gradle/develocity-actions

Latest recorded source activity: October 28, 2026 at 10:41

SkillsMP catalog refreshed: November 9, 2026 at 14:22

skills collected: 1

GitHub stars: 11
GitHub forks: 9

Install with an AI assistant

Copy this prompt into the AI assistant you're using.

Follow https://skillsmp.com/skill-install/prompt.md to install Agent Skills from https://github.com/gradle/develocity-actions.

Repository README

Repository README source: README.md

Read the source README

Expand full README

# develocity-actions A collection of composite GitHub Actions related to [Develocity](https://gradle.com/develocity/): - [setup-maven](#setup-maven-action) - [maven-publish-build-scan](#maven-publish-build-scan-action) - [setup-npm](#setup-npm-action) - [setup-docker](#setup-docker-action) - [setup-python](#setup-python-action) --- ## setup-maven action ### Features The action enables three features: - [Build Summary](#build-summary): Display a summary of the Maven builds as a GitHub workflow summary or as a pull-request comment - [Develocity extensions injection](#develocity-extensions-injection): Inject Develocity/CCUD Maven extensions - [Capture Build Scan® data](#capture-build-scan-data): Capture published Build Scan® links and unpublished Build Scan® data as a workflow artifact per job with prefix `build-scan-data-maven`, which can then be published in a dependent workflow. > [!NOTE] > This action can be combined with the `maven-publish-build-scan` action to publish Build Scan® in a fork context. See [the relevant section](#maven-publish-build-scan-action) for details. ### Usage Insert the `Setup Maven` step once in each job having steps invoking Maven. Make sure to put the step before the Maven invocation. ```yaml name: PR Build jobs: build: - name: Setup Maven uses: gradle/develocity-actions/setup-maven@v2.0 - name: Build with Maven run: ./mvnw clean package [...] ``` > [!NOTE] > When authenticated access is required to publish a Build Scan®, it is recommended to provide as input `develocity-access-key` to the `setup-maven` and/or `setup-npm` steps. This triggers a request for a [short-lived access token](https://docs.develocity.ai/current/reference/develocity-api/#short-lived-access-tokens) instead of relying on the `DEVELOCITY_ACCESS_KEY` environment variable. --- #### Build Summary ###### Requirements - The Maven project must be compiled with JDK 8 or above - The Maven project must have the Develocity extension applied (or injected) The process is handled by a [Maven extension](https://maven.apache.org/guides/mini/guide-using-extensions.html) `maven-build-scan-capture-extension.jar` which is running during each Maven invocation. The extension is automatically registered by configuring the environment `MAVEN_OPTS=-Dmaven.ext.classpath=<PATH_TO_EXTENSION>`. > [!WARNING] > If `MAVEN_OPTS` environment variable is set in the step invoking the `mvn` command, the extension won't be registered. Make sure to use `MAVEN_OPTS: ${{ env.MAVEN_OPTS }} <EXTRA_PARAMETERS>` construction to append the extra parameters and have the extension registered. > [!WARNING] > The job name is computed by appending `github.job` to the current matrix value (if present). This works only when the matrix contains entries defined as single-dimension array. If a matrix entry is an array of objects, the computed `job-name` can be overridden with the `job-name` action input to avoid having `-object` in the job name. ###### Workflow Summary By default, a summary will be added to the GitHub workflow calling the action (can be skipped if `add-job-summary` is set to `false`): ![workflow](./doc/summary-workflow.png) ###### Pull-request Comment By default, a comment will be added to the pull-request with the summary (can be skipped if `add-pr-comment` is set to `false`): ![comment](./doc/summary-comment.png) **Permissions**: The following permissions are required for this feature to work: - `pull-requests: write`: to comment the pull-request > [!NOTE] > The pull-request comment is overwriting the previous summary comment if present, this means that if several jobs have a setup-maven step, only the last will have its summary commented in the PR. It is recommended to disable the pull-request summary in this case (`add-pr-comment: false`). ###### Raw Summary data Additionally, the summary details will be accessible in `$RUNNER_TEMP/build-scan-data-maven/build-metadata.json` with the format below: ```json { "prNumber": 42, "buildToolType": "maven", "builds": [ { "projectId": "maven-project", "workflowName": "PR Build", "jobName": "test-matrix", "buildToolVersion": "3.8.8", "requestedTasks": "clean build", "buildId": "1701252758489-c27ff62b-3ab5-45f4-b7e4-2b362cf5220e", "buildFailure": false, "buildTimestamp": "1701252760650", "buildScanLink": "https://<DEVELOCITY_URL>/s/itg2ytkifb6wa" }, { "projectId": "maven-project", "workflowName": "PR