From 5ed7ab30de6b9860e17011865b4183dd6f0b85e0 Mon Sep 17 00:00:00 2001
From: rory <rory@expensify.com>
Date: Thu, 22 Oct 2026 15:26:58 -0700
Subject: [PATCH 1/3] ci: block compromised Java certificates

Protect the selected JVM before dependency downloads and other Java
network operations. Keep Gradle on the protected JDK so cached or
automatically downloaded toolchains cannot bypass the blocklist.
---
 .github/workflows/ci.yml | 27 +++++++++++++++++++++------
 1 file changed, 21 insertions(+), 6 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 30dc3e4..8b3f847 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -25,15 +25,30 @@ jobs:
         uses: actions/setup-java@v4
         with:
           java-version: '21'
-          distribution: 'temurin'
-
-      - name: Install NDK
-        run: |
-          yes | ${ANDROID_HOME}/cmdline-tools/latest/bin/sdkmanager "ndk;29.0.13846066"
+          # Match gradle/gradle-daemon-jvm.properties so Gradle uses this protected JDK.
+          distribution: 'jetbrains'
 
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v3
 
+      - name: Block compromised Java certificates
+        uses: Expensify/GitHub-Actions/block-compromised-java-certificates@d8dfc3ddd4d8626206653c6168ca8d094547749a
+
+      - name: Restrict Gradle to the protected JDK
+        run: |
+          # Prevent cached or downloaded toolchains from bypassing the certificate blocklist.
+          mkdir -p "$HOME/.gradle"
+          cat >> "$HOME/.gradle/gradle.properties" <<EOF
+          org.gradle.java.installations.auto-detect=false
+          org.gradle.java.installations.auto-download=false
+          org.gradle.java.installations.fromEnv=JAVA_HOME
+          org.gradle.java.installations.paths=$JAVA_HOME
+          EOF
+
+      - name: Install NDK
+        run: |
+          yes | "${ANDROID_HOME}/cmdline-tools/latest/bin/sdkmanager" "ndk;29.0.13846066"
+
       # Run checks (tests, lint) on every trigger
       - name: Build Artifacts
         if: github.event_name == 'release'
@@ -45,4 +60,4 @@ jobs:
         with:
           fail_on_unmatched_files: true
           files: |
-            **/build/outputs/aar/*.aar
\ No newline at end of file
+            **/build/outputs/aar/*.aar

From 9ddfb4234e829b3dc4cde2d0ddaf413553452d36 Mon Sep 17 00:00:00 2001
From: rory <rory@expensify.com>
Date: Thu, 22 Oct 2026 15:34:25 -0700
Subject: [PATCH 2/3] ci: authenticate JBR resolution and pin actions

The JetBrains resolver reads GITHUB_TOKEN from the environment;
without it, CI hit the anonymous GitHub API rate limit. Use the
reviewed setup-java v5 revision and pin the remaining existing tags
to satisfy the workflow validation gates.
---
 .github/workflows/ci.yml | 11 +++++++----
 1 file changed, 7 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 8b3f847..7574b3d 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -17,19 +17,22 @@ jobs:
       packages: write # Needed to publish to GitHub Packages
 
     steps:
-      - uses: actions/checkout@v4
+      - uses: actions/checkout@11d5960a326750d5838078e36cf38b85af677262 # v4
         with:
           fetch-depth: 0 # Critical for git-sensitive-semantic-versioning
 
       - name: Set up JDK 21
-        uses: actions/setup-java@v4
+        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
+        env:
+          # The JetBrains resolver reads this environment variable for GitHub release requests.
+          GITHUB_TOKEN: ${{ github.token }}
         with:
           java-version: '21'
           # Match gradle/gradle-daemon-jvm.properties so Gradle uses this protected JDK.
           distribution: 'jetbrains'
 
       - name: Setup Gradle
-        uses: gradle/actions/setup-gradle@v3
+        uses: gradle/actions/setup-gradle@d9c87d481d55275bb5441eef3fe0e46805f9ef70 # v3
 
       - name: Block compromised Java certificates
         uses: Expensify/GitHub-Actions/block-compromised-java-certificates@d8dfc3ddd4d8626206653c6168ca8d094547749a
@@ -56,7 +59,7 @@ jobs:
 
       - name: Upload Release Assets
         if: github.event_name == 'release'
-        uses: softprops/action-gh-release@v2
+        uses: softprops/action-gh-release@3bb12739c298aeb8a4eeaf626c5b8d85266b0e65 # v2
         with:
           fail_on_unmatched_files: true
           files: |

From 190209c935a71c7a433cf2deacf2fb7f78606a3c Mon Sep 17 00:00:00 2001
From: rory <rory@expensify.com>
Date: Thu, 22 Oct 2026 16:29:26 -0700
Subject: [PATCH 3/3] ci: reuse shared Gradle JDK restrictions

Adopt the merged GitHub-Actions Gradle opt-in instead of duplicating its toolchain restrictions in each workflow. Keep remediation after setup/cache restoration and before Java network use.
---
 .github/workflows/ci.yml | 15 +++------------
 1 file changed, 3 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
index 7574b3d..66d1b91 100644
--- a/.github/workflows/ci.yml
+++ b/.github/workflows/ci.yml
@@ -35,18 +35,9 @@ jobs:
         uses: gradle/actions/setup-gradle@d9c87d481d55275bb5441eef3fe0e46805f9ef70 # v3
 
       - name: Block compromised Java certificates
-        uses: Expensify/GitHub-Actions/block-compromised-java-certificates@d8dfc3ddd4d8626206653c6168ca8d094547749a
-
-      - name: Restrict Gradle to the protected JDK
-        run: |
-          # Prevent cached or downloaded toolchains from bypassing the certificate blocklist.
-          mkdir -p "$HOME/.gradle"
-          cat >> "$HOME/.gradle/gradle.properties" <<EOF
-          org.gradle.java.installations.auto-detect=false
-          org.gradle.java.installations.auto-download=false
-          org.gradle.java.installations.fromEnv=JAVA_HOME
-          org.gradle.java.installations.paths=$JAVA_HOME
-          EOF
+        uses: Expensify/GitHub-Actions/block-compromised-java-certificates@b70c378d6cfae84f6844379eef3568cb33ea9680
+        with:
+          restrict-gradle: 'true'
 
       - name: Install NDK
         run: |