Reduce Gradle cache writers and converge the remote cache

[trask]

Applies the cache fixes from opentelemetry-java-instrumentation#19532 and opentelemetry-java-instrumentation#19533 to reduce GitHub Actions cache pressure and improve Develocity remote cache coverage.

[Copilot]

Pull request overview

This PR adjusts Gradle caching and Develocity remote build cache configuration to reduce GitHub Actions cache churn and ensure the remote cache converges reliably, while limiting which CI runs can write caches.

Changes:

• Configure Gradle build cache to use remote(develocity.buildCache) and disable local build cache on the authenticated main-branch CI writer to improve remote cache convergence.
• Make additional GitHub Actions workflows use Gradle setup caches in read-only mode to reduce cache writers.
• Restrict DEVELOCITY_ACCESS_KEY exposure in CI to narrow when authenticated remote-cache writes can occur.

Reviewed changes

Copilot reviewed 5 out of 5 changed files in this pull request and generated 1 comment.

Show a summary per file

File	Description
settings.gradle.kts	Switches remote build cache configuration to Develocity’s build cache and conditionally disables local build cache for the authenticated main CI writer.
.github/workflows/build.yml	Tightens cache writer conditions and scopes Develocity access key usage to specific matrix/branch conditions.
.github/workflows/codeql.yml	Makes Gradle setup cache read-only for CodeQL and removes Develocity key usage from the build step.
.github/workflows/oats-tests.yml	Forces Gradle setup cache to read-only mode.
.github/workflows/prometheus-test.yml	Forces Gradle setup cache to read-only mode.

Suppressed comments (1)

.github/workflows/build.yml:48

• The workflow currently injects DEVELOCITY_ACCESS_KEY for workflow_dispatch runs on the default branch (because the condition only checks ref_name). That enables authenticated Develocity remote-cache writes even though this PR’s intent/description says workflow dispatches should be explicitly read-only. Gate the key injection on github.event_name == 'push' so only default-branch pushes can write to the remote cache.

        run: ./gradlew clean check shadowJar
        env:
          DEVELOCITY_ACCESS_KEY: >-
            ${{ matrix.os == 'ubuntu-latest' && github.ref_name == github.event.repository.default_branch && secrets.DEVELOCITY_ACCESS_KEY || '' }}

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.