Install Gradle without services.gradle.org

The merge-queue run for #1108 (37834367420) was evicted when the
ubuntu Gradle 6.9.4 e2e leg's install step got HTTP 500 from
services.gradle.org six times in 31 s. That host only redirects: the
zip lives on the gradle/gradle-distributions GitHub release, and the
.sha256 is a second request to the same flaky redirector.

scripts/install-gradle.sh now fetches the zip from the GitHub release
(services.gradle.org only as a fallback) and checks it against a
sha256 pinned in the script, taken from gradle.org/release-checksums.
A version with no pinned digest fails closed. The e2e legs and
gradle-compatibility.yml share the script.

Co-Authored-By: Claude Opus 5.5 (1M context) <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01148r6VxiJnnFAx13nVn4Sa

Author: claude

.github/workflows/ci.yml

@@ -1526,15 +1526,8 @@ jobs:
         shell: bash
         env:
           GRADLE_VERSION: ${{ matrix.gradle }}
-        run: |
-          url="https://services.gradle.org/distributions/gradle-${GRADLE_VERSION}-bin.zip"
-          curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$url" -o "$RUNNER_TEMP/gradle.zip"
-          curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$url.sha256" -o "$RUNNER_TEMP/gradle.sha256"
-          python -c 'import hashlib, pathlib, os; p=pathlib.Path(os.environ["RUNNER_TEMP"]); assert hashlib.sha256((p/"gradle.zip").read_bytes()).hexdigest() == (p/"gradle.sha256").read_text().strip()'
-          unzip -q "$RUNNER_TEMP/gradle.zip" -d "$RUNNER_TEMP"
-          launcher="$RUNNER_TEMP/gradle-${GRADLE_VERSION}/bin/gradle"
-          if [ "$RUNNER_OS" = Windows ]; then launcher="${launcher}.bat"; fi
-          echo "SOCKET_PATCH_GRADLE_E2E_GRADLE=$launcher" >> "$GITHUB_ENV"
+        # Pinned digest, GitHub-release origin: see the script.
+        run: scripts/install-gradle.sh "$GRADLE_VERSION" "$RUNNER_TEMP" >> "$GITHUB_ENV"
 
       - name: Setup .NET SDK
         if: matrix.dotnet != ''

.github/workflows/gradle-compatibility.yml

@@ -21,8 +21,8 @@ name: Gradle patch compatibility
 #
 # 9.8.0 is the current release on services.gradle.org (re-checked
 # 2026-10-02; bump it here and in ci.yml together when a newer 9.x ships).
-# 7.6.6 is the last 7.x. Every distribution is sha256-checked against
-# services.gradle.org before use.
+# 7.6.6 is the last 7.x. scripts/install-gradle.sh pins every
+# distribution's sha256; add the new version's digest there too.
 #
 # Each mode runs its suites' `#[ignore]` tests by name prefix (the contract
 # scripts/ci-e2e-bundle.py --check enforces): agent = e2e_gradle_discovery_build
@@ -44,6 +44,7 @@ on:
     paths:
       - '.github/workflows/gradle-compatibility.yml'
       - 'scripts/ci-e2e-bundle.py'
+      - 'scripts/install-gradle.sh'
       - 'Cargo.lock'
       - 'Cargo.toml'
       - 'crates/*/Cargo.toml'
@@ -277,16 +278,8 @@ jobs:
         shell: bash
         env:
           GRADLE_VERSION: ${{ matrix.gradle }}
-        run: |
-          # Download flags: see the Maven step above.
-          url="https://services.gradle.org/distributions/gradle-${GRADLE_VERSION}-bin.zip"
-          curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$url" -o "$RUNNER_TEMP/gradle.zip"
-          curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$url.sha256" -o "$RUNNER_TEMP/gradle.sha256"
-          python -c 'import hashlib, pathlib, os; p=pathlib.Path(os.environ["RUNNER_TEMP"]); assert hashlib.sha256((p/"gradle.zip").read_bytes()).hexdigest() == (p/"gradle.sha256").read_text().strip()'
-          unzip -q "$RUNNER_TEMP/gradle.zip" -d "$RUNNER_TEMP"
-          launcher="$RUNNER_TEMP/gradle-${GRADLE_VERSION}/bin/gradle"
-          if [ "$RUNNER_OS" = Windows ]; then launcher="${launcher}.bat"; fi
-          echo "SOCKET_PATCH_GRADLE_E2E_GRADLE=$launcher" >> "$GITHUB_ENV"
+        # Pinned digest, GitHub-release origin: see the script.
+        run: scripts/install-gradle.sh "$GRADLE_VERSION" "$RUNNER_TEMP" >> "$GITHUB_ENV"
 
       - name: Run the ${{ matrix.mode }} suites
         shell: bash

scripts/install-gradle.sh

@@ -0,0 +1,61 @@
+#!/usr/bin/env bash
+# Install one pinned Gradle distribution for the real-Gradle suites, then
+# print the variable a CI step appends to $GITHUB_ENV.
+#
+#   scripts/install-gradle.sh <version> <dir>
+#
+# The zip comes straight from the gradle/gradle-distributions GitHub
+# release, the host services.gradle.org redirects to anyway; the redirector
+# alone answering HTTP 500 for ~30 s used to fail a merge-queue leg. It is
+# only tried after the release download fails. The sha256 is pinned below
+# (from https://gradle.org/release-checksums/), so no checksum fetch can fail
+# either; a version without a pin fails closed.
+#
+# Prints (stdout):
+#   SOCKET_PATCH_GRADLE_E2E_GRADLE=<launcher path>
+set -euo pipefail
+
+if [ $# -ne 2 ]; then
+  sed -n '2,15p' "$0" | sed 's/^# \{0,1\}//' >&2
+  exit 2
+fi
+VERSION="$1"
+DIR="$2"
+
+case "$VERSION" in
+  6.9.4) sha=3e240228538de9f18772a574e99a0ba959e83d6ef351014381acd9631781389a ;;
+  7.6.6) sha=673d9776f303bc7048fc3329d232d6ebf1051b07893bd9d11616fad9a8673be0 ;;
+  8.14.3) sha=bd71102213493060956ec229d946beee57158dbd89d0e62b91bca0fa2c5f3531 ;;
+  9.8.0) sha=bafd5ce9cfaea0fbccfdc8439a1ac42fbd4cd9c89dc9a988228d8a2639a58e6c ;;
+  *)
+    echo "install-gradle.sh: no pinned sha256 for Gradle $VERSION; add it from https://gradle.org/release-checksums/" >&2
+    exit 1
+    ;;
+esac
+
+mkdir -p "$DIR"
+zip="$DIR/gradle-$VERSION-bin.zip"
+file="gradle-$VERSION-bin.zip"
+fetched=""
+# --ssl-revoke-best-effort: Windows curl (schannel) otherwise fails when the
+# CA's revocation endpoint is unreachable.
+for url in \
+  "https://github.com/gradle/gradle-distributions/releases/download/v$VERSION/$file" \
+  "https://services.gradle.org/distributions/$file"; do
+  if curl -fsSL --retry 5 --retry-all-errors --ssl-revoke-best-effort "$url" -o "$zip"; then
+    fetched=1
+    break
+  fi
+  echo "install-gradle.sh: download from $url failed" >&2
+done
+if [ -z "$fetched" ]; then
+  echo "install-gradle.sh: every origin failed for Gradle $VERSION" >&2
+  exit 1
+fi
+
+# python, not sha256sum: the macOS runners have only shasum.
+python -c 'import hashlib, sys; d = hashlib.sha256(open(sys.argv[1], "rb").read()).hexdigest(); sys.exit(0 if d == sys.argv[2] else "sha256 mismatch: got " + d)' "$zip" "$sha"
+unzip -q "$zip" -d "$DIR"
+launcher="$DIR/gradle-$VERSION/bin/gradle"
+case "$(uname -s)" in MINGW*|MSYS*|CYGWIN*) launcher="$launcher.bat" ;; esac
+echo "SOCKET_PATCH_GRADLE_E2E_GRADLE=$launcher"