ci: Upgrade to JDK 21 and centralize CI configuration with new workflows (#4948)

.github/workflows/codeql.yml

@@ -70,7 +70,7 @@ jobs:
       uses: actions/setup-java@v5
       with:
         distribution: 'temurin' # See 'Supported distributions' for available options
-        java-version: '17'
+        java-version: '21'
         token: ${{ github.token }}
 
     # Initializes the CodeQL tools for scanning.

.github/workflows/dependency-submission.yml

@@ -18,7 +18,7 @@ jobs:
       - uses: actions/setup-java@v5
         with:
           distribution: temurin
-          java-version: 17
+          java-version: 21
           token: ${{ github.token }}
 
       - name: Generate and submit dependency graph

.github/workflows/docs.yml

@@ -47,15 +47,10 @@ jobs:
           submodules: 'recursive'
           ref: ${{ inputs.ref || '' }}
 
-      - name: Set up JDK 17
-        uses: actions/setup-java@v5
+      - name: Gradle Setup
+        uses: ./.github/actions/gradle-setup
         with:
-          java-version: '17'
-          distribution: 'temurin'
-          token: ${{ github.token }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
+          gradle_encryption_key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
 
       - name: Build Dokka HTML documentation
         run: ./gradlew dokkaGeneratePublicationHtml

.github/workflows/publish-core.yml

@@ -23,19 +23,10 @@ jobs:
         with:
           submodules: 'recursive'
 
-      - name: Set up JDK 17
-        uses: actions/setup-java@v5
+      - name: Gradle Setup
+        uses: ./.github/actions/gradle-setup
         with:
-          java-version: '17'
-          distribution: 'temurin'
-          token: ${{ github.token }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
-        with:
-          build-scan-publish: true
-          build-scan-terms-of-use-url: 'https://gradle.com/terms-of-service'
-          build-scan-terms-of-use-agree: 'yes'
+          gradle_encryption_key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
 
       - name: Configure Version
         id: version

.github/workflows/release.yml

@@ -125,19 +125,12 @@ jobs:
           ref: ${{ inputs.tag_name }}
           fetch-depth: 0
           submodules: 'recursive'
-      - name: Set up JDK 17
-        uses: actions/setup-java@v5
+
+      - name: Gradle Setup
+        uses: ./.github/actions/gradle-setup
         with:
-          java-version: '17'
-          distribution: 'temurin'
-          token: ${{ github.token }}
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
-        with:
-          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
-          build-scan-publish: true
-          build-scan-terms-of-use-url: 'https://gradle.com/terms-of-service'
-          build-scan-terms-of-use-agree: 'yes'
+          gradle_encryption_key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+          cache_read_only: 'false'
 
       - name: Load secrets
         env:
@@ -222,19 +215,12 @@ jobs:
           ref: ${{ inputs.tag_name }}
           fetch-depth: 0
           submodules: 'recursive'
-      - name: Set up JDK 17
-        uses: actions/setup-java@v5
+
+      - name: Gradle Setup
+        uses: ./.github/actions/gradle-setup
         with:
-          java-version: '17'
-          distribution: 'temurin'
-          token: ${{ github.token }}
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
-        with:
-          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
-          build-scan-publish: true
-          build-scan-terms-of-use-url: 'https://gradle.com/terms-of-service'
-          build-scan-terms-of-use-agree: 'yes'
+          gradle_encryption_key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+          cache_read_only: 'false'
 
       - name: Load secrets
         env:
@@ -294,21 +280,12 @@ jobs:
           ref: ${{ inputs.tag_name }}
           fetch-depth: 0
           submodules: 'recursive'
-          
-      - name: Set up JDK 17
-        uses: actions/setup-java@v5
-        with:
-          java-version: '17'
-          distribution: 'temurin'
-          token: ${{ github.token }}
 
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
+      - name: Gradle Setup
+        uses: ./.github/actions/gradle-setup
         with:
-          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
-          build-scan-publish: true
-          build-scan-terms-of-use-url: 'https://gradle.com/terms-of-service'
-          build-scan-terms-of-use-agree: 'yes'
+          gradle_encryption_key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+          cache_read_only: 'false'
 
       - name: Install dependencies for AppImage
         if: runner.os == 'Linux'

.github/workflows/reusable-check.yml

@@ -58,6 +58,8 @@ jobs:
     permissions:
       contents: read
     timeout-minutes: 60
+    outputs:
+      cache_read_only: ${{ steps.cache_config.outputs.cache_read_only }}
 
     steps:
       - name: Checkout code
@@ -66,26 +68,21 @@ jobs:
           fetch-depth: 0
           submodules: 'recursive'
 
-      - name: Validate Gradle Wrapper
-        uses: gradle/actions/wrapper-validation@v6
+      - name: Determine cache read-only setting
+        id: cache_config
+        shell: bash
+        run: |
+          if [[ "${{ github.ref }}" == "refs/heads/main" ]] || [[ "${{ github.event_name }}" == "merge_group" ]] || [[ "${{ github.ref }}" == gh-readonly-queue/* ]]; then
+            echo "cache_read_only=false" >> "$GITHUB_OUTPUT"
+          else
+            echo "cache_read_only=true" >> "$GITHUB_OUTPUT"
+          fi
 
-      - name: Set up JDK 17
-        uses: actions/setup-java@v5
+      - name: Gradle Setup
+        uses: ./.github/actions/gradle-setup
         with:
-          java-version: '17'
-          distribution: 'temurin'
-          token: ${{ github.token }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
-        with:
-          cache-read-only: ${{ github.ref != 'refs/heads/main' && github.event_name != 'merge_group' && !startsWith(github.ref, 'refs/heads/gh-readonly-queue/') }}
-          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
-          cache-cleanup: on-success
-          build-scan-publish: true
-          build-scan-terms-of-use-url: 'https://gradle.com/terms-of-service'
-          build-scan-terms-of-use-agree: 'yes'
-          add-job-summary: always
+          gradle_encryption_key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+          cache_read_only: ${{ steps.cache_config.outputs.cache_read_only }}
 
       - name: Code Style & Static Analysis
         if: inputs.run_lint == true
@@ -138,6 +135,7 @@ jobs:
     permissions:
       contents: read
     timeout-minutes: 60
+    needs: host-check
     strategy:
       fail-fast: true
       matrix:
@@ -150,26 +148,11 @@ jobs:
           fetch-depth: 0
           submodules: 'recursive'
 
-      - name: Validate Gradle Wrapper
-        uses: gradle/actions/wrapper-validation@v6
-
-      - name: Set up JDK 17
-        uses: actions/setup-java@v5
+      - name: Gradle Setup
+        uses: ./.github/actions/gradle-setup
         with:
-          java-version: '17'
-          distribution: 'temurin'
-          token: ${{ github.token }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
-        with:
-          cache-read-only: ${{ github.ref != 'refs/heads/main' && github.event_name != 'merge_group' && !startsWith(github.ref, 'refs/heads/gh-readonly-queue/') }}
-          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
-          cache-cleanup: on-success
-          build-scan-publish: true
-          build-scan-terms-of-use-url: 'https://gradle.com/terms-of-service'
-          build-scan-terms-of-use-agree: 'yes'
-          add-job-summary: always
+          gradle_encryption_key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+          cache_read_only: ${{ needs.host-check.outputs.cache_read_only }}
 
       - name: Determine matrix metadata
         id: matrix_meta
@@ -266,3 +249,35 @@ jobs:
             **/build/outputs/androidTest-results
           retention-days: 7
           if-no-files-found: ignore
+
+  build-desktop:
+    name: Build Desktop Debug
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+    timeout-minutes: 60
+    needs: host-check
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0
+          submodules: 'recursive'
+
+      - name: Gradle Setup
+        uses: ./.github/actions/gradle-setup
+        with:
+          gradle_encryption_key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+          cache_read_only: ${{ needs.host-check.outputs.cache_read_only }}
+
+      - name: Build Desktop
+        run: ./gradlew :desktop:packageDistributionForCurrentOS -Pci=true --scan
+
+      - name: Upload Desktop artifact
+        if: ${{ inputs.upload_artifacts }}
+        uses: actions/upload-artifact@v7
+        with:
+          name: desktop-app
+          path: desktop/build/compose/binaries/main/app/Meshtastic/bin/*
+          retention-days: 7

.github/workflows/scheduled-updates.yml

@@ -81,21 +81,11 @@ jobs:
       - name: Fix file permissions
         run: sudo chown -R $USER:$USER .
 
-      - name: Set up JDK 17
-        uses: actions/setup-java@v5
+      - name: Gradle Setup
+        uses: ./.github/actions/gradle-setup
         with:
-          java-version: '17'
-          distribution: 'temurin'
-          token: ${{ github.token }}
-
-      - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v6
-        with:
-          cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
-          build-scan-publish: true
-          build-scan-terms-of-use-url: 'https://gradle.com/terms-of-service'
-          build-scan-terms-of-use-agree: 'yes'
-          add-job-summary: always
+          gradle_encryption_key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+          cache_read_only: 'false'
 
       - name: Update Graphs
         run: ./gradlew graphUpdate