Merge pull request #274 from tomorrow-one/gradle-wrapper-8.5

Add dependency-review-action, update gradle wrapper and gradle-build-action

.editorconfig

@@ -19,3 +19,12 @@ quote_type = single
 
 [*.md]
 trim_trailing_whitespace = false
+
+[*.bat]
+indent_style = unset
+indent_size = unset
+end_of_line = unset
+charset = unset
+trim_trailing_whitespace = unset
+insert_final_newline = unset
+

.github/workflows/gradle-build.yml

@@ -14,7 +14,8 @@ on:
     branches: [ "main" ]
 
 permissions:
-  contents: read
+  contents: write
+  # Note that this permission will not be available if the PR is from a forked repository
 
 jobs:
   build:
@@ -31,11 +32,25 @@ jobs:
         cache: 'gradle'
     - name: Validate gradle wrapper
       uses: gradle/wrapper-validation-action@v1
+    - name: Setup Gradle to generate and submit dependency graphs
+      uses: gradle/gradle-build-action@v2
+      with:
+        dependency-graph: generate-and-submit
     - name: Build
-      uses: gradle/gradle-build-action@v2.8.0
+      uses: gradle/gradle-build-action@v2
       with:
         arguments: build
 
+  dependency-review:
+    needs: build
+    runs-on: ubuntu-latest
+    steps:
+    - name: Perform dependency review
+      uses: actions/dependency-review-action@v3
+      with:
+        fail-on-severity: high
+        allow-ghsas: GHSA-h3qr-39j9-4r5v
+
   publish:
     needs: [ build ]
     if: github.event_name != 'pull_request' && github.ref == 'refs/heads/main'
@@ -49,7 +64,7 @@ jobs:
           distribution: 'temurin'
           cache: 'gradle'
       - name: Publish
-        uses: gradle/gradle-build-action@v2.8.0
+        uses: gradle/gradle-build-action@v2
         env:
           # variables used by build.gradle.kts for signing / publishing (without 'ORG_GRADLE_PROJECT_' prefix)
           ORG_GRADLE_PROJECT_signingKeyId: ${{ secrets.OSSRH_GPG_SECRET_KEY_ID }}

gradle/wrapper/gradle-wrapper.properties

@@ -1,5 +1,7 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-8.3-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.5-bin.zip
+networkTimeout=10000
+validateDistributionUrl=true
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists