gateway: bump gradle/actions from 6.0.1 to 6.1.0

[dependabot]

Bumps gradle/actions from 6.0.1 to 6.1.0.

Release notes

Sourced from gradle/actions's releases.

v6.1.0

New: Basic Cache Provider

A new MIT-licensed Basic Caching provider is now available as an alternative to the proprietary Enhanced Caching provided by gradle-actions-caching. Choose Basic Caching by setting cache-provider: basic on setup-gradle or dependency-submission actions.

• Built on @actions/cache -- fully open source
• Caches ~/.gradle/caches and ~/.gradle/wrapper directories
• Cache key derived from build files (*.gradle*, gradle-wrapper.properties, etc.)
• Clean cache on build file changes (no restore keys, preventing stale entry accumulation)

Limitations vs Enhanced Caching: No cache cleanup, no deduplication of cached content, cached content is fixed unless build files change.

Revamped Licensing & Distribution Documentation

• New DISTRIBUTION.md documents the licensing of each component (particularly Basic Caching vs Enhanced Caching)
• Simplified licensing notices in README, docs, and runtime log output
• Clear usage tiers: Enhanced Caching is free for public repos and in Free Preview for private repos

What's Changed

• Use a unique cache entry for wrapper-validation test by @​bigdaz in gradle/actions#921
• Update Dependencies by @​bigdaz in gradle/actions#922
• Update dependencies and resolve npm vulnerabilities by @​bigdaz in gradle/actions#933
• Add open-source 'basic' cache provider and revamp licensing documentation by @​bigdaz in gradle/actions#930
• Restructure caching documentation for basic and enhanced providers by @​bigdaz in gradle/actions#934

Full Changelog: gradle/actions@v6.0.1...v6.1.0

Commits

• 50e97c2 Link to docs for caching providers
• f2e6298 Restructure caching documentation for basic and enhanced providers (#934)
• b294b1e Really fix integ-test-full
• 83d3189 Revise license details for gradle-actions-caching
• 1d5db06 Update license link for gradle-actions-caching component
• 1c80961 Fix license link for Enhanced Caching component
• 9e99920 Fix integ-test-full workflow
• bb8aaaf Fix workflow permissions
• f5dfb43 [bot] Update dist directory
• ff9ae24 Add open-source 'basic' cache provider and revamp licensing documentation (#930)
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot show <dependency name> ignore conditions will show all of the ignore conditions of the specified dependency
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[raboof]

This action now contains proprietary 'Enhanced Caching' code. Not sure if we're comfortable with that?

[potiuk]

Agreed. I missed it in previous version but I think we should just not allow it.

[dongjoon-hyun]

6.1.0 introduced cache-provider: basic feature. Can we allow 6.1.0 with cache-provider: basic?

• https://github.com/gradle/actions/releases/tag/v6.1.0

A new MIT-licensed Basic Caching provider is now available as an alternative to the proprietary Enhanced Caching provided by gradle-actions-caching. Choose Basic Caching by setting cache-provider: basic on setup-gradle or dependency-submission actions.

[potiuk]

6.1.0 introduced cache-provider: basic feature. Can we allow 6.1.0 with cache-provider: basic?

• https://github.com/gradle/actions/releases/tag/v6.1.0

A new MIT-licensed Basic Caching provider is now available as an alternative to the proprietary Enhanced Caching provided by gradle-actions-caching. Choose Basic Caching by setting cache-provider: basic on setup-gradle or dependency-submission actions.

I guess that changes things - the only thing it is not default, and we have - currently no way to verify it - unless we add custom check on our actions scanner.

[dongjoon-hyun]

Got it. So, is this Gradle action v6.0.1 hash going to be removed from the approved pattern soon?

[potiuk]

Got it. So, is this Gradle action v6.0.1 hash going to be removed from the approved pattern soon?

I guess - if we agree to that.

[raboof]

Having slept on this I think it is OK to leave this for the projects to decide.

Since it is possible to use the action transparently, and Gradle is a 'trustworthy' partner so we don't expect shenanigans even in the proprietary cache implementation, I think we can allow the action here and leave it up to the individual projects to decide their risk appetite.

While adding this check to a scanner tool would be neat, it doesn't seem like a high priority - we're already overloading projects with information so we should be careful with that.

Approving, but not merging yet, would be good to have more consensus.

[potiuk]

Having slept on this I think it is OK to leave this for the projects to decide.

Since it is possible to use the action transparently, and Gradle is a 'trustworthy' partner so we don't expect shenanigans even in the proprietary cache implementation, I think we can allow the action here and leave it up to the individual projects to decide their risk appetite.

While adding this check to a scanner tool would be neat, it doesn't seem like a high priority - we're already overloading projects with information so we should be careful with that.

Approving, but not merging yet, would be good to have more consensus.

I am ok with that - maybe we can - indeed add some checks in our current (and updated in the future) action checker for ASF PMCs. That could be a warning initially or error later if we find that gradle action is miconfigured.

[potiuk]

Is 2 people enough for a consensus ? :)

[raboof]

:D since the license change is actually already there since the previous update and I saw no other objections I think 2 is sufficient - we can always revisit this decision later.