build: track gradle-wrapper.jar, build through the wrapper in CI - #186
Merged
Merged
Conversation
The jar is now tracked, so the ignore line is stale and actively misleading: it would force `git add -f` on every wrapper upgrade and invite someone to untrack it again. setup-gradle validates the jar's checksum against Gradle's published hashes on every run, which is the reason it is safe to commit.
With gradle/wrapper/gradle-wrapper.jar committed, ./gradlew works on a clean checkout, so CI can use the same entry point as every other environment instead of installing Gradle separately. Drops the version-reading step — setup-gradle takes the version from the wrapper, and from v4 it also checksums the jar against Gradle's published hashes on every run. chmod stays: git on Windows does not track the executable bit, so gradlew is still mode 100644 in the index.
This branch was cut from a main that predates the release workflows, so adding release.yml here made it an add/add conflict against the copy already on main. The workflow change belongs in a follow-up PR based on current main; this branch should carry only the wrapper jar.
Same reason as the release.yml revert: this branch predates current main, so editing .gitignore here conflicts. Restoring it byte-for-byte to the merge base leaves the jar as this branch's only change. The ignore-line removal moves to the follow-up PR.
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Commits
gradle/wrapper/gradle-wrapper.jar(47,505 bytes, Steven's commit) and makes the rest of the repo consistent with that.Why this is the right call
gradlewwithout its jar is a script with no engine. It has worked locally only because every machine that has ever built OpenLoop already had the jar sitting on disk from an earlier Gradle run — nothing in the repo put it there. A clean clone couldn't build, which is exactly what CI hit.The usual argument against committing it is that it's an unreviewable binary executed on every build, which matters more here than most since this repo is public. That's covered:
gradle/actions/setup-gradlev4+ checksums the jar against Gradle's published hashes on every run and fails if it doesn't match. Committed-and-validated beats absent.Changes beyond the jar
.gitignore— removed/gradle/wrapper/gradle-wrapper.jar. Leaving it would have meantgit add -fon every wrapper upgrade and an open invitation to untrack it again. Replaced with a comment explaining why the jar is tracked.release.yml— back to./gradlew, so CI uses the same entry point as every other environment. The version-reading step is gone;setup-gradletakes the version fromgradle-wrapper.propertiesitself.chmod +x gradlewstays. Git on Windows doesn't track the executable bit, sogradlewis still mode100644in the index and arrives non-executable on a Linux runner. If you ever want that fixed at the source:git update-index --chmod=+x gradlew.Dry run status
Cleared: checkout,
compileSdk 37, JDK 17, keystore opening with the alias. Still unproven: R8, the baseline profile,jarsigner.🤖 Generated with Claude Code
https://claude.ai/code/session_01Miqsf1M14nY5TKiZHzyjNY
Note
Low Risk
Build and CI wiring only; the committed wrapper JAR is validated by setup-gradle checksums on each run, with no app runtime or security logic changes.
Overview
Fixes clean-clone and CI builds by committing
gradle/wrapper/gradle-wrapper.jarso./gradlewhas its bootstrap JAR in the repo instead of relying on a machine-local copy left over from an earlier Gradle run..gitignoredrops the ignore rule for that JAR and documents why it stays tracked, so wrapper upgrades don’t needgit add -for risk untracking it again..github/workflows/release.ymlswitches the release job back to./gradlewwithgradle/actions/setup-gradle(Gradle version fromgradle-wrapper.properties), removing a separate version-read step. CI still runschmod +x gradlewbecause the executable bit isn’t preserved for Linux runners on Windows-originated commits.Reviewed by Cursor Bugbot for commit dcc0296. Bugbot is set up for automated code reviews on this repo. Configure here.