Build", "jobName": "test-matrix", "buildToolVersion": "3.8.8", "requestedTasks": "install", "buildId": "1701252760831-89e3583d-3c3c-4a64-a958-e61aa791f4f4", "buildFailure": true, "buildTimestamp": "1701252760800", "buildScanLink": "https://<DEVELOCITY_URL>/s/dxqnlj5hgybq4" } ] } ``` --- #### Develocity extensions injection If one wants to inject Develocity Maven Extension (and optionally CCUD Maven Extension), the `develocity-injection-enabled` input should be set to `true`. The `develocity-url`, `develocity-maven-extension-version`, and optionally `develocity-ccud-maven-extension-version` inputs should be set accordingly: ```yaml name: PR Build jobs: build: - name: Setup Maven uses: gradle/develocity-actions/setup-maven@v2.0 with: develocity-url: 'https://scans.gradle.com' develocity-injection-enabled: 'true' develocity-maven-extension-version: '<DV_EXTENSION_VERSION>' - name: Build with Maven run: ./mvnw clean package [...] ``` > [!NOTE] > DV_EXTENSION_VERSION needs to be adjusted to the expected version of the Develocity Maven Extension. --- #### Capture Build Scan® data ###### Requirements - The Maven project must be compiled with JDK 8 or above - The Maven project must have the Develocity extension applied (or injected) The process is handled by a [Maven extension](https://maven.apache.org/guides/mini/guide-using-extensions.html) `maven-build-scan-capture-extension.jar` which is running during each Maven invocation. The extension is automatically registered by configuring the environment `MAVEN_OPTS=-Dmaven.ext.classpath=<PATH_TO_EXTENSION>`. > [!WARNING] > If `MAVEN_OPTS` environment variable is set in the step invoking the `mvn` command, the extension won't be registered. Make sure to use `MAVEN_OPTS: ${{ env.MAVEN_OPTS }} <EXTRA_PARAMETERS>` construction to append the extra parameters and have the extension registered. ###### Configuration The _capture strategy_ can be customized: - `ALWAYS`: default behavior, capture will be attempted on each Maven invocation - `ON_FAILURE`: capture will be attempted only on failed builds - `ON_DEMAND`: capture will be attempted if `CAPTURE_BUILD_SCAN=true` in the environment The _capture_ can be _enabled_/_disabled_ separately: - `capture-unpublished-build-scans`: to disable unpublished Build Scan® capture - `capture-build-scan-links`: to disable Build Scan® link capture The captured files are added as workflow artifact (one artifact per job). When a Build Scan link is captured, it is added as output to the step invoking Maven. The output name is `build-scan-url` and can be used in subsequent steps of the workflow. **Event Triggers**: - `pull_request`: To capture unpublished Build Scan® - `workflow_run`: To capture Build Scan® links --- ### Action inputs | Name | Description | Default | |------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------| | `develocity-access-key` | *Optional*: Develocity access key. Should be set to a secret containing the Develocity Access key | `` | | `develocity-token-expiry` | *Optional*: Develocity short-lived access tokens expiry in hours | `2` | | `capture-strategy` | *Optional*: Build Scan capture strategy (ALWAYS, ON_FAILURE, ON_DEMAND) | `ALWAYS` | | `capture-unpublished-build-scans` | *Optional*: Enable unpublished Build Scans capture | `true` | | `capture-build-scan-links` | *Optional*: Enable Build Scan links capture | `true` | | `job-name` | *Optional*: Job name (used in summary and as artifact suffix) | | | `add-pr-comment` | *Optional*: Comment the pull-request with Build Scan links | `true` | | `add-job-summary` | *Optional*: Add a summary to the GitHub workflow | `true` | | `add-project-id-in-job-summary` | *Optional*: Add project id to the job summary / comment | `false` | | `develocity-injection-enabled` | *Optional*: Whether to enable or not Develocity/CCUD Maven Extensions injection | | | `develocity-url` | *Optional*: Develocity server URL | | | `develocity-maven-extension-version` | *Optional*: Develocity Maven Extension version to be injected | | | `develocity-ccud-maven-extension-version` | *Optional*: Common Custom User Data Maven Extension version to be injected | | | `develocity-maven-repository-url` | *Optional*: URL of the repository to use when resolving the Develocity and CCUD extensions | https://repo1.maven.org/maven2 | | `develocity-maven-repository-username` | *Optional*: Username for the repository URL to use when resolving the Develocity and CCUD extensions | | | `develocity-maven-repository-password` | *Optional*: Password for the repository URL to use when resolving the Develocity and CCUD extensions | | | `develocity-allow-untrusted-server` | *Optional*: Whether to allow communicating with untrusted server | | | `develocity-enforce-url` | *Optional*: