ci: make Gradle caching work by running the suite on main

[jamesnrokt]

Background

No Gradle cache entry has ever existed for this repo — the cache listing holds only Trunk entries. Unit Tests reports 116 actionable tasks: 116 executed and re-downloads the Gradle distribution every run; the instrumented jobs log Gradle User Home cache not found. Will initialize empty.

The cause is structural, which is why just adding setup-gradle would have fixed nothing: setup-gradle is read-only off the default branch, and an entry written on a PR ref is visible only to that PR — but this workflow never ran on a push to main. No run was ever permitted to write the cache that PR jobs read.

What changed

• Run this workflow on pushes to main, matching the other Rokt Android repos. Main runs may write, so the ordinary suite populates the cache — no bespoke warming job needed.
• Gate the four jobs that require a PR context to pull_request only: trunk-check (check-mode: pull_request), pr-check-hadcoded-secrets, security-checks (diff-aware against a base branch) and automerge-dependabot (reads the PR number). kit-compatibility-test and pr-notify were already gated.
• Add setup-gradle to the remaining Gradle jobs and replace the end-of-life gradle/gradle-build-action@v2.9.0 in instrumented-tests.yml. Pinned to the SHA the release workflows already use, so no new action version enters the supply chain.
• org.gradle.caching=true — without it, a warm dependency cache still leaves 116 executed.
• Pass --no-build-cache on every publish invocation in release-publish.yml and release-draft.yml, so released artifacts are always built from scratch and never assembled from cached task outputs.

cache-read-only: true is kept on build-kits.yml and instrumented-tests.yml, and only there. setup-gradle keys entries per job invocation, so build-kits' 22-kit matrix would otherwise write 22 entries per main commit and churn through the 10 GB repo limit.

Validation

Local populate pass, then clean and rebuild:

PASS A  2m 55s   42 actionable tasks: 40 executed, 2 from cache
PASS B  3s       42 actionable tasks: 12 executed, 23 from cache, 7 up-to-date

compileReleaseKotlin, compileReleaseJavaWithJavac and minifyReleaseWithR8 all FROM-CACHE, so outputs are correct as well as reused. actionlint and trunk check clean.

[cursor]

PR Summary

Low Risk
Changes are limited to CI configuration and Gradle caching flags; release builds are explicitly forced fresh with --no-build-cache.

Overview
CI now runs on pushes to main so Gradle dependency/build caches can be written on the default branch and reused by PR jobs (previously the workflow never ran on main, so caches could not populate).

Gradle setup is standardized across unit, lint, kit, instrumented, and build-kits jobs: gradle/actions/setup-gradle replaces the EOL gradle/gradle-build-action in instrumented tests; org.gradle.caching=true is enabled in gradle.properties. Matrix-heavy build-kits and instrumented workflows use cache-read-only: true to avoid cache churn from many writers.

PR-only jobs (trunk-check, security-checks, automerge-dependabot) are gated with if: github.event_name == 'pull_request'.

Release paths add --no-build-cache on all Maven publish/smoke steps in release-publish.yml and release-draft.yml so shipped artifacts are not assembled from cached task outputs.

^{Reviewed by Cursor Bugbot for commit d2896aa. Bugbot is set up for automated code reviews on this repo. Configure here.}

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
0.0% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud