[ISSUE-86] ci: replace Gradle wrapper validation with offline checksum #126

Dave · 2026-07-05T10:42:36Z

Dave commented

2026-07-05 10:42:36 +00:00

Summary

Replace the gradle/actions/wrapper-validation@v3 step (which fetches checksums from GitHub's CDN and times out on the internal CI runner) with an offline sha256 checksum verification using a local checksum file.

Changes

.gitea/workflows/test_build.yml: Replaced Validate Gradle Wrapper step using gradle/actions/wrapper-validation@v3 with Validate Gradle Wrapper (offline checksum) that runs sha256sum --check
gradle/wrapper/gradle-wrapper.jar.sha256: Added pre-computed SHA256 checksum file for the Gradle wrapper JAR

Issues

Fixes CI after multi-module merge (similar to Hithomelabs/HomeLabDocker#86)

Testing

Checksum verified locally
Workflow should pass on CI without external network timeouts

## Summary Replace the `gradle/actions/wrapper-validation@v3` step (which fetches checksums from GitHub's CDN and times out on the internal CI runner) with an offline sha256 checksum verification using a local checksum file. ## Changes - **`.gitea/workflows/test_build.yml`**: Replaced `Validate Gradle Wrapper` step using `gradle/actions/wrapper-validation@v3` with `Validate Gradle Wrapper (offline checksum)` that runs `sha256sum --check` - **`gradle/wrapper/gradle-wrapper.jar.sha256`**: Added pre-computed SHA256 checksum file for the Gradle wrapper JAR ## Issues - Fixes CI after multi-module merge (similar to Hithomelabs/HomeLabDocker#86) ## Testing - [x] Checksum verified locally - [ ] Workflow should pass on CI without external network timeouts

Dave added 1 commit 2026-07-05 10:42:36 +00:00

Hithomelabs/CFTunnels#86 : ci: replace Gradle wrapper validation with offline checksum

sample gradle build and test / build (pull_request) Successful in 1m56s

Details

sample gradle build and test / tag (push) Successful in 6s

Details

sample gradle build and test / build_tag_push (push) Failing after 1m53s

Details

d500a8b276

Dave commented

2026-07-05 10:42:45 +00:00

This PR replaces the gradle/actions/wrapper-validation@v3 step that fetches checksums from GitHub's CDN (which times out on the internal CI runner) with an offline sha256 checksum verification using a local checksum file at gradle/wrapper/gradle-wrapper.jar.sha256.

Fixes the CI timeout issue after the multi-module merge.

This PR replaces the `gradle/actions/wrapper-validation@v3` step that fetches checksums from GitHub's CDN (which times out on the internal CI runner) with an offline sha256 checksum verification using a local checksum file at `gradle/wrapper/gradle-wrapper.jar.sha256`. Fixes the CI timeout issue after the multi-module merge.

Linus approved these changes 2026-07-05 10:44:38 +00:00

Linus left a comment

PR Review: [ISSUE-86] ci: replace Gradle wrapper validation with offline checksum

Summary

This PR replaces the gradle/actions/wrapper-validation@v3 action (which fetches checksums from GitHub CDN and times out on the internal CI runner) with an offline sha256sum --check against a committed checksum file. This is architect-approved as Option B.

Changes Reviewed

.gitea/workflows/test_build.yml — uses: gradle/actions/wrapper-validation@v3 replaced with run: sha256sum --check gradle/wrapper/gradle-wrapper.jar.sha256
gradle/wrapper/gradle-wrapper.jar.sha256 (new) — Pre-computed SHA-256 checksum for the wrapper JAR

Code Quality

Clean, minimal change — 2 lines removed, 4 lines added across 2 files
Follows YAML best practices; multiline | block scalar is correctly used
Checksum file format is correct (sha256sum output format with double-space separator)

Security

No exposed secrets — checksum file is a public hash only
No external network dependency — removes CDN call that was failing
The checksum is committed and tracked, providing integrity verification
The wrapper JAR is validated against its own checksum — if someone tampers with both the JAR and the checksum file, the change would be visible in the PR diff, which is an acceptable trust model for internal CI

Testing

Checksum verified locally (per PR description)
No test modifications needed — this is purely a CI workflow change
Once merged, CI should run without network timeouts on the internal runner

Tooling Note

sha256sum is available on ubuntu-latest runners by default (part of coreutils), so no additional dependencies are required.

Approval Status

REVIEW COMPLETE — APPROVED

This is a straightforward, well-justified change that addresses a concrete CI reliability issue. The approach (Option B from the architect's analysis) is correct: committed checksum file + local verification eliminates the external network dependency. The checksum file format is valid for sha256sum --check, and the path references are correct.

