From 1a7d89280da5b95cd070db55fd488b9ffe29a8d5 Mon Sep 17 00:00:00 2001 From: Claude Date: Thu, 8 Oct 2026 20:17:48 +0000 Subject: [PATCH] Install Gradle without services.gradle.org The merge-queue run for #1108 (37834367420) was evicted when the ubuntu Gradle 6.9.4 e2e leg's install step got HTTP 500 from services.gradle.org six times in 31 s. That host only redirects: the zip lives on the gradle/gradle-distributions GitHub release, and the .sha256 is a second request to the same flaky redirector. scripts/install-gradle.sh now fetches the zip from the GitHub release (services.gradle.org only as a fallback) and checks it against a sha256 pinned in the script, taken from gradle.org/release-checksums. A version with no pinned digest fails closed. The e2e legs and gradle-compatibility.yml share the script. Co-Authored-By: Claude Opus 5.5 (1M context) Claude-Session: https://claude.ai/code/session_01148r6VxiJnnFAx13nVn4Sa --- .github/workflows/ci.yml | 11 +--- .github/workflows/gradle-compatibility.yml | 17 ++---- scripts/install-gradle.sh | 61 ++++++++++++++++++++++ 3 files changed, 68 insertions(+), 21 deletions(-) create mode 100755 scripts/install-gradle.sh diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml index 8bebde5fc..d8d4a5b78 100644 --- a/.github/workflows/ci.yml +++ b/.github/workflows/ci.yml @@ -1526,15 +1526,8 @@ jobs: shell: bash env: GRADLE_VERSION: ${{ matrix.gradle }} - run: | - url="https://services.gradle.org/distributions/gradle-${GRADLE_VERSION}-bin.zip" - curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$url" -o "$RUNNER_TEMP/gradle.zip" - curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$url.sha256" -o "$RUNNER_TEMP/gradle.sha256" - python -c 'import hashlib, pathlib, os; p=pathlib.Path(os.environ["RUNNER_TEMP"]); assert hashlib.sha256((p/"gradle.zip").read_bytes()).hexdigest() == (p/"gradle.sha256").read_text().strip()' - unzip -q "$RUNNER_TEMP/gradle.zip" -d "$RUNNER_TEMP" - launcher="$RUNNER_TEMP/gradle-${GRADLE_VERSION}/bin/gradle" - if [ "$RUNNER_OS" = Windows ]; then launcher="${launcher}.bat"; fi - echo "SOCKET_PATCH_GRADLE_E2E_GRADLE=$launcher" >> "$GITHUB_ENV" + # Pinned digest, GitHub-release origin: see the script. + run: scripts/install-gradle.sh "$GRADLE_VERSION" "$RUNNER_TEMP" >> "$GITHUB_ENV" - name: Setup .NET SDK if: matrix.dotnet != '' diff --git a/.github/workflows/gradle-compatibility.yml b/.github/workflows/gradle-compatibility.yml index 70081afb1..fa670333a 100644 --- a/.github/workflows/gradle-compatibility.yml +++ b/.github/workflows/gradle-compatibility.yml @@ -21,8 +21,8 @@ name: Gradle patch compatibility # # 9.8.0 is the current release on services.gradle.org (re-checked # 2026-10-02; bump it here and in ci.yml together when a newer 9.x ships). -# 7.6.6 is the last 7.x. Every distribution is sha256-checked against -# services.gradle.org before use. +# 7.6.6 is the last 7.x. scripts/install-gradle.sh pins every +# distribution's sha256; add the new version's digest there too. # # Each mode runs its suites' `#[ignore]` tests by name prefix (the contract # scripts/ci-e2e-bundle.py --check enforces): agent = e2e_gradle_discovery_build @@ -44,6 +44,7 @@ on: paths: - '.github/workflows/gradle-compatibility.yml' - 'scripts/ci-e2e-bundle.py' + - 'scripts/install-gradle.sh' - 'Cargo.lock' - 'Cargo.toml' - 'crates/*/Cargo.toml' @@ -277,16 +278,8 @@ jobs: shell: bash env: GRADLE_VERSION: ${{ matrix.gradle }} - run: | - # Download flags: see the Maven step