From 80a4a209d63e55ff09c7f31b59358bfe56b055b4 Mon Sep 17 00:00:00 2001
From: Lena <lena@omega>
Date: Wed, 1 Jul 2026 00:00:00 +0000
Subject: ci: fail when gradle pins drift from versions

The gradle files and go.mod repeat pins from versions because gradle
cannot source a shell file. Compare them in ci/test.sh so a bump that
misses a copy fails loud instead of silently building with the old
version.
---
 ci/test.sh                      | 14 ++++++++++++++
 metadata/reproducible-builds.md |  6 ++++--
 2 files changed, 18 insertions(+), 2 deletions(-)

diff --git a/ci/test.sh b/ci/test.sh
index 8e8a3a4..5c141e5 100755
--- a/ci/test.sh
+++ b/ci/test.sh
@@ -12,6 +12,20 @@ if [ -f "$root/rsync/rsync-${RSYNC_VERSION}.tar.gz" ]; then
 	( cd "$root/rsync" && sha256sum -c "rsync-${RSYNC_VERSION}.tar.gz.sha256" )
 fi
 
+# The gradle files and go.mod repeat pins from ./versions (gradle cannot source
+# a shell file); fail loud if they drift.
+echo "ci: version pins"
+pin() {
+	grep -q "$2" "$root/$1" || { echo "ci: $1 does not pin '$2' (see versions)" >&2; exit 1; }
+}
+pin build.gradle "version '${AGP_VERSION}'"
+pin build.gradle "version '${KOTLIN_VERSION}'"
+pin gradle/wrapper/gradle-wrapper.properties "gradle-${GRADLE_VERSION}-bin.zip"
+pin app/build.gradle "compileSdk ${ANDROID_PLATFORM}"
+pin app/build.gradle "minSdk ${ANDROID_MIN_SDK}"
+pin app/build.gradle "targetSdk ${ANDROID_TARGET_SDK}"
+pin rsh/go.mod "^go ${GO_VERSION}"
+
 echo "ci: gofmt"
 unformatted=$(gofmt -l "$root/rsh")
 if [ -n "$unformatted" ]; then
diff --git a/metadata/reproducible-builds.md b/metadata/reproducible-builds.md
index 9830957..91b34f6 100644
--- a/metadata/reproducible-builds.md
+++ b/metadata/reproducible-builds.md
@@ -6,8 +6,10 @@ How rsend stays reproducible and what F-Droid needs to build it.
 Pinning
 -------
 Every tool and source version lives in ./versions: the rsync source and its
-sha256, the Go version, the Android NDK, SDK platform, build-tools, Gradle, the
-Android Gradle Plugin, and Kotlin. The build never floats a version.
+sha256, the Go version, the JDK release, the Android NDK, SDK platform,
+build-tools, Gradle, the Android Gradle Plugin, and Kotlin. The build never
+floats a version. The gradle files and go.mod repeat some pins because gradle
+cannot source a shell file; ci/test.sh fails if they drift from ./versions.
 
 
 Determinism
-- 
cgit v1.2.3