objections I think 2 is sufficient - we can always revisit this decision later.

dongjoon-hyun · 2026-04-09T15:50:21Z

Thank you. It's great to have v6.1.0.

### What changes were proposed in this pull request? This PR adds `gradle/actions/setup-gradle` to GitHub Actions workflows (`build_and_test.yml`, `publish_snapshot_chart.yml`) and removes the `cache: 'gradle'` option from `actions/setup-java` and `Java Tool Chain caching` step since `setup-gradle` handles Gradle caching. ### Why are the changes needed? The `gradle/actions/setup-gradle` action is the officially recommended way to set up Gradle in GitHub Actions, offering several advantages over the `cache: 'gradle'` option in `actions/setup-java`: - actions/setup-java#588 - apache/infrastructure-actions#681 - apache/infrastructure-actions#696 Advantages: - **More efficient caching**: Provides more sophisticated and optimized caching of Gradle User Home between invocations, with detailed reporting of cache usage and configuration options. - **Dependency Graph support**: Can generate and submit a GitHub Dependency Graph for the project, enabling Dependabot security alerts. - **Build Scan link capture**: Automatically captures Build Scan links from the build, making them easier to locate in workflow runs. - **Separation of concerns**: `actions/setup-java` is a general-purpose Java setup tool. Delegating Gradle-specific setup to the dedicated first-party action avoids sub-optimal caching strategies (`actions/setup-java#588`). ### Does this PR introduce _any_ user-facing change? No. ### How was this patch tested? CI should pass with the updated workflows. ### Was this patch authored or co-authored using generative AI tooling? Generated-by: Claude Code (claude-opus-4-6) Closes #621 from dongjoon-hyun/SPARK-56401. Authored-by: Dongjoon Hyun <dongjoon@apache.org> Signed-off-by: Dongjoon Hyun <dongjoon@apache.org>

dependabot Bot added dependencies Pull requests that update a dependency file github_actions Pull requests that update GitHub Actions code labels Apr 8, 2026

dongjoon-hyun mentioned this pull request Apr 8, 2026

[SPARK-56401] Use setup-gradle v6.1.0 GitHub Actions in CIs apache/spark-kubernetes-operator#621

Closed

raboof approved these changes Apr 9, 2026

View reviewed changes

potiuk approved these changes Apr 9, 2026

View reviewed changes

raboof merged commit 92c5789 into main Apr 9, 2026
8 checks passed

raboof deleted the dependabot/github_actions/gradle/actions-6.1.0 branch April 9, 2026 08:23

jonnybot0 mentioned this pull request Apr 17, 2026

Update gradle setup action to one permitted by ASF apache/groovy-geb#324

Open

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

gateway: bump gradle/actions from 6.0.1 to 6.1.0#681

gateway: bump gradle/actions from 6.0.1 to 6.1.0#681
raboof merged 1 commit intomainfrom
dependabot/github_actions/gradle/actions-6.1.0

dependabot Bot commented on behalf of github Apr 8, 2026

Uh oh!

raboof commented Apr 8, 2026

Uh oh!

potiuk commented Apr 8, 2026

Uh oh!

dongjoon-hyun commented Apr 8, 2026 •

edited

Loading

Uh oh!

potiuk commented Apr 8, 2026

Uh oh!

dongjoon-hyun commented Apr 9, 2026

Uh oh!

potiuk commented Apr 9, 2026

Uh oh!

raboof left a comment

Uh oh!

potiuk commented Apr 9, 2026

Uh oh!

potiuk commented Apr 9, 2026 •

edited

Loading

Uh oh!

raboof commented Apr 9, 2026

Uh oh!

Uh oh!

dongjoon-hyun commented Apr 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Conversation

dependabot Bot commented on behalf of github Apr 8, 2026

v6.1.0

New: Basic Cache Provider

Revamped Licensing & Distribution Documentation

What's Changed

Uh oh!

raboof commented Apr 8, 2026

Uh oh!

potiuk commented Apr 8, 2026

Uh oh!

dongjoon-hyun commented Apr 8, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

potiuk commented Apr 8, 2026

Uh oh!

dongjoon-hyun commented Apr 9, 2026

Uh oh!

potiuk commented Apr 9, 2026

Uh oh!

raboof left a comment

Choose a reason for hiding this comment

Uh oh!

potiuk commented Apr 9, 2026

Uh oh!

potiuk commented Apr 9, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

raboof commented Apr 9, 2026

Uh oh!

Uh oh!

dongjoon-hyun commented Apr 9, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

dongjoon-hyun commented Apr 8, 2026 •

edited

Loading

potiuk commented Apr 9, 2026 •

edited

Loading