Micron Document
🎖️GitЯра🎖️

Node / meshtastic / Meshtastic-Android / commits / 5a8994a

Commit 5a8994a90e6eeae2a2199bb717e3cfc984d5dfc6

󰉖 Browse tree at this commit

Parents : c09bf1a
Author : James Rich <2199651+jamesarich@users.noreply.github.com>
Signature : Signature validation error
Date : 2026-08-02T20:43:00-05:00
Committer : GitHub <noreply@github.com>
Date : 2026-08-03T01:43:00Z

ci: restrict Develocity cache writes to trusted events (#6550)

Changes

1 files changed, 8 insertions(+), 1 deletions(-)

M build-logic/settings-plugin/src/main/kotlin/MeshtasticDevelocitySettingsPlugin.kt +8 -1

Diff

diff --git a/build-logic/settings-plugin/src/main/kotlin/MeshtasticDevelocitySettingsPlugin.kt b/build-logic/settings-plugin/src/main/kotlin/MeshtasticDevelocitySettingsPlugin.kt
index 6f624d2a28..928df2849f 100644
--- a/build-logic/settings-plugin/src/main/kotlin/MeshtasticDevelocitySettingsPlugin.kt
+++ b/build-logic/settings-plugin/src/main/kotlin/MeshtasticDevelocitySettingsPlugin.kt
@@ -61,7 +61,14 @@ class MeshtasticDevelocitySettingsPlugin : Plugin<Settings> {
remote(develocity.buildCache) {
isEnabled = true
val accessKey = System.getenv("DEVELOCITY_ACCESS_KEY")?.trim()
- isPush = isCI && !accessKey.isNullOrEmpty()
+ // Write only from trusted events. A same-repository pull request DOES
+ // receive repository secrets, so gating on the access key alone let PR
+ // builds write into the shared cache; excluding pull_request here keeps
+ // unmerged code out of it. Fork PRs have no key and are excluded twice
+ // over, and local builds are excluded by isCI.
+ val event = System.getenv("GITHUB_EVENT_NAME")
+ val trustedForPush = event == "push" || event == "merge_group"
+ isPush = isCI && trustedForPush && !accessKey.isNullOrEmpty()
}
}
}

Served by rngit 1.4.2 - Generated in 0.06s