build(android): make develop toolchain inputs reproducible

[Jeremy1844]

Audit root

• Audit ID: ADV-2026-0058 / RC-0058
• Target: develop
• Audited base: 38ccd793a3bbcc2150258deb4104dac6910c68da
• Regression: 9733a84cf315d2200490d41391888105ee1c7530
• Fix/head: 1d99020f0f76a65ea3bd5246c271976e4a7c71c4
• Head tree: 00ea8ff056462d058608f2363365b4e08421c126
• Shape: two commits, one root, 10 files, +11,112/-13

This is a draft. It has not been merged, released, signed, deployed, or exercised against production.

Why

The active develop branch selected mutable hosted-runner labels and inline Java 23 values, omitted an authenticated Gradle distribution checksum, and had no repository-owned dependency-verification corpus.

Java 23 had reached end of life, while the existing Gradle 9.4.1, Android Gradle Plugin, Kotlin and Foundry graph was proved compatible with the selected Zulu 25 LTS build without changing the generated JVM target.

The regression contract reports 18 exact violations on the audited base:

• six mutable runner labels;
• four inline Java declarations;
• four Gradle jobs not using a repository-owned Java version;
• a setup-java/version-file count mismatch;
• missing .java-version;
• missing reviewed Gradle 9.4.1 distribution checksum;
• missing dependency-verification metadata.

Regression-first fix

Commit 9733a84cf315d2200490d41391888105ee1c7530 adds the reproducibility contract before the fix. It exits nonzero with all 18 expected violations.

Commit 1d99020f0f76a65ea3bd5246c271976e4a7c71c4:

• pins Ubuntu jobs to ubuntu-24.04;
• pins macOS jobs to macos-15;
• selects exact Zulu 25.0.4+7 through .java-version;
• changes only the catalog Java toolchain major from 23 to 25;
• preserves JVM target 17;
• makes every Gradle workflow consume .java-version;
• authenticates the Gradle 9.4.1 distribution;
• retains the reviewed wrapper JAR unchanged;
• adds strict SHA-256 metadata for the complete tested dependency graph.

The final metadata contains 1,562 components, 2,571 artifacts and 2,571 SHA-256 entries. Its file SHA-256 is:

3dc3ab243935e9240fcb29de18f0e855daa0a1db6cac9e3bab0395d07f41afa4

The unchanged wrapper JAR SHA-256 is:

55243ef57851f12b070ad14f7f5bb8302daceeebc5bce5ece5fa6edb23e1145c

Recorded local evidence

• Expected RED: reproducibility contract exits 1 with 18 violations.
• PASS: reproducibility contract at the fix head.
• PASS: Actionlint 1.7.12.
• PASS: strict offline full check, 2,677/2,677 tasks executed in 3m28s.
• PASS: configured testDebugUnitTest -Proborazzi.test.verify=true, 1,029 tasks and 39/39 emitted tests with no failures, errors or skips.
• PASS: app:bundleRelease app-tv:bundleRelease --dry-run; both signing tasks were skipped.
• PASS: deterministic metadata regeneration in the canonical exact-tree evidence; the metadata hash remained unchanged.
• PASS: independent strict-cache comparison in the canonical evidence; all 2,980 shared artifact hashes matched.
• PASS: diff, commit ancestry, stable patch, binary, public-safety, secret-pattern and strict Git object checks.
• PASS: clean worktree.

The strict run used no dependency-metadata-writing flag, build cache or configuration cache.

Environment separation

Two preflight invocations failed before testing for local environment reasons:

1. An unrelated offline Gradle home was selected and did not contain the audited Foundry plugin.
2. An obsolete SDK root was selected and did not contain the installed API 36 platform.

After selecting the preserved audited dependency cache and the installed API 36/build-tools 36 SDK, the complete strict graph passed. Neither preliminary stop was a dependency-verification, compiler, test or repository failure.

Scope and compatibility

Changed paths are limited to the reproducibility policy, five workflows, .java-version, the Java catalog value, verification metadata and wrapper properties.

The Git trees for app, app-tv, baselineprofile, common, features, libraries, services, release and distribution are byte-identical between the base and fix.

Therefore:

• no application behavior changes;
• no persistence, schema, migration, wire-format or user-data changes;
• no lesson, translation, PDF, video, Bible, hymnal or Ellen G. White content changes;
• no signing, store, release or deployment implementation changes;
• no user-data migration or recovery action is required;
• generated JVM target remains 17.

Developers and CI must use the exact JDK selected by .java-version.

Open pull-request overlap

The final preflight reviewed every open Android PR, #1548 through #1555. All target main; none targets develop.

There is zero changed-path overlap with #1548, #1549, #1551, #1552 and #1553.

The remaining intersections are branch-divergent and do not block this standalone develop draft:

• fix(storage): preserve v26 legacy user input #1550 also changes gradle/libs.versions.toml, in a separate hunk. If its new Room testing dependency is later ported to develop, regenerate and strictly verify the dependency metadata.
• ci(android): run push quality gates on pull requests #1554 also changes pull_request.yml. If ported, its added job must retain the pinned runner, .java-version and develop Gradle-action alignment.
• ci(android): keep release secrets out of push checks #1555 also changes on_push.yml. Its release-secret-boundary fix remains separate, but its hunk must be replayed after this root because the direct patch context changed.

Landing order and dependent roots

1. Land this ADV-0058 develop root first.
2. Recreate ADV-0033's regression/fix pair on the actual landed ADV-0058 SHA, preserving the pinned toolchain while applying immutable Action refs and least-privilege controls.
3. Rebase ADV-0073 and extend or regenerate strict metadata for its newly declared Robolectric SDK 23/24 artifacts.

The ADV-0073 requirement was reproduced directly. A detached composition of the exact ADV-0058 and ADV-0073 trees failed closed in updateRobolectricJars: strict verification rejected the SDK 23 JAR and POM because they are absent from this metadata corpus. The SDK 24 coordinate is also absent. ADV-0073's current three-file head is therefore not composition-ready; it must add authenticated Gradle metadata for both SDK lines and rerun its empty-home/offline matrix.

Main-target ADV-0051, ADV-0054, ADV-0069 and the main ADV-0058 slice remain separate branch-specific delivery units.

Rollback

There is no application-data rollback.

Prefer a forward correction that preserves exact runner, Java, wrapper and dependency identities. If the fix must be reverted, revert the landed equivalent of 1d99020f0f76a65ea3bd5246c271976e4a7c71c4. Retain or replace the regression contract so any alternative toolchain remains pinned and authenticated.

Reverting without a replacement restores the confirmed mutable and unauthenticated build path.

Security, privacy and content rights

This root improves build-artifact integrity. No compromise is alleged.

No credential, private source, signing material, private alert, user data or dependency payload is included in the change or public evidence. No rights-controlled content was read, changed, generated or uploaded.

Remaining draft gates

Keep this PR in draft until maintainers:

• run the exact head on GitHub-hosted Ubuntu 24.04 and macOS 15;
• confirm setup-java resolves exact Zulu 25.0.4+7 on the hosted architectures;
• rerun strict check, the configured unit/Roborazzi lane and the release-bundle dry-run;
• review fork/no-secret logs and first-time-contributor approval behavior;
• review required-check and branch-protection changes;
• inspect authorized private dependency and security-alert views;
• revalidate the target SHA and open-PR overlap immediately before merge.

ADV-0033 owns full-SHA GitHub Action pinning and privileged workflow controls. This PR must not absorb that separate root.

No local evidence authorizes merge, signing, store upload, release or deployment.