From 12d1b1fa51ea3fa1d3ab6625b2dec471d1a169ed Mon Sep 17 00:00:00 2001
From: rory <rory@expensify.com>
Date: Thu, 22 Oct 2026 15:28:04 -0700
Subject: [PATCH] ci: block compromised Java certificates

Apply the shared eMudhra certificate blocklist after Java setup and
cache restoration, before Java network operations. Keep the selected
JVM protected when nested Android actions would otherwise replace it.

Source: https://github.com/Expensify/GitHub-Actions/pull/117
---
 .github/workflows/buildAndroid.yml                   |  3 +++
 .../workflows/publishReactNativeAndroidArtifacts.yml |  3 +++
 .github/workflows/publishReactNativeiOSArtifacts.yml |  3 +++
 .github/workflows/remote-build-android.yml           | 12 ++++++++++++
 4 files changed, 21 insertions(+)

diff --git a/.github/workflows/buildAndroid.yml b/.github/workflows/buildAndroid.yml
index 8bdba2f7e5f3..321f5511a422 100644
--- a/.github/workflows/buildAndroid.yml
+++ b/.github/workflows/buildAndroid.yml
@@ -122,6 +122,9 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e
 
+      - name: Block compromised Java certificates
+        uses: Expensify/GitHub-Actions/block-compromised-java-certificates@main
+
       - name: Setup 1Password CLI and certificates
         uses: Expensify/GitHub-Actions/setup-certificate-1p@main
         with:
diff --git a/.github/workflows/publishReactNativeAndroidArtifacts.yml b/.github/workflows/publishReactNativeAndroidArtifacts.yml
index 8048abe07e4d..89effa0b28fd 100644
--- a/.github/workflows/publishReactNativeAndroidArtifacts.yml
+++ b/.github/workflows/publishReactNativeAndroidArtifacts.yml
@@ -83,6 +83,9 @@ jobs:
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e
 
+      - name: Block compromised Java certificates
+        uses: Expensify/GitHub-Actions/block-compromised-java-certificates@main
+
       - name: Determine new patched RN version
         id: getNewPatchedVersion
         run: echo "NEW_PATCHED_VERSION=$(./.github/scripts/getNewPatchedRNVersion.sh)" >> "$GITHUB_OUTPUT"
diff --git a/.github/workflows/publishReactNativeiOSArtifacts.yml b/.github/workflows/publishReactNativeiOSArtifacts.yml
index 56aebc1d2322..5ea622cb45b4 100644
--- a/.github/workflows/publishReactNativeiOSArtifacts.yml
+++ b/.github/workflows/publishReactNativeiOSArtifacts.yml
@@ -234,6 +234,9 @@ jobs:
           path: /tmp/ios-artifacts
           merge-multiple: true
 
+      - name: Block compromised Java certificates
+        uses: Expensify/GitHub-Actions/block-compromised-java-certificates@main
+
       - name: Publish to GitHub Packages Maven
         run: ./android/gradlew -p scripts/artifacts-utils/ios/publish publish -PartifactsDir="/tmp/ios-artifacts" -PpatchedVersion="${PATCHED_VERSION}" -PpatchesHash="${PATCHES_HASH}" -PpackageName="${PACKAGE_NAME}"
         env:
diff --git a/.github/workflows/remote-build-android.yml b/.github/workflows/remote-build-android.yml
index e24ff55b08b6..c8427243b137 100644
--- a/.github/workflows/remote-build-android.yml
+++ b/.github/workflows/remote-build-android.yml
@@ -80,6 +80,16 @@ jobs:
         with:
           IS_HYBRID_BUILD: ${{ matrix.is_hybrid_build && 'true' || 'false' }}
 
+      - name: Setup Java
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654
+        with:
+          distribution: adopt
+          java-version: 17
+          cache: gradle
+
+      - name: Block compromised Java certificates
+        uses: Expensify/GitHub-Actions/block-compromised-java-certificates@main
+
       - name: Configure AWS Credentials
         # v6
         uses: aws-actions/configure-aws-credentials@99214aa6889fcddfa57764031d71add364327e59
@@ -98,6 +108,8 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }}
           IS_HYBRID_APP: ${{ matrix.is_hybrid_build }}
         with:
+          # Keep the protected JVM instead of installing another one inside Rock.
+          setup-java: false
           variant: ${{ matrix.variant }}
           rock-build-extra-params: '--extra-params -PreactNativeArchitectures=arm64-v8a,x86_64'
           comment-bot: false