From c572f8729e0f614cd618cf78b52da8a620c668d0 Mon Sep 17 00:00:00 2001
From: rory <rory@expensify.com>
Date: Thu, 22 Oct 2026 15:26:58 -0700
Subject: [PATCH 1/2] ci: block compromised Java certificates

Protect the selected JVM before dependency downloads and other Java
network operations. Keep Gradle on the protected JDK so cached or
automatically downloaded toolchains cannot bypass the blocklist.
---
 .github/workflows/buildAndroid.yml            | 14 ++++++++++
 .../publishReactNativeAndroidArtifacts.yml    | 14 ++++++++++
 .../publishReactNativeiOSArtifacts.yml        | 25 +++++++++++++++++
 .github/workflows/remote-build-android.yml    | 28 +++++++++++++++++++
 4 files changed, 81 insertions(+)

diff --git a/.github/workflows/buildAndroid.yml b/.github/workflows/buildAndroid.yml
index 8bdba2f7e5f3..29b0ed83908e 100644
--- a/.github/workflows/buildAndroid.yml
+++ b/.github/workflows/buildAndroid.yml
@@ -122,6 +122,20 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e
 
+      - name: Block compromised Java certificates
+        uses: Expensify/GitHub-Actions/block-compromised-java-certificates@d8dfc3ddd4d8626206653c6168ca8d094547749a
+
+      - name: Restrict Gradle to the protected JDK
+        run: |
+          # Prevent cached or downloaded toolchains from bypassing the certificate blocklist.
+          mkdir -p "$HOME/.gradle"
+          cat >> "$HOME/.gradle/gradle.properties" <<EOF
+          org.gradle.java.installations.auto-detect=false
+          org.gradle.java.installations.auto-download=false
+          org.gradle.java.installations.fromEnv=JAVA_HOME
+          org.gradle.java.installations.paths=$JAVA_HOME
+          EOF
+
       - name: Setup 1Password CLI and certificates
         uses: Expensify/GitHub-Actions/setup-certificate-1p@main
         with:
diff --git a/.github/workflows/publishReactNativeAndroidArtifacts.yml b/.github/workflows/publishReactNativeAndroidArtifacts.yml
index 8048abe07e4d..04ee8525e72d 100644
--- a/.github/workflows/publishReactNativeAndroidArtifacts.yml
+++ b/.github/workflows/publishReactNativeAndroidArtifacts.yml
@@ -83,6 +83,20 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e
 
+      - name: Block compromised Java certificates
+        uses: Expensify/GitHub-Actions/block-compromised-java-certificates@d8dfc3ddd4d8626206653c6168ca8d094547749a
+
+      - name: Restrict Gradle to the protected JDK
+        run: |
+          # Prevent cached or downloaded toolchains from bypassing the certificate blocklist.
+          mkdir -p "$HOME/.gradle"
+          cat >> "$HOME/.gradle/gradle.properties" <<EOF
+          org.gradle.java.installations.auto-detect=false
+          org.gradle.java.installations.auto-download=false
+          org.gradle.java.installations.fromEnv=JAVA_HOME
+          org.gradle.java.installations.paths=$JAVA_HOME
+          EOF
+
       - name: Determine new patched RN version
         id: getNewPatchedVersion
         run: echo "NEW_PATCHED_VERSION=$(./.github/scripts/getNewPatchedRNVersion.sh)" >> "$GITHUB_OUTPUT"
diff --git a/.github/workflows/publishReactNativeiOSArtifacts.yml b/.github/workflows/publishReactNativeiOSArtifacts.yml
index 56aebc1d2322..691b841ffe59 100644
--- a/.github/workflows/publishReactNativeiOSArtifacts.yml
+++ b/.github/workflows/publishReactNativeiOSArtifacts.yml
@@ -234,6 +234,31 @@ jobs:
           path: /tmp/ios-artifacts
           merge-multiple: true
 
