Disable gradle build cache on releases to mitigate supply chain risk (#8254)

Author: jack-berg

.github/workflows/build-daily.yml

@@ -34,7 +34,8 @@ jobs:
           SONATYPE_KEY: ${{ secrets.SONATYPE_KEY }}
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
           GPG_PASSWORD: ${{ secrets.GPG_PASSWORD }}
-          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
+          # disable gradle build cache, ensuring we're building from source to mitigate supply chain risk
+          DISABLE_REMOTE_BUILD_CACHE: true
 
   workflow-notification:
     permissions:

.github/workflows/release.yml

@@ -37,7 +37,8 @@ jobs:
           SONATYPE_KEY: ${{ secrets.SONATYPE_KEY }}
           GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
           GPG_PASSWORD: ${{ secrets.GPG_PASSWORD }}
-          DEVELOCITY_ACCESS_KEY: ${{ secrets.DEVELOCITY_ACCESS_KEY }}
+          # disable gradle build cache, ensuring we're building from source to mitigate supply chain risk
+          DISABLE_REMOTE_BUILD_CACHE: true
 
       - name: Set environment variables
         run: |

settings.gradle.kts

@@ -75,6 +75,7 @@ include(":animal-sniffer-signature")
 val develocityServer = "https://develocity.opentelemetry.io"
 val isCI = System.getenv("CI") != null
 val develocityAccessKey = System.getenv("DEVELOCITY_ACCESS_KEY") ?: ""
+val disableRemoteBuildCache = System.getenv("DISABLE_REMOTE_BUILD_CACHE") != null
 
 develocity {
   if (develocityAccessKey.isNotEmpty()) {
@@ -110,6 +111,7 @@ develocity {
 buildCache {
   remote(HttpBuildCache::class) {
     url = uri("$develocityServer/cache/")
+    isEnabled = !disableRemoteBuildCache
     isPush = isCI && develocityAccessKey.isNotEmpty()
   }
 }