above. - url="https://services.gradle.org/distributions/gradle-${GRADLE_VERSION}-bin.zip" - curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$url" -o "$RUNNER_TEMP/gradle.zip" - curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$url.sha256" -o "$RUNNER_TEMP/gradle.sha256" - python -c 'import hashlib, pathlib, os; p=pathlib.Path(os.environ["RUNNER_TEMP"]); assert hashlib.sha256((p/"gradle.zip").read_bytes()).hexdigest() == (p/"gradle.sha256").read_text().strip()' - unzip -q "$RUNNER_TEMP/gradle.zip" -d "$RUNNER_TEMP" - launcher="$RUNNER_TEMP/gradle-${GRADLE_VERSION}/bin/gradle" - if [ "$RUNNER_OS" = Windows ]; then launcher="${launcher}.bat"; fi - echo "SOCKET_PATCH_GRADLE_E2E_GRADLE=$launcher" >> "$GITHUB_ENV" + # Pinned digest, GitHub-release origin: see the script. + run: scripts/install-gradle.sh "$GRADLE_VERSION" "$RUNNER_TEMP" >> "$GITHUB_ENV" - name: Run the ${{ matrix.mode }} suites shell: bash diff --git a/scripts/install-gradle.sh b/scripts/install-gradle.sh new file mode 100755 index 000000000..d0285d180 --- /dev/null +++ b/scripts/install-gradle.sh @@ -0,0 +1,61 @@ +#!/usr/bin/env bash +# Install one pinned Gradle distribution for the real-Gradle suites, then +# print the variable a CI step appends to $GITHUB_ENV. +# +# scripts/install-gradle.sh +# +# The zip comes straight from the gradle/gradle-distributions GitHub +# release, the host services.gradle.org redirects to anyway; the redirector +# alone answering HTTP 500 for ~30 s used to fail a merge-queue leg. It is +# only tried after the release download fails. The sha256 is pinned below +# (from https://gradle.org/release-checksums/), so no checksum fetch can fail +# either; a version without a pin fails closed. +# +# Prints (stdout): +# SOCKET_PATCH_GRADLE_E2E_GRADLE= +set -euo pipefail + +if [ $# -ne 2 ]; then + sed -n '2,15p' "$0" | sed 's/^# \{0,1\}//' >&2 + exit 2 +fi +VERSION="$1" +DIR="$2" + +case "$VERSION" in + 6.9.4) sha=3e240228538de9f18772a574e99a0ba959e83d6ef351014381acd9631781389a ;; + 7.6.6) sha=673d9776f303bc7048fc3329d232d6ebf1051b07893bd9d11616fad9a8673be0 ;; + 8.14.3) sha=bd71102213493060956ec229d946beee57158dbd89d0e62b91bca0fa2c5f3531 ;; + 9.8.0) sha=bafd5ce9cfaea0fbccfdc8439a1ac42fbd4cd9c89dc9a988228d8a2639a58e6c ;; + *) + echo "install-gradle.sh: no pinned sha256 for Gradle $VERSION; add it from https://gradle.org/release-checksums/" >&2 + exit 1 + ;; +esac + +mkdir -p "$DIR" +zip="$DIR/gradle-$VERSION-bin.zip" +file="gradle-$VERSION-bin.zip" +fetched="" +# --ssl-revoke-best-effort: Windows curl (schannel) otherwise fails when the +# CA's revocation endpoint is unreachable. +for url in \ + "https://github.com/gradle/gradle-distributions/releases/download/v$VERSION/$file" \ + "https://services.gradle.org/distributions/$file"; do + if curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$url" -o "$zip"; then + fetched=1 + break + fi + echo "install-gradle.sh: download from $url failed" >&2 +done +if [ -z "$fetched" ]; then + echo "install-gradle.sh: every origin failed for Gradle $VERSION" >&2 + exit 1 +fi + +# python, not sha256sum: the macOS runners have only shasum. +python -c 'import hashlib, sys; d = hashlib.sha256(open(sys.argv[1], "rb").read()).hexdigest(); sys.exit(0 if d == sys.argv[2] else "sha256 mismatch: got " + d)' "$zip" "$sha" +unzip -q "$zip" -d "$DIR" +launcher="$DIR/gradle-$VERSION/bin/gradle" +case "$(uname -s)" in MINGW*|MSYS*|CYGWIN*) launcher="$launcher.bat" ;; esac +echo "SOCKET_PATCH_GRADLE_E2E_GRADLE=$launcher"