+      - name: Get Java version
+        id: get-java-version
+        uses: ./.github/actions/composite/getJavaVersion
+
+      - name: Setup Java
+        # v5.2.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654
+        with:
+          distribution: oracle
+          java-version: ${{ steps.get-java-version.outputs.version }}
+
+      - name: Block compromised Java certificates
+        uses: Expensify/GitHub-Actions/block-compromised-java-certificates@d8dfc3ddd4d8626206653c6168ca8d094547749a
+
+      - name: Restrict Gradle to the protected JDK
+        run: |
+          # Prevent cached or downloaded toolchains from bypassing the certificate blocklist.
+          mkdir -p "$HOME/.gradle"
+          cat >> "$HOME/.gradle/gradle.properties" <<EOF
+          org.gradle.java.installations.auto-detect=false
+          org.gradle.java.installations.auto-download=false
+          org.gradle.java.installations.fromEnv=JAVA_HOME
+          org.gradle.java.installations.paths=$JAVA_HOME
+          EOF
+
       - name: Publish to GitHub Packages Maven
         run: ./android/gradlew -p scripts/artifacts-utils/ios/publish publish -PartifactsDir="/tmp/ios-artifacts" -PpatchedVersion="${PATCHED_VERSION}" -PpatchesHash="${PATCHES_HASH}" -PpackageName="${PACKAGE_NAME}"
         env:
diff --git a/.github/workflows/remote-build-android.yml b/.github/workflows/remote-build-android.yml
index e24ff55b08b6..b3966926815e 100644
--- a/.github/workflows/remote-build-android.yml
+++ b/.github/workflows/remote-build-android.yml
@@ -90,6 +90,32 @@ jobs:
           role-duration-seconds: 21600
           aws-region: us-east-1
 
+      - name: Get Java version
+        id: get-java-version
+        uses: ./.github/actions/composite/getJavaVersion
+
+      - name: Setup Java
+        # v5.2.0
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654
+        with:
+          distribution: adopt
+          java-version: ${{ steps.get-java-version.outputs.version }}
+          cache: gradle
+
+      - name: Block compromised Java certificates
+        uses: Expensify/GitHub-Actions/block-compromised-java-certificates@d8dfc3ddd4d8626206653c6168ca8d094547749a
+
+      - name: Restrict Gradle to the protected JDK
+        run: |
+          # Prevent cached or downloaded toolchains from bypassing the certificate blocklist.
+          mkdir -p "$HOME/.gradle"
+          cat >> "$HOME/.gradle/gradle.properties" <<EOF
+          org.gradle.java.installations.auto-detect=false
+          org.gradle.java.installations.auto-download=false
+          org.gradle.java.installations.fromEnv=JAVA_HOME
+          org.gradle.java.installations.paths=$JAVA_HOME
+          EOF
+
       - name: Rock Remote Build - Android
         # rock v3
         uses: callstackincubator/android@1a7d52dfe3ca195ccbe5ad2f06c15f2fc3835115
@@ -98,6 +124,8 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
           IS_HYBRID_APP: ${{ matrix.is_hybrid_build }}
         with:
+          # Java is installed and protected before Rock can run Gradle.
+          setup-java: false
           variant: ${{ matrix.variant }}
           rock-build-extra-params: '--extra-params -PreactNativeArchitectures=arm64-v8a,x86_64'
           comment-bot: false

From 8dc91b014c4a2b0abdc8cd99ce0e64b2ae2ec59d Mon Sep 17 00:00:00 2001
From: rory <rory@expensify.com>
Date: Thu, 22 Oct 2026 16:29:26 -0700
Subject: [PATCH 2/2] ci: reuse shared Gradle JDK restrictions

Adopt the merged GitHub-Actions Gradle opt-in instead of duplicating its toolchain restrictions in each workflow. Keep remediation after setup/cache restoration and before Java network use.
---
 .github/workflows/buildAndroid.yml                | 15 +++------------
 .../publishReactNativeAndroidArtifacts.yml        | 15 +++------------
 .../workflows/publishReactNativeiOSArtifacts.yml  | 15 +++------------
 .github/workflows/remote-build-android.yml        | 15 +++------------
 4 files changed, 12 insertions(+), 48 deletions(-)

diff --git a/.github/workflows/buildAndroid.yml b/.github/workflows/buildAndroid.yml
index 29b0ed83908e..81305fe28dec 100644
--- a/.github/workflows/buildAndroid.yml
+++ b/.github/workflows/buildAndroid.yml
@@ -123,18 +123,9 @@ jobs:
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e
 
       - name: Block compromised Java certificates
-        uses: Expensify/GitHub-Actions/block-compromised-java-certificates@d8dfc3ddd4d8626206653c6168ca8d094547749a
-
-      - name: Restrict Gradle to the protected JDK
-        run: |
-          # Prevent cached or downloaded toolchains from bypassing the certificate blocklist.
-          mkdir -p "$HOME/.gradle"
-          cat >> "$HOME/.gradle/gradle.properties" <<EOF
-          org.gradle.java.installations.auto-detect=false
-          org.gradle.java.installations.auto-download=false
-          org.gradle.java.installations.fromEnv=JAVA_HOME
-          org.gradle.java.installations.paths=$JAVA_HOME
-          EOF
+        uses: Expensify/GitHub-Actions/block-compromised-java-certificates@b70c378d6cfae84f6844379eef3568cb33ea9680
+        with:
+          restrict-gradle: 'true'
 
