clear tool cache, revert to setup-java action for reproducibility
What the developer wrote
Authored by Craig Raw
clear tool cache, revert to setup-java action for reproducibility
What changed, and why it matters
This commit changes how the project's automated build system installs Java. It removes a method that downloaded and ran a shell script from the internet (SDKMAN) and instead uses GitHub's official, pinned Java setup action with a specific Java version. It also clears a cached Java directory to make builds more reproducible. This is a hardening improvement, not a vulnerability fix.
No action required. This is a CI hardening/reproducibility improvement. Reviewers may verify that Java 25.0.2 is the intended version and that the Temurin distribution license is acceptable for the project.
Security signals we found
Removed remote script execution (curl | bash) from CI workflow
Replaced dynamic JDK provisioning with pinned actions/setup-java version and distribution
Added tool-cache clearing step to improve build reproducibility
No vulnerability, bug, or exploit code present in diff
Evidence from the diff
The package.yaml GitHub Actions workflow is modified to stop using SDKMAN (curling get.sdkman.io and installing Java from a .sdkmanrc file) and reverts to actions/setup-java@v5 with a pinned Temurin JDK 25.0.2. A new step deletes $RUNNER_TOOL_CACHE/Java_* to clear the Java tool cache for reproducibility. The change reduces supply-chain attack surface by eliminating an unverified remote script execution and an indeterminate JDK source, replacing it with a pinned, GitHub-managed action and explicit Java version.
Changed components
.github/workflows/package.yamlInspect captured patch +7 / −15
diff --git a/.github/workflows/package.yaml b/.github/workflows/package.yaml
index 5fbad8e..f57387e 100644
--- a/.github/workflows/package.yaml
+++ b/.github/workflows/package.yaml
@@ -15,22 +15,14 @@ jobs:
- uses: actions/checkout@v6
with:
submodules: recursive
- - name: Download JDK via SDKMAN
- id: sdkman
- run: |
- curl -s "https://get.sdkman.io" | bash
- source "$HOME/.sdkman/bin/sdkman-init.sh"
- sdk env install
- JAVA_VERSION=$(grep '^java=' .sdkmanrc | cut -d= -f2)
- ARCHIVE=$(ls ~/.sdkman/archives/java-${JAVA_VERSION}.*)
- echo "file=$ARCHIVE" >> $GITHUB_OUTPUT
- echo "version=$(echo $JAVA_VERSION | cut -d- -f1)" >> $GITHUB_OUTPUT
-
- - uses: actions/setup-java@v5
+ - name: Clear Java tool-cache for reproduciblity
+ shell: bash
+ run: rm -rf "$RUNNER_TOOL_CACHE/Java_*"
+ - name: Set up JDK 25.0.2
+ uses: actions/setup-java@v5
with:
- distribution: 'jdkfile'
- java-version: ${{ steps.sdkman.outputs.version }}
- jdkFile: ${{ steps.sdkman.outputs.file }}
+ distribution: 'temurin'
+ java-version: '25.0.2'
- name: Show Build Versions
run: ./gradlew -v
- name: Build with Gradle
Why this scored 14/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.