From 23c5f3ce1b69b780458e91609416591d4f680b99 Mon Sep 17 00:00:00 2001 From: JohnBraham Date: Thu, 1 Oct 2026 11:52:53 +0100 Subject: [PATCH 1/2] Pin Java 17 for the 1.12 release action Use Temurin 17.0.1+12 for both release builds and Maven publication, matching the existing build guard. Add a workflow check so the release selector cannot drift back to a floating Java 17 version. The new check failed before the change and passes afterward. --- .github/workflows/deploy-release.yml | 8 ++++++-- gradle/verification/workflows.gradle | 2 ++ 2 files changed, 8 insertions(+), 2 deletions(-) diff --git a/.github/workflows/deploy-release.yml b/.github/workflows/deploy-release.yml index 710e8e37..8d6f43eb 100644 --- a/.github/workflows/deploy-release.yml +++ b/.github/workflows/deploy-release.yml @@ -49,6 +49,7 @@ jobs: java_toolchain_version: ${{ steps.validate.outputs.java_toolchain_version }} java_setup_version: ${{ steps.validate.outputs.java_setup_version }} gradle_java_version: ${{ steps.validate.outputs.gradle_java_version }} + gradle_java_setup_version: ${{ steps.validate.outputs.gradle_java_setup_version }} install_gradle_java: ${{ steps.validate.outputs.install_gradle_java }} curseforge_project_id: ${{ steps.validate.outputs.curseforge_project_id }} curseforge_dependencies: ${{ steps.validate.outputs.curseforge_dependencies }} @@ -238,6 +239,7 @@ jobs: fi case "${{ steps.route.outputs.target_branch }}" in master-1.12) + gradle_java_setup_version=17.0.1+12 if [[ "$minecraft_version" != '1.12.2' || "$java_toolchain_version" != '8.0.502+7' \ || "$gradle_java_version" != '17' ]]; then echo "master-1.12 has an unexpected target/toolchain contract" >&2 @@ -245,6 +247,7 @@ jobs: fi ;; master-1.18) + gradle_java_setup_version="$java_setup_version" if [[ "$minecraft_version" != '1.18.2' || "$java_toolchain_version" != '17.0.1+12' \ || "$gradle_java_version" != '17' ]]; then echo "master-1.18 has an unexpected target/toolchain contract" >&2 @@ -284,6 +287,7 @@ jobs: echo "java_toolchain_version=$java_toolchain_version" >> "$GITHUB_OUTPUT" echo "java_setup_version=$java_setup_version" >> "$GITHUB_OUTPUT" echo "gradle_java_version=$gradle_java_version" >> "$GITHUB_OUTPUT" + echo "gradle_java_setup_version=$gradle_java_setup_version" >> "$GITHUB_OUTPUT" echo "install_gradle_java=$install_gradle_java" >> "$GITHUB_OUTPUT" echo "curseforge_project_id=$curseforge_project_id" >> "$GITHUB_OUTPUT" { @@ -356,7 +360,7 @@ jobs: uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5 with: distribution: temurin - java-version: ${{ needs.preflight.outputs.gradle_java_version }} + java-version: ${{ needs.preflight.outputs.gradle_java_setup_version }} - name: Set up Gradle uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6 @@ -575,7 +579,7 @@ jobs: uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5 with: distribution: temurin - java-version: ${{ needs.preflight.outputs.gradle_java_version }} + java-version: ${{ needs.preflight.outputs.gradle_java_setup_version }} - name: Set up Gradle uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6 diff --git a/gradle/verification/workflows.gradle b/gradle/verification/workflows.gradle index 41ca614b..c21e5c7f 100644 --- a/gradle/verification/workflows.gradle +++ b/gradle/verification/workflows.gradle @@ -26,6 +26,8 @@ tasks.register('verifyWorkflowContracts') { 'master-1.12)', 'master-1.18)', 'stage-legacy-dependencies.sh', 'stage-orespawn-release.sh', "mmdlib) curseforge_dependencies+=('261744(required)')", + 'gradle_java_setup_version=17.0.1+12', + 'java-version: ${{ needs.preflight.outputs.gradle_java_setup_version }}', 'confirm_live_publication' ] ] From 37960aa266962eea609ed8ea5577da01f37b1b05 Mon Sep 17 00:00:00 2001 From: JohnBraham Date: Thu, 1 Oct 2026 11:57:42 +0100 Subject: [PATCH 2/2] Compile Java during CodeQL scans Disable Gradle build-cache reuse in the CodeQL compile step so the scanner observes javac, even when production sources have not changed. The workflow guard reproduces the missing setting and passes with the fix; a clean no-cache compilation passes too. --- .github/workflows/codeql-analysis.yml | 2 +- gradle/verification/workflows.gradle | 3 ++- 2 files changed, 3 insertions(+), 2 deletions(-) diff --git a/.github/workflows/codeql-analysis.yml b/.github/workflows/codeql-analysis.yml index 5a29b994..35414717 100644 --- a/.github/workflows/codeql-analysis.yml +++ b/.github/workflows/codeql-analysis.yml @@ -69,7 +69,7 @@ jobs: gradle_args=( clean classes -PlegacyDependencyVerificationRepository="${{ steps.dependencies.outputs.repository }}" - --no-daemon --stacktrace --max-workers=2 + --no-daemon --no-build-cache --stacktrace --max-workers=2 -Dorg.gradle.java.installations.paths="$JAVA_HOME,$JAVA_HOME_8_X64,$JAVA_HOME_25_X64" -Dorg.gradle.java.installations.auto-detect=false -Dorg.gradle.java.installations.auto-download=false diff --git a/gradle/verification/workflows.gradle b/gradle/verification/workflows.gradle index c21e5c7f..b67c7838 100644 --- a/gradle/verification/workflows.gradle +++ b/gradle/verification/workflows.gradle @@ -13,7 +13,8 @@ tasks.register('verifyWorkflowContracts') { ], 'codeql-analysis.yml': [ 'master-1.12', 'feature/**', 'github/codeql-action/init@', - 'stage-legacy-dependencies.sh', 'clean classes' + 'stage-legacy-dependencies.sh', 'clean classes', + '--no-daemon --no-build-cache --stacktrace --max-workers=2' ], 'validate-gradle-build.yml': [ 'master-1.12', 'feature/**', 'gradle/actions/wrapper-validation@'