What the developer wrote
Authored by Craig Raw
combine sdkman and setup-java actions
What changed, and why it matters
This commit changes how the project's automated build system downloads and installs Java. It replaces a pre-made GitHub Action with a custom shell script that downloads SDKMAN, installs a Java version based on a project config file, and then passes that downloaded Java archive to the standard setup-java action. There is no direct evidence in the commit that this change fixes or introduces a security vulnerability.
No immediate security action required. As a routine hygiene measure, reviewers may verify that the `.sdkmanrc` file is pinned to a specific, trusted Java distribution/version and that the workflow's `curl | bash` step uses a verified SDKMAN URL and checksum where possible. Monitor future commits for any follow-up fixes.
Security signals we found
No security-relevant keywords in commit title or message
No changes to application source code, wallet logic, or dependencies
CI workflow change only: Java toolchain acquisition path refactored
Use of `curl | bash` pattern in CI to install SDKMAN (supply-chain consideration, but not a confirmed vulnerability)
No explicit vendor disclosure of security relevance
Evidence from the diff
The patch modifies .github/workflows/package.yaml to replace sdkman/sdkman-action@main with a two-step process: a custom run step that downloads SDKMAN via curl | bash, sources it, runs sdk env install, parses .sdkmanrc to locate the downloaded JDK archive, and writes the archive path and Java version to GitHub Actions outputs; followed by actions/setup-java@v5 configured with distribution: 'jdkfile' and the outputs from the previous step. The change is a CI/CD plumbing refactor and does not alter application code, cryptography, authentication, or network-facing behavior of Sparrow Wallet itself.
Changed components
.github/workflows/package.yamlInspect captured patch +15 / −3
diff --git a/.github/workflows/package.yaml b/.github/workflows/package.yaml
index 7a61326..5fbad8e 100644
--- a/.github/workflows/package.yaml
+++ b/.github/workflows/package.yaml
@@ -15,10 +15,22 @@ jobs:
- uses: actions/checkout@v6
with:
submodules: recursive
- - name: Set up SDKman and Java
- uses: sdkman/sdkman-action@main
+ - name: Download JDK via SDKMAN
+ id: sdkman
+ run: |
+ curl -s "https://get.sdkman.io" | bash
+ source "$HOME/.sdkman/bin/sdkman-init.sh"
+ sdk env install
+ JAVA_VERSION=$(grep '^java=' .sdkmanrc | cut -d= -f2)
+ ARCHIVE=$(ls ~/.sdkman/archives/java-${JAVA_VERSION}.*)
+ echo "file=$ARCHIVE" >> $GITHUB_OUTPUT
+ echo "version=$(echo $JAVA_VERSION | cut -d- -f1)" >> $GITHUB_OUTPUT
+
+ - uses: actions/setup-java@v5
with:
- sdkmanrc: .sdkmanrc
+ distribution: 'jdkfile'
+ java-version: ${{ steps.sdkman.outputs.version }}
+ jdkFile: ${{ steps.sdkman.outputs.file }}
- name: Show Build Versions
run: ./gradlew -v
- name: Build with Gradle
Why this scored 12/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.