One minor suggestion (not blocking): Consider adding a --strict flag to sha256sum to ensure the checksum file itself has no formatting issues (though the current file is correctly formatted):

sha256sum --check --strict gradle/wrapper/gradle-wrapper.jar.sha256

--strict exits non-zero if the checksum file has an improperly formatted line, offering an extra defense-in-depth layer.

## PR Review: [ISSUE-86] ci: replace Gradle wrapper validation with offline checksum ### Summary This PR replaces the `gradle/actions/wrapper-validation@v3` action (which fetches checksums from GitHub CDN and times out on the internal CI runner) with an offline `sha256sum --check` against a committed checksum file. This is architect-approved as Option B. ### Changes Reviewed 1. **`.gitea/workflows/test_build.yml`** — `uses: gradle/actions/wrapper-validation@v3` replaced with `run: sha256sum --check gradle/wrapper/gradle-wrapper.jar.sha256` 2. **`gradle/wrapper/gradle-wrapper.jar.sha256`** (new) — Pre-computed SHA-256 checksum for the wrapper JAR ### Code Quality - [x] Clean, minimal change — 2 lines removed, 4 lines added across 2 files - [x] Follows YAML best practices; multiline `|` block scalar is correctly used - [x] Checksum file format is correct (`sha256sum` output format with double-space separator) ### Security - [x] **No exposed secrets** — checksum file is a public hash only - [x] No external network dependency — removes CDN call that was failing - [x] The checksum is committed and tracked, providing integrity verification - [x] The wrapper JAR is validated against its own checksum — if someone tampers with both the JAR and the checksum file, the change would be visible in the PR diff, which is an acceptable trust model for internal CI ### Testing - [x] Checksum verified locally (per PR description) - [x] No test modifications needed — this is purely a CI workflow change - [ ] Once merged, CI should run without network timeouts on the internal runner ### Tooling Note `sha256sum` is available on `ubuntu-latest` runners by default (part of `coreutils`), so no additional dependencies are required. ### Approval Status **REVIEW COMPLETE** — **APPROVED** This is a straightforward, well-justified change that addresses a concrete CI reliability issue. The approach (Option B from the architect's analysis) is correct: committed checksum file + local verification eliminates the external network dependency. The checksum file format is valid for `sha256sum --check`, and the path references are correct. **One minor suggestion** (not blocking): Consider adding a `--strict` flag to `sha256sum` to ensure the checksum file itself has no formatting issues (though the current file is correctly formatted): ```yaml sha256sum --check --strict gradle/wrapper/gradle-wrapper.jar.sha256 ``` `--strict` exits non-zero if the checksum file has an improperly formatted line, offering an extra defense-in-depth layer.

Linus approved these changes 2026-07-05 10:44:44 +00:00

Linus left a comment

PR Review: [ISSUE-86] ci: replace Gradle wrapper validation with offline checksum

Code Quality

Clean, minimal change — 2 lines removed, 4 lines added across 2 files
Checksum file format is correct (sha256sum output format with double-space separator)
YAML syntax is valid

Security

No exposed secrets
No external network dependency
Committed checksum provides integrity verification for internal CI

Testing

Checksum verified locally
No new test surfaces introduced — purely a CI step replacement

Recommendations

Non-blocking suggestion: Consider sha256sum --check --strict for extra defense-in-depth on checksum file formatting.

Approval Status

APPROVED — Ready for human merge. This architect-approved change correctly replaces the network-dependent Gradle wrapper validation with an offline checksum check, eliminating the timeout issue on the internal runner.

## PR Review: [ISSUE-86] ci: replace Gradle wrapper validation with offline checksum ### Code Quality - [x] Clean, minimal change — 2 lines removed, 4 lines added across 2 files - [x] Checksum file format is correct (`sha256sum` output format with double-space separator) - [x] YAML syntax is valid ### Security - [x] No exposed secrets - [x] No external network dependency - [x] Committed checksum provides integrity verification for internal CI ### Testing - [x] Checksum verified locally - [x] No new test surfaces introduced — purely a CI step replacement ### Recommendations Non-blocking suggestion: Consider `sha256sum --check --strict` for extra defense-in-depth on checksum file formatting. ### Approval Status **APPROVED** — Ready for human merge. This architect-approved change correctly replaces the network-dependent Gradle wrapper validation with an offline checksum check, eliminating the timeout issue on the internal runner.

hitanshu merged commit d500a8b276 into test

2026-07-05 10:45:13 +00:00

Dave referenced this pull request

2026-07-05 10:52:35 +00:00

ci: fix Gradle wrapper validation in test_image_build_push.yml (missed in PR #126) #127

hitanshu referenced this issue from a commit

2026-07-05 10:55:23 +00:00

Merge pull request 'ci: fix Gradle wrapper validation in test_image_build_push.yml (missed in PR #126)' (#127) from Dave/CFTunnels:ISSUE-86-fix into test

Sign in to join this conversation.

No reviewers