[Mikola Lysenko (mikolalysenko)]

Problem

scripts/install-gradle.sh downloads the pinned Gradle zip from two origins, but both are served by github.com releases (services.gradle.org redirects to gradle/gradle-distributions). On 2026-11-09 05:43–05:47 UTC github.com release downloads returned 504 for longer than curl's ~30 s of --retry 5. 9 gradle legs of the nightly failed in the install step (run 42568829044, e.g. job 129001677694: every origin failed for Gradle 7.6.6).

The same window also failed Ruby, Deno, vexctl and installer steps. #2039–#2042 fixed those, but not Gradle. The e2e gradle 9.8.0