Whether to enforce the URL over any defined locally to the project | | | `develocity-capture-file-fingerprints` | *Optional*: Whether to enable/disable capturing of file fingerprints. This setting is enabled by default | | | `develocity-custom-develocity-maven-extension-coordinates` | *Optional*: Will not inject the Develocity Maven extension if an extension with provided coordinates is found (value is an artifactId of the extension) | | | `develocity-custom-ccud-extension-coordinates` | *Optional*: Will not inject the CCUD extension if an extension with provided coordinates is found (value is an artifactId of the extension) | | --- ## maven-publish-build-scan action Publish Build Scans® for pull-requests issued from forked repositories ### Description When submitting a pull request from a forked GitHub repository, a GitHub workflow that validates the change cannot publish a Build Scan® as workflows from forked repositories do not have access to secrets. An access token is required to publish a Build Scan®. > [!NOTE] > The `Approve and Run` manual step documented [here](https://docs.github.com/en/actions/managing-workflow-runs/approving-workflow-runs-from-public-forks) must be enabled on the GitHub repository configuration to meet legal requirements (this is the default configuration). ### Maven workflow #### Architecture ![Architecture](./doc/architecture-publish-maven.png) #### Usage In the GitHub workflow called to validate a pull-request, insert the `Setup Maven` step once in each job having steps invoking Maven. ```yaml name: PR Build jobs: build: - name: Setup Maven uses: gradle/develocity-actions/setup-maven@v2.0 - name: Build with Maven run: ./mvnw clean package [...] ``` Add a new GitHub workflow to publish the Build Scans® saved during the previous step ```yaml name: Upload Build Scans on: workflow_run: workflows: [ "PR Build" ] types: [ completed ] jobs: publish-build-scans: runs-on: ubuntu-latest permissions: actions: write pull-requests: write steps: - name: Setup Build Scan link capture uses: gradle/develocity-actions/setup-maven@v2.0 - name: Publish Build Scans uses: gradle/develocity-actions/maven-publish-build-scan@v2.0 with: develocity-url: 'https://<MY_DEVELOCITY_URL>' develocity-access-key: ${{ secrets.<DEVELOCITY_ACCESS_KEY> }} ``` > [!NOTE] > Some parameters need to be adjusted here: > - The workflow name (here `PR Build`) triggered when a pull-request is submitted > - The Develocity URL (here `https://<MY_DEVELOCITY_URL>`) > - The secret name holding the Develocity access key (here `<DEVELOCITY_ACCESS_KEY>`) #### Implementation details The action will download any saved Build Scan® and publish them to Develocity. The list of pull-request authors allowed to publish a Build Scan® can be specified by the csv parameter `authorized-users-list`. The action will publish Build Scans® if the initial pull-request author belongs to the list or if the list is empty. **Event Triggers**: - `workflow_run`: to run after the build workflow. This event allows access to the repository secrets (_Develocity Access Key_) which is required to publish a Build Scan® to Develocity when authentication is enabled. **Permissions**: The following permissions are required for this action to operate: - `actions: write`: to delete a workflow artifact ### Action inputs | Name | Description | Default | |----------------------------------|------------------------------------------------------------------------------|-----------------------| | `develocity-url` | Develocity URL | | | `develocity-access-key` | *Optional*: Develocity access key | | | `develocity-allow-untrusted` | *Optional*: Develocity allow-untrusted flag | `false` | | `authorized-users-list` | *Optional*: CSV List of users allowed to publish Build Scans | `''` | | `github-token` | *Optional*: Github token | `${{ github.token }}` | --- ## Build the action ```bash npm run all ``` --- ## Release the action Run the `/release` [Claude Code skill](.claude/skills/release/SKILL.md), or manually: - Fill the release notes in `release/changelog.md` and merge the change - Push the new version as a tag, which publishes the GitHub release: ```bash git tag -a -m "vX.Y" vX.Y git push origin vX.Y ``` - Empty the release notes in `release/changelog.md` and merge the change to prepare for next development iteration --- ## setup-npm action ### Usage Insert the `Setup npm` step once in each job having steps invoking npm. Make sure to put the step before the npm invocation. ```yaml name: PR Build jobs: build: - name: Setup npm uses: gradle/develocity-actions/setup-npm@v2.0 - name: Build with npm run: npm run build [...] ``` ### Action inputs | Name | Description | Default | |------------------------------------------------------------|---------------------------------------------------------------------------------------------------------------------------------------------------------|--------------------------------| | `develocity-access-key` | *Optional*: Develocity access key. Should be set to a secret containing the Develocity Access key | `` | | `develocity-token-expiry` | *Optional*: Develocity short-lived access tokens expiry in hours | `2` | | `develocity-injection-enabled` | *Optional*: Whether to enable or not Develocity npm agent injection | | | `develocity-url` | *Optional*: Develocity server URL | | | `develocity-npm-agent-version` | *Optional*: Develocity npm agent version to be injected (ignored when `develocity-npm-agent-url-override` is set) | `latest` | | `develocity-npm-agent-install-location` | *Optional*: Develocity npm agent installation location | `~/.node_libraries` | | `develocity-pacote-version` | *Optional*: Version of pacote to use to install the Develocity npm build agent | `21.0.0` | | `develocity-allow-untrusted-server` | *Optional*: Whether to allow communicating with untrusted server | | | `develocity-npm-agent-url-override` | *Optional*: Override the URL to use to download the Develocity NPM agent | | ## setup-docker action ### Description Publishes a Build Scan® for every container image built in the job. The agent subscribes to BuildKit's build history stream, so it captures whatever reaches BuildKit without the build itself being changed: no Dockerfile edit, no wrapper script, no change to the command that builds the image. A build that talks to the Docker Engine API instead of BuildKit produces no history record and is not captured. ### Usage Insert the `Setup Docker` step in each job that builds an image, before the build runs. The agent is stopped automatically when the job ends, and the scans it published are written to the job summary. A job that builds on more than one builder can add one step per builder. ```yaml name: PR Build on: pull_request jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@v5 - name: Setup Docker uses: gradle/develocity-actions/setup-docker@v2.4 with: develocity-url: 'https://<develocity-server>' develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: Build image run: docker build -t my-image . ``` The agent runs on a JDK 21 or later that it finds on the runner. It deliberately does not use `actions/setup-java`, which would export `JAVA_HOME` and prepend `PATH` for the whole job and so change the JDK the build under test compiles with. When the runner has no suitable JDK, one is downloaded for the agent alone. When the job ends, the post step waits for a scan of every build BuildKit recorded since the agent started. It counts those builds with `docker buildx history`, which needs buildx 0.20 or later. GitHub-hosted Ubuntu runners have it. With an older buildx the post step warns that it cannot tell how many scans to wait for, and scans still queued in the agent may be lost. #### Naming the scans Capturing a scan needs no change to the build. Giving that scan a project name does. The name shown on the scan comes from the build's own `--build-arg DEVELOCITY_PROJECT_ID`, falling back to the last segment of the git repository. The build arg is also the project identifier sent when requesting a scan token. The `develocity-project-id` input below is sent there only for builds that declare no build arg, or an invalid one, and it never reaches the name on the scan. #### Builds on their own builder The agent attaches to whichever buildx builder is current when it starts, so the builder has to exist by then. Put the `Setup Docker` step after `docker/setup-buildx-action` or `docker buildx create`. A builder made current with `--use`, which `docker/setup-buildx-action` does by default, needs no further configuration. A job that builds on a builder that is not the current one has to name it through `buildx-builder`, otherwise those builds are invisible to the agent. #### Agent version The default `develocity-docker-agent-version` is the agent version this release of the action was tested with. Develocity rejects an agent that is newer than the server supports, so check the compatibility of your server before raising it. ### Action inputs | Name | Description | Default | |----------------------------------------|--------------------------------------------------------------------------------------------------------------------|---------| | `develocity-url` | *Required*: Develocity server URL | | | `develocity-access-key` | *Required*: Develocity access key. Should be set to a secret containing the Develocity Access key | `` | | `develocity-token-expiry` | *Optional*: Develocity short-lived access tokens expiry in hours | `2` | | `develocity-project-id` | *Optional*: Develocity project identifier sent when requesting a scan token for a build that