Repository navigation
Add opt-in Gradle restrictions to Java remediation - #118
Merged
Merged
Conversation
Add opt-in Gradle hardening after successful certificate remediation. Prevent cached JVM settings and automatic toolchain selection from bypassing the protected JDK while preserving unrelated Gradle properties.
Codex Review SummaryThis comment shows the latest Codex review activity on this pull request.
ℹ️ About Codex in GitHubYour team has set up Codex to review pull requests in this repo. Reviews are triggered when you
Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings. |
francoisl
approved these changes
Oct 22, 2026
This was referenced Oct 22, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Details
Centralize the repeated "Restrict Gradle to the protected JDK" steps from the Java certificate rollout. Patching one JVM does not prevent Gradle from selecting or downloading another, unprotected toolchain.
Add opt-in
restrict-gradle: 'true'toblock-compromised-java-certificatesaction, defaulting to'false'. After successful certificate remediation, it:GRADLE_USER_HOME, falling back to$HOME/.gradle; appends overriding properties while preserving unrelated bytes and file permissions. Repeat runs with the same settings are no-ops.JAVA_HOMEto match the protectedjava-home, including equivalent symlink paths, so the Gradle launcher starts on the protected JVM.Run the action after Java setup and Gradle cache restoration, before Gradle. The selected JDK must satisfy the project's toolchain and daemon criteria; incompatible requirements fail instead of downloading/selecting another JVM. Multi-JDK builds can retain their own explicit policy.
Related Issues
For https://github.com/Expensify/Expensify/issues/694720
Manual Tests
n/a - automated tests only.
Linked PRs
Follow-up to #117.
After this merges, consumers can bump their action SHA, set
restrict-gradle: 'true', and remove the duplicated inline Gradle-property steps: