ci: pin JDK 17 for the Android lane by brow · Pull Request #8711 · block/buzz

brow · 2026-10-29T21:14:27Z

ubuntu-latest now resolves to Ubuntu 26.04, whose default JDK is 25. Gradle 8.14.5 doesn't support JDK 25, so every Android CI build fails at project configuration ("Gradle build failed due to Java/Gradle incompatibility"). This breaks main and every open mobile PR. The last green Android run (18:09Z today) was on the 24.04 image, which defaults to JDK 17.

This pins Temurin JDK 17 with actions/setup-java (SHA-pinned to v6.1.0) for the Android lane only. Other lanes are unchanged.

Validation

The pinned actions/setup-java SHA matches the upstream v6.1.0 tag.
This PR's own Android lane is the end-to-end check.

🤖 Generated with Claude Code

ubuntu-latest moved to Ubuntu 26.04, whose default JDK 25 is not supported by Gradle 8.14.5, so every Android build fails at project configuration. Pin the JDK 17 the 24.04 image provided. Co-authored-by: studio <dc2fc481343672df31a689840c09299972e704dac592e0da6f18486646a7ee3e@buzz.block.builderlab.xyz> Signed-off-by: Tom Brow <[email protected]>

brow · 2026-10-29T21:14:31Z

@codex review

chatgpt-codex-connector

💡 Codex Review

Here are some automated review suggestions for this pull request.

Reviewed commit: 8c438f5613

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review".

If Codex has suggestions, it will comment; otherwise it will react with 👍.

Codex can also answer questions or update the PR. Try commenting "@codex address that feedback".

chatgpt-codex-connector · 2026-10-29T21:16:45Z

        run: /bin/bash scripts/test-mobile-gateway-recipes.sh
+      # ubuntu-latest (26.04) defaults to JDK 25, which Gradle 8.14 does not
+      # support. Pin the JDK 17 the 24.04 image used.
+      - name: Set up JDK 17


Sign off the commit

Commit d09fd2284a1585d6cb812c5b8116cba427c84979 has no Signed-off-by trailer, so the repository's required DCO check will reject any PR containing it; recreate the commit with git commit -s or rebase it with --signoff before merging.

AGENTS.md reference: AGENTS.md:L197-L197

Useful? React with 👍 / 👎.

🤖 Not applicable: d09fd2284a is not part of this PR. Its only commit, 8c438f5613, carries Signed-off-by: Tom Brow <[email protected]>.

chatgpt-codex-connector · 2026-10-29T21:16:49Z

Codex Review Summary

This comment shows the latest Codex review activity on this pull request.

Review	Status	Commit	Review trigger
📝 Code Review	✅ Completed 2026-10-29T21:20:42.103182Z	`8c438f5`	Draft marked ready

ℹ️ About Codex in GitHub

Your team has set up Codex to review pull requests in this repo. Reviews are triggered when you

Open a pull request for review
Mark a draft as ready
Comment "@codex review" or "@codex security review".

Codex reacts with 👀 while any review is running, comments if it has suggestions, and reacts with 👍 once all reviews finish with no findings.

github-actions · 2026-10-29T21:20:08Z

🔐 Codex Security Review

Note: This is an automated, security-focused review generated by Codex.
Use it as a supplement to human review; false positives are possible.

Scope

Exact PR diff: 76cd4294f65bde33eff031315509e81deccf7c9d...8c438f56132e983aa1d4da295225002e26cdd072

Model: gpt-6.1-sol

💡 Click "edited" above to see earlier reviews for this PR.

Review Summary

Overall Risk: NONE

The PR pins JDK 17 for the Android CI lane before Gradle runs, consistent with the Android build configuration. No concrete security, correctness, or reliability issues were found in the authorized range.

Findings

No concrete security, correctness, or reliability findings were identified.

Notes

No additional limitations were reported.

_{Generated by Codex Security Review |

Requested by: @brow |

Workflow run}

wesbillman

🤖 Carl, an automated reviewer, commenting via Wes's GitHub account.

No blockers. Correct, minimal fix for the Android lane.

Root cause checks out: main's Android job (run 40954404696, ubuntu-26.04) fails with "Java version used for the build is 25.0.5, which is incompatible with Gradle 8.14.5."
This PR's Android job runs on ubuntu-26.04, resolves Temurin 17.0.21 from the runner tool cache, builds the debug APK, and passes :app:testDebugUnitTest.
The actions/setup-java SHA matches upstream v6.1.0. JDK 17 matches the app's sourceCompatibility/jvmTarget, and _ci-clients.yml is the only workflow under .github that runs Gradle, so no other lane needs the pin.

Not approving: approval is the maintainers' call.

jedwards27

🤖 Review from :bot: Jude’s code review agent

Verdict: APPROVE
Reviewed head: 8c438f56132e983aa1d4da295225002e26cdd072
Base: 76cd4294f65bde33eff031315509e81deccf7c9d

No author-actionable defects found.

Evidence reviewed

Live PR metadata immediately before review still showed head 8c438f56132e983aa1d4da295225002e26cdd072, base 76cd4294f65bde33eff031315509e81deccf7c9d, author brow; authenticated reviewer was jedwards27, so normal review semantics apply.
Clean local review checkout at the reviewed head; merge-base matched the PR base. The diff is limited to .github/workflows/_ci-clients.yml with +8/-0, and git diff --check 76cd4294f65bde33eff031315509e81deccf7c9d..HEAD passed.
The new actions/setup-java step is scoped to matrix.lane == 'android' and runs before Gradle cache restore/build/test in the Android lane; other client lanes skip the Java pin.
Pin integrity checked: actions/setup-java tag v6.1.0 resolves to b843ebf9b913146b38da2eaa7aeddf76074ae1ad, matching the workflow pin.
Failure fit checked: Android Gradle wrapper is 8.14.5; Android/Kotlin compile targets are Java 17. The observed failing main-branch Android job was using Java 25 on ubuntu-26.04, which Gradle 8.14.5 rejects. This PR pins Temurin 17 instead of mutating build logic or hiding diagnostics.
PR CI proof checked: the Android job on run 40956090011 used ubuntu-26.04, setup-java resolved Temurin 17.0.21+9, set JAVA_HOME under the hosted toolcache, built build/app/outputs/flutter-apk/app-debug.apk, and passed :app:testDebugUnitTest with BUILD SUCCESSFUL.
Workflow validation evidence: actionlint .github/workflows/_ci-clients.yml passed under the repo toolchain in a lane review; GitHub zizmor and security checks were green at final refresh.
The change does not appear to mask the broader toolchain-upgrade signal: the Android CI log still emits the future Flutter/Gradle/AGP/Kotlin and Gradle 9 warnings; this fixes the immediate JDK 25 incompatibility only.

CI / gate state at final refresh

Passing at final refresh: Android lane, mobile checks/tests, desktop, desktop macOS build, relay/postgres, rust lint/unit/cross-compile, security, DCO, zizmor, Semgrep, and related result aggregators.
Skipped by selector: web and unrelated skipped matrix lanes.
Still in progress at final refresh: Mobile Swift Domain / Mobile Swift (Native), Relay and PostgreSQL / Desktop E2E Integration (1/3), and Rust / Windows Rust (x86_64-pc-windows-msvc). Those are external CI gates, not author rework unless they fail with a PR-caused issue.

Confidence gaps

I did not validate any separate internal mobile release-builder stack outside this repository. If a release/build owner has another Android/Gradle lane riding a floating Ubuntu/JDK image, auditing that stack is follow-up ownership, not a required change to this PR.
I did not run the Android build locally; the PR’s GitHub Android lane exercised the production workflow on the affected runner image and JDK selection path.

Author action: None.

Verification owner: CI/repository protection owns the remaining in-progress checks; release/build owners own any separate internal Android release-builder audit if desired.

Empty commit: main's Android lane was failing on the runner's new default JDK until #8711 pinned JDK 17. Co-authored-by: Elrond <28d6302a099e5225b02c4155ac4236e4912603df2ab08dbfc2f4fef08ce598c8@buzz.block.builderlab.xyz> Co-Authored-By: Claude Opus 5.5 <[email protected]> Signed-off-by: Luke Tornquist <[email protected]>

`ubuntu-latest` now resolves to Ubuntu 26.04, whose default JDK is 25. Gradle 8.14.5 doesn't support JDK 25, so every Android CI build fails at project configuration ("Gradle build failed due to Java/Gradle incompatibility"). This breaks main and every open mobile PR. The last green Android run (18:09Z today) was on the 24.04 image, which defaults to JDK 17. This pins Temurin JDK 17 with `actions/setup-java` (SHA-pinned to v6.1.0) for the Android lane only. Other lanes are unchanged. ### Validation - The pinned `actions/setup-java` SHA matches the upstream `v6.1.0` tag. - This PR's own Android lane is the end-to-end check. 🤖 Generated with [Claude Code](https://claude.com/claude-code) Signed-off-by: Tom Brow <[email protected]> Co-authored-by: Tom Brow <[email protected]> Co-authored-by: studio <dc2fc481343672df31a689840c09299972e704dac592e0da6f18486646a7ee3e@buzz.block.builderlab.xyz> (cherry picked from commit c609d33) Signed-off-by: SanHsien <[email protected]>

…or the red CI jobs Android lane failed on ubuntu 26.04 (JDK 25 vs Gradle 8.14.5) and cargo-deny failed on RUSTSEC-2026-0433/0429. Both fixes are cherry-picked verbatim from upstream; the 2026-11-02 review, its JSON, DECISIONS, FORK and ROADMAP now say so. Watermarks unchanged. Co-Authored-By: Claude Sonnet 5.5 <[email protected]> Signed-off-by: SanHsien <[email protected]>

Avoids a new Dependency freshness REVIEW UPDATE row for the pin taken verbatim from upstream block#8711. Co-Authored-By: Claude Opus 5.5 <[email protected]> Signed-off-by: SanHsien <[email protected]>

chatgpt-codex-connector Bot reviewed Oct 29, 2026

View reviewed changes

brow marked this pull request as ready for review October 29, 2026 21:18

brow requested a review from a team as a code owner October 29, 2026 21:18

brow temporarily deployed to codex-review October 29, 2026 21:18 — with GitHub Actions Inactive

github-actions Bot added the codex-security-review-current The posted Codex security review matches its recorded range. label Oct 29, 2026

wesbillman reviewed Oct 29, 2026

View reviewed changes

wesbillman approved these changes Oct 29, 2026

View reviewed changes

brow enabled auto-merge (squash) October 29, 2026 21:30

jedwards27 approved these changes Oct 29, 2026

View reviewed changes

brow merged commit c609d33 into main Oct 29, 2026
99 checks passed

brow deleted the ci-android-jdk17 branch October 29, 2026 21:34

jedwards27 mentioned this pull request Oct 29, 2026

fix(mobile): finish public account setup before returning to Buzz #8712

Merged

Navigation Menu

Repository navigation

ci: pin JDK 17 for the Android lane - #8711

ci: pin JDK 17 for the Android lane#8711
brow merged 1 commit into
mainfrom
ci-android-jdk17

brow commented Oct 29, 2026

Uh oh!

brow commented Oct 29, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Uh oh!

chatgpt-codex-connector Bot Oct 29, 2026

Uh oh!

brow Oct 29, 2026

Uh oh!

chatgpt-codex-connector Bot commented Oct 29, 2026 •

edited

Loading

Uh oh!

github-actions Bot commented Oct 29, 2026

Uh oh!

wesbillman left a comment

Uh oh!

jedwards27 left a comment

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

Conversation

brow commented Oct 29, 2026

Validation

Uh oh!

brow commented Oct 29, 2026

Uh oh!

chatgpt-codex-connector Bot left a comment

Choose a reason for hiding this comment

💡 Codex Review

Uh oh!

chatgpt-codex-connector Bot Oct 29, 2026

Choose a reason for hiding this comment

Uh oh!

brow Oct 29, 2026

Choose a reason for hiding this comment

Uh oh!

chatgpt-codex-connector Bot commented Oct 29, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codex Review Summary

Uh oh!

github-actions Bot commented Oct 29, 2026

🔐 Codex Security Review

Review Summary

Findings

Notes

Uh oh!

wesbillman left a comment

Choose a reason for hiding this comment

Uh oh!

jedwards27 left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

This branch was previously deployed

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

4 participants

chatgpt-codex-connector Bot commented Oct 29, 2026 •

edited

Loading