[improve][ci] Publish Develocity Build Scans for the Docker images

[donat]

Motivation

The Gradle builds in Pulsar CI already publish Build Scans to develocity.apache.org. The two test images built in the same workflow publish nothing, so their builds are visible only in the job log. A Build Scan for each image shows the duration and cache use of each Dockerfile step, the build log and the packages in the image.

Modifications

The pulsar-java-test-image and pulsar-test-latest-version-image jobs gain a Setup Docker step before their image build. It runs the Develocity Docker build agent beside the build, using the setup-docker action from gradle/develocity-actions. The agent captures what reaches BuildKit, so the Dockerfiles and the Gradle dockerBuild tasks stay as they are.

The scans go to develocity.apache.org under the pulsar project, with the DEVELOCITY_ACCESS_KEY secret the Gradle builds already use. Pull request runs from forks have no access key, so they build the images as before and publish no scan.

Documentation for the action: https://github.com/gradle/develocity-actions#setup-docker-action

The pinned version of the action is on the ASF actions allowlist: apache/infrastructure-actions#1364

Verifying this change

• Make sure that the change passes the CI checks.

Tested on a mirror of this repository, where both image jobs built their images and published four Build Scans, two per job.

Does this pull request potentially affect one of the following parts:

If the box was checked, please highlight the changes

• Dependencies (add or upgrade a dependency)
• The public API
• The schema
• The default values of configurations
• The threading model
• The binary protocol
• The REST endpoints
• The admin CLI options
• The metrics
• Anything that affects deployment

[lhotari]

👋 Hi Donat, Thank you! Do you know if there's a way to get this working with the public https://scans.gradle.com/ service?

We have setup the Pulsar build this way so that it uses develocity.apache.org when DEVELOCITY_ACCESS_KEY is available (it's not available for PRs from forks):

pulsar/.github/actions/setup-gradle/action.yml

Lines 55 to 79 in 546a40c

	- name: Setup Gradle with Develocity
	if: ${{ inputs.develocity-access-key != '' && inputs.build-scan-publish == 'true' && github.event.repository.visibility == 'public' }}
	uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
	with:
	develocity-injection-enabled: true
	develocity-url: https://develocity.apache.org
	# expected format is develocity.apache.org:<access-key>
	develocity-access-key: ${{ inputs.develocity-access-key }}
	develocity-plugin-version: '4.5.1'
	develocity-ccud-plugin-version: '2.8.0'
	build-scan-publish: ${{ inputs.build-scan-publish == 'true' && github.event.repository.visibility == 'public' }}
	cache-read-only: ${{ inputs.cache-read-only }}
	add-job-summary: ${{ inputs.add-job-summary }}
	- name: Setup Gradle
	if: ${{ !(inputs.develocity-access-key != '' && inputs.build-scan-publish == 'true' && github.event.repository.visibility == 'public') }}
	uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
	with:
	build-scan-publish: ${{ inputs.build-scan-publish == 'true' && github.event.repository.visibility == 'public' }}
	build-scan-terms-of-use-url: 'https://gradle.com/terms-of-service'
	build-scan-terms-of-use-agree: 'yes'
	develocity-plugin-version: '4.5.1'
	develocity-ccud-plugin-version: '2.8.0'
	cache-read-only: ${{ inputs.cache-read-only }}
	add-job-summary: ${{ inputs.add-job-summary }}

We have also limited publishing from other than public repositories in .github/actions/setup-gradle/action.yml.

[donat]

Hi @lhotari! Nice to find a familiar face around here :)

Do you know if there's a way to get this working with the public https://scans.gradle.com/ service?

No, there's no Docker scans support available on scans.gradle.org.

it's not available for PRs from forks

This is a known limitation. No Docker scans for PRs from forks, unfortunately.