declares none | | | `develocity-allow-untrusted-server` | *Optional*: Whether to allow communicating with untrusted server | | | `develocity-docker-agent-version` | *Optional*: Develocity Docker agent version (ignored when `develocity-docker-agent-url-override` is set) | `0.9.0` | | `develocity-docker-agent-url-override` | *Optional*: Override the URL to use to download the Develocity Docker agent jar | | | `develocity-docker-agent-java-home` | *Optional*: JDK 21 or later used to run the agent. Detected from the runner when not set | | | `develocity-package-scan-enabled` | *Optional*: Whether to catalogue the packages contained in each built image | `true` | | `buildx-builder` | *Optional*: Name of the buildx builder to attach to. Required when the job builds on a builder that is not current | | | `drain-timeout` | *Optional*: Seconds to wait for the agent to publish every captured build before stopping it. `0` skips the wait | `300` | | `shutdown-timeout` | *Optional*: Seconds the agent may spend on the build in flight once it has been signalled to stop | `120` | | `add-job-summary` | *Optional*: Whether to add or not a job summary listing the published Build Scans | `true` | ## setup-python action ### Description Installs the [Develocity Python agent](https://docs.develocity.ai/python/current/python-agent/) so that the supported Python tools run later in the job, such as pytest, pip, mypy or pylint, publish a Build Scan®. The agent is configured through environment variables, so the project needs no `.develocity.py`. A `.develocity.py` the project already has keeps applying (project name, tags, custom values), with the server URL and access key from this action taking precedence. The agent expects a `.develocity.py` next to the nearest `pyproject.toml` of the tool it instruments: with one at the repository root but none in a nested project, it publishes nothing for that project. Use either no `.develocity.py` at all, or one per project. ### Usage Insert the `Setup Develocity for Python` step after the step that sets up the interpreter and before the tools run. The agent is installed into that interpreter, with pip, or with `uv pip` when the interpreter has no pip, so it only instruments the tools run by it: a tool running in another virtual environment, such as a pre-commit hook, is not instrumented. The interpreter must be able to install packages: use one set up by `actions/setup-python` or a virtual environment. The system Python of the runner is externally managed (PEP 668), so pip and uv refuse to install into it. ```yaml name: PR Build on: pull_request jobs: build: runs-on: ubuntu-latest steps: - uses: actions/checkout@v5 - uses: actions/setup-python@v6 with: python-version: '3.12' - name: Setup Develocity for Python uses: gradle/develocity-actions/setup-python@v2.5 with: develocity-url: 'https://<develocity-server>' develocity-access-key: ${{ secrets.DEVELOCITY_ACCESS_KEY }} - name: Test run: pytest ``` Python support needs to be enabled in the Develocity license. The project name shown on the scan comes from `pyproject.toml`. The agent has no environment variable to change it, so a different name needs `configuration.project_name` in a `.develocity.py`. ### Action inputs | Name | Description | Default | |----------------------------------------|---------------------------------------------------------------------------------------------------------------------|----------| | `develocity-url` | *Required*: Develocity server URL | | | `develocity-access-key` | *Optional*: Develocity access key. Should be set to a secret containing the Develocity Access key | | | `develocity-token-expiry` | *Optional*: Develocity short-lived access tokens expiry in hours | `2` | | `develocity-injection-enabled` | *Optional*: Whether to enable or not Develocity Python agent injection | `true` | | `develocity-allow-untrusted-server` | *Optional*: Whether to allow communicating with untrusted server (sets `DEVELOCITY_ALLOW_INSECURE_PROTOCOL`) | | | `develocity-python-agent-version` | *Optional*: Develocity Python agent version (ignored when `develocity-python-agent-url-override` is set) | `0.10.1` | | `develocity-python-agent-url-override` | *Optional*: Override the URL to use to download the Develocity Python agent wheel | | | `develocity-python-agent-sha256` | *Optional*: Expected SHA-256 of the agent wheel. Known for the default version | | | `python-executable` | *Optional*: Python interpreter the agent is installed into | `python` |

Loading the repository README…

Skills in this repository

classification pending

skill

occupation

description

updated

release

unclassified

Release a new version of the develocity-actions. Use when asked to release, cut or tag a new version of the action.

2026-10-28

Showing 1 of 1 collected skill.