From 8e8f1d8fe63ad5e4dd7f88491c054504a5922159 Mon Sep 17 00:00:00 2001
From: rory <rory@expensify.com>
Date: Thu, 22 Oct 2026 15:26:58 -0700
Subject: [PATCH 1/2] ci: block compromised Java certificates

Protect the selected JVM before dependency downloads and other Java
network operations. Keep Gradle on the protected JDK so cached or
automatically downloaded toolchains cannot bypass the blocklist.
---
 .github/workflows/build-android.yml | 14 ++++++++++++++
 1 file changed, 14 insertions(+)

diff --git a/.github/workflows/build-android.yml b/.github/workflows/build-android.yml
index ac571b8b3..c5de59d18 100644
--- a/.github/workflows/build-android.yml
+++ b/.github/workflows/build-android.yml
@@ -41,6 +41,20 @@ jobs:
           distribution: 'zulu'
           java-version: 17
 
+      - name: Block compromised Java certificates
+        uses: Expensify/GitHub-Actions/block-compromised-java-certificates@d8dfc3ddd4d8626206653c6168ca8d094547749a
+
+      - name: Restrict Gradle to the protected JDK
+        run: |
+          # Prevent cached or downloaded toolchains from bypassing the certificate blocklist.
+          mkdir -p "$HOME/.gradle"
+          cat >> "$HOME/.gradle/gradle.properties" <<EOF
+          org.gradle.java.installations.auto-detect=false
+          org.gradle.java.installations.auto-download=false
+          org.gradle.java.installations.fromEnv=JAVA_HOME
+          org.gradle.java.installations.paths=$JAVA_HOME
+          EOF
+
       # v6.0.0
       - name: Setup Node.js
         uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903

From 3b943880357fe62c683038f0c51261699aa6ea18 Mon Sep 17 00:00:00 2001
From: rory <rory@expensify.com>
Date: Thu, 22 Oct 2026 16:29:26 -0700
Subject: [PATCH 2/2] ci: reuse shared Gradle JDK restrictions

Adopt the merged GitHub-Actions Gradle opt-in instead of duplicating its toolchain restrictions in each workflow. Keep remediation after setup/cache restoration and before Java network use.
---
 .github/workflows/build-android.yml | 15 +++------------
 1 file changed, 3 insertions(+), 12 deletions(-)

diff --git a/.github/workflows/build-android.yml b/.github/workflows/build-android.yml
index c5de59d18..6d0608037 100644
--- a/.github/workflows/build-android.yml
+++ b/.github/workflows/build-android.yml
@@ -42,18 +42,9 @@ jobs:
           java-version: 17
 
       - name: Block compromised Java certificates
-        uses: Expensify/GitHub-Actions/block-compromised-java-certificates@d8dfc3ddd4d8626206653c6168ca8d094547749a
-
-      - name: Restrict Gradle to the protected JDK
-        run: |
-          # Prevent cached or downloaded toolchains from bypassing the certificate blocklist.
-          mkdir -p "$HOME/.gradle"
-          cat >> "$HOME/.gradle/gradle.properties" <<EOF
-          org.gradle.java.installations.auto-detect=false
-          org.gradle.java.installations.auto-download=false
-          org.gradle.java.installations.fromEnv=JAVA_HOME
-          org.gradle.java.installations.paths=$JAVA_HOME
-          EOF
+        uses: Expensify/GitHub-Actions/block-compromised-java-certificates@b70c378d6cfae84f6844379eef3568cb33ea9680
+        with:
+          restrict-gradle: 'true'
 
       # v6.0.0
       - name: Setup Node.js