       - name: Setup 1Password CLI and certificates
         uses: Expensify/GitHub-Actions/setup-certificate-1p@main
diff --git a/.github/workflows/publishReactNativeAndroidArtifacts.yml b/.github/workflows/publishReactNativeAndroidArtifacts.yml
index 04ee8525e72d..c46436a7155a 100644
--- a/.github/workflows/publishReactNativeAndroidArtifacts.yml
+++ b/.github/workflows/publishReactNativeAndroidArtifacts.yml
@@ -84,18 +84,9 @@ jobs:
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e
 
       - name: Block compromised Java certificates
-        uses: Expensify/GitHub-Actions/block-compromised-java-certificates@d8dfc3ddd4d8626206653c6168ca8d094547749a
-
-      - name: Restrict Gradle to the protected JDK
-        run: |
-          # Prevent cached or downloaded toolchains from bypassing the certificate blocklist.
-          mkdir -p "$HOME/.gradle"
-          cat >> "$HOME/.gradle/gradle.properties" <<EOF
-          org.gradle.java.installations.auto-detect=false
-          org.gradle.java.installations.auto-download=false
-          org.gradle.java.installations.fromEnv=JAVA_HOME
-          org.gradle.java.installations.paths=$JAVA_HOME
-          EOF
+        uses: Expensify/GitHub-Actions/block-compromised-java-certificates@b70c378d6cfae84f6844379eef3568cb33ea9680
+        with:
+          restrict-gradle: 'true'
 
       - name: Determine new patched RN version
         id: getNewPatchedVersion
diff --git a/.github/workflows/publishReactNativeiOSArtifacts.yml b/.github/workflows/publishReactNativeiOSArtifacts.yml
index 691b841ffe59..38e119cc680b 100644
--- a/.github/workflows/publishReactNativeiOSArtifacts.yml
+++ b/.github/workflows/publishReactNativeiOSArtifacts.yml
@@ -246,18 +246,9 @@ jobs:
           java-version: ${{ steps.get-java-version.outputs.version }}
 
       - name: Block compromised Java certificates
-        uses: Expensify/GitHub-Actions/block-compromised-java-certificates@d8dfc3ddd4d8626206653c6168ca8d094547749a
-
-      - name: Restrict Gradle to the protected JDK
-        run: |
-          # Prevent cached or downloaded toolchains from bypassing the certificate blocklist.
-          mkdir -p "$HOME/.gradle"
-          cat >> "$HOME/.gradle/gradle.properties" <<EOF
-          org.gradle.java.installations.auto-detect=false
-          org.gradle.java.installations.auto-download=false
-          org.gradle.java.installations.fromEnv=JAVA_HOME
-          org.gradle.java.installations.paths=$JAVA_HOME
-          EOF
+        uses: Expensify/GitHub-Actions/block-compromised-java-certificates@b70c378d6cfae84f6844379eef3568cb33ea9680
+        with:
+          restrict-gradle: 'true'
 
       - name: Publish to GitHub Packages Maven
         run: ./android/gradlew -p scripts/artifacts-utils/ios/publish publish -PartifactsDir="/tmp/ios-artifacts" -PpatchedVersion="${PATCHED_VERSION}" -PpatchesHash="${PATCHES_HASH}" -PpackageName="${PACKAGE_NAME}"
diff --git a/.github/workflows/remote-build-android.yml b/.github/workflows/remote-build-android.yml
index b3966926815e..15c8394639ac 100644
--- a/.github/workflows/remote-build-android.yml
+++ b/.github/workflows/remote-build-android.yml
@@ -103,18 +103,9 @@ jobs:
           cache: gradle
 
       - name: Block compromised Java certificates
-        uses: Expensify/GitHub-Actions/block-compromised-java-certificates@d8dfc3ddd4d8626206653c6168ca8d094547749a
-
-      - name: Restrict Gradle to the protected JDK
-        run: |
-          # Prevent cached or downloaded toolchains from bypassing the certificate blocklist.
-          mkdir -p "$HOME/.gradle"
-          cat >> "$HOME/.gradle/gradle.properties" <<EOF
-          org.gradle.java.installations.auto-detect=false
-          org.gradle.java.installations.auto-download=false
-          org.gradle.java.installations.fromEnv=JAVA_HOME
-          org.gradle.java.installations.paths=$JAVA_HOME
-          EOF
+        uses: Expensify/GitHub-Actions/block-compromised-java-certificates@b70c378d6cfae84f6844379eef3568cb33ea9680
+        with:
+          restrict-gradle: 'true'
 
       - name: Rock Remote Build - Android
         # rock v3