Simplify gradle installation and automate upgrades #12934

yeikel · 2025-08-24T23:50:24Z

Same idea as #12717

yeikel · 2025-08-25T00:22:51Z

.github/dependabot.yml

+  - package-ecosystem: "docker"
+    directory: "/gradle"
+    schedule:
+      interval: "weekly"
+      day: "sunday"
+      time: "16:00"


Sample pull request https://github.com/yeikel/dependabot-core/pull/84/files

We can consider limiting this to only minor or patch upgrades. I am open for feedback

yeikel · 2025-08-25T00:23:08Z

gradle/Dockerfile

 RUN apt-get update && apt-get install -y --no-install-recommends \
    openjdk-21-jdk \
    ca-certificates-java \
-    wget \


wget is no longer needed

.github/dependabot.yml

        patterns:
          - "regclient/regctl*"
          - "sigstore/cosign/cosign*"
+  - package-ecosystem: "docker"


yeikel · 2025-12-04T13:44:16Z

gradle/Dockerfile

-RUN set -o errexit -o nounset \
-    && echo "Testing Gradle installation" \
-    && gradle --version


This is tested via the existing tests

yeikel · 2025-12-09T18:57:17Z

gradle/Dockerfile

+
 FROM ghcr.io/dependabot/dependabot-updater-core

-# Install Java


This is self-explanatory and the comment was just a distraction

yeikel · 2025-12-11T15:25:38Z

@kbukum1 Any chance you can review this as you reviewed #12717?

Thanks!

Copilot

Pull request overview

This PR simplifies Gradle installation by switching from manual download and installation to using the official Gradle Docker image, and adds Dependabot configuration to automate future Gradle version updates. This follows the same pattern established in PR #12717 for Maven.

Key changes:

Replaces manual Gradle installation (wget, sha256 verification, unzip) with the official gradle:8.14.3-jdk21-ubi-minimal Docker image
Adds Dependabot configuration for weekly automated updates of the Gradle Docker image
Updates from Gradle 8.14.2 to 8.14.3

Reviewed changes

Copilot reviewed 2 out of 2 changed files in this pull request and generated 5 comments.

File	Description
gradle/Dockerfile	Refactors to use official Gradle Docker image with multi-stage build pattern, removes manual installation logic, updates Java installation cleanup, and adjusts GRADLE_HOME/PATH configuration
.github/dependabot.yml	Adds weekly Dependabot monitoring for the gradle Dockerfile to automate Gradle version updates

Copilot · 2025-12-29T15:40:47Z

gradle/Dockerfile

+# By using dependabot-updater-core as the builder, we inherit $DEPENDABOT_HOME
+# We also need to include it below for the final build, and using it as a builder should not negatively impact build time
+FROM ghcr.io/dependabot/dependabot-updater-core AS builder
+
+# Copying all files from `$DEPENDABOT_HOME` with a builder consolidates the final copy into a single Docker layer
+COPY --from=gradle /opt/gradle $DEPENDABOT_HOME/gradle-installation
+
+COPY --chown=dependabot:dependabot --parents gradle maven common $DEPENDABOT_HOME
+COPY --chown=dependabot:dependabot updater $DEPENDABOT_HOME/dependabot-updater


The builder pattern used here differs from the Maven Dockerfile which uses a simpler approach. The Maven Dockerfile (lines 3-16) directly copies from the maven image in the final stage without an intermediate builder. This adds complexity with the builder stage that may not be necessary.

Consider simplifying to match the Maven pattern:

FROM docker.io/gradle:8.14.3-jdk21-ubi-minimal@sha256:... AS gradle FROM ghcr.io/dependabot/dependabot-updater-core # ... apt-get install ... COPY --from=gradle /opt/gradle $DEPENDABOT_HOME/gradle-installation USER dependabot ARG GRADLE_HOME=$DEPENDABOT_HOME/gradle-installation ENV PATH=$GRADLE_HOME/bin:$PATH COPY --chown=dependabot:dependabot --parents gradle maven common $DEPENDABOT_HOME/ COPY --chown=dependabot:dependabot updater $DEPENDABOT_HOME/dependabot-updater

This would consolidate the COPY operations and eliminate the need for the intermediate builder stage, making it more consistent with the Maven approach.

The builder is used to avoid unnecessary layers which improves the pull time

Copilot · 2025-12-29T15:40:48Z

gradle/Dockerfile

-    && echo "Testing Gradle installation" \
-    && gradle --version
+COPY --from=builder $DEPENDABOT_HOME $DEPENDABOT_HOME



The Gradle installation is no longer verified after installation. The previous version included a verification step that ran gradle --version to ensure the installation was successful. While the official Docker image is presumably tested, it would be safer to verify that Gradle is accessible on the PATH and functioning correctly in this environment.

Consider adding a verification step similar to what was removed, either as a RUN command or ensuring that the build process validates Gradle is available.

Suggested change

# Verify that Gradle is installed correctly and available on PATH

RUN gradle --version

This happens via our existing tests

gradle/Dockerfile

Copilot · 2025-12-29T15:40:48Z

gradle/Dockerfile

+# Copying all files from `$DEPENDABOT_HOME` with a builder consolidates the final copy into a single Docker layer
+COPY --from=gradle /opt/gradle $DEPENDABOT_HOME/gradle-installation


The comment states "Copying all files from $DEPENDABOT_HOME with a builder consolidates the final copy into a single Docker layer", but this actually creates MORE layers, not fewer. The Maven Dockerfile accomplishes the same result with fewer stages and layers by directly copying from the maven image in the final stage.

The claim about layer consolidation appears to be incorrect since the builder pattern here adds an extra stage without reducing the number of COPY operations in the final image.

It seems that Copilot is right about this one. I reverted that additional change for now

gradle/Dockerfile

yeikel · 2026-01-01T22:54:50Z

@kbukum1 I applied all of Copilot's feedback. Could you please take a second look?

github-actions bot added the L: java:gradle Maven packages via Gradle label Aug 24, 2025

yeikel changed the title ~~Simplify installation of gradle~~ Simplify installation of gradle and automate upgrades Aug 24, 2025

yeikel force-pushed the gradle-docker branch 2 times, most recently from 0a48f31 to 26a199e Compare August 24, 2025 23:56

yeikel changed the title ~~Simplify installation of gradle and automate upgrades~~ Simplify gradle installation and automate upgrades Aug 24, 2025

yeikel changed the title ~~Simplify gradle installation and automate upgrades~~ Simplify gradle installation and automate upgrades Aug 24, 2025

yeikel force-pushed the gradle-docker branch 2 times, most recently from 47a1b7a to 1de201b Compare August 25, 2025 00:03

yeikel marked this pull request as ready for review August 25, 2025 00:22

yeikel requested a review from a team as a code owner August 25, 2025 00:22

yeikel commented Aug 25, 2025

View reviewed changes

AbhishekBhaskar moved this to Scoping in Dependabot Aug 26, 2025

AbhishekBhaskar added this to Dependabot Aug 26, 2025

yeikel force-pushed the gradle-docker branch 3 times, most recently from dcb4ee7 to 3c1683d Compare August 30, 2025 00:20

yeikel force-pushed the gradle-docker branch 2 times, most recently from 06a7d9f to 697b995 Compare September 5, 2025 23:24

yeikel force-pushed the gradle-docker branch 3 times, most recently from 2bc32bb to 58ac6a3 Compare September 15, 2025 19:24

github-advanced-security bot found potential problems Nov 14, 2025

View reviewed changes

.github/dependabot.yml

patterns:

- "regclient/regctl*"

- "sigstore/cosign/cosign*"

- package-ecosystem: "docker"

Check warning

Code scanning / zizmor

insufficient cooldown in Dependabot updates Warning

insufficient cooldown in Dependabot updates

yeikel force-pushed the gradle-docker branch from 02ea9ee to 9382580 Compare November 30, 2025 20:22

github-actions bot added L: python L: python:uv labels Nov 30, 2025

yeikel force-pushed the gradle-docker branch 4 times, most recently from 3795b12 to 7fc8479 Compare November 30, 2025 20:25

yeikel force-pushed the gradle-docker branch 4 times, most recently from 432e5c4 to 8253645 Compare December 4, 2025 13:43

yeikel commented Dec 4, 2025

View reviewed changes

yeikel force-pushed the gradle-docker branch 6 times, most recently from 51fd628 to cd3f380 Compare December 9, 2025 18:54

yeikel commented Dec 9, 2025

View reviewed changes

yeikel force-pushed the gradle-docker branch 2 times, most recently from 17bcc7f to e72007f Compare December 11, 2025 15:24

yeikel force-pushed the gradle-docker branch 2 times, most recently from ba2985e to 402945c Compare December 16, 2025 06:04

yeikel force-pushed the gradle-docker branch from 402945c to 7e32396 Compare December 23, 2025 22:55

kbukum1 requested a review from Copilot December 29, 2025 15:37

Copilot started reviewing on behalf of kbukum1 December 29, 2025 15:37 View session

Copilot AI reviewed Dec 29, 2025

View reviewed changes

yeikel force-pushed the gradle-docker branch 2 times, most recently from ccf72ed to d9665ca Compare December 29, 2025 17:01

Simplify gradle installation and automate upgrades

67148e2

yeikel force-pushed the gradle-docker branch from d9665ca to 67148e2 Compare January 1, 2026 22:54


		FROM ghcr.io/dependabot/dependabot-updater-core

		# Install Java



	# Verify that Gradle is installed correctly and available on PATH
	RUN gradle --version

		# Copying all files from `$DEPENDABOT_HOME` with a builder consolidates the final copy into a single Docker layer
		COPY --from=gradle /opt/gradle $DEPENDABOT_HOME/gradle-installation

Simplify gradle installation and automate upgrades #12934

Are you sure you want to change the base?

Simplify gradle installation and automate upgrades #12934

Conversation

yeikel commented Aug 24, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

yeikel Aug 25, 2025

Choose a reason for hiding this comment

Uh oh!

yeikel Aug 25, 2025

Choose a reason for hiding this comment

Uh oh!

Check warning

yeikel Dec 4, 2025 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Choose a reason for hiding this comment

Uh oh!

yeikel Dec 9, 2025

Choose a reason for hiding this comment

Uh oh!

yeikel commented Dec 11, 2025

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Copilot AI Dec 29, 2025

Choose a reason for hiding this comment

Uh oh!

yeikel Dec 29, 2025

Choose a reason for hiding this comment

Uh oh!

Copilot AI Dec 29, 2025

Choose a reason for hiding this comment

Uh oh!

yeikel Dec 29, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Copilot AI Dec 29, 2025

Choose a reason for hiding this comment

Uh oh!

yeikel Dec 29, 2025

Choose a reason for hiding this comment

Uh oh!

Uh oh!

yeikel commented Jan 1, 2026

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant

yeikel commented Aug 24, 2025 •

edited

Loading

yeikel Dec 4, 2025 •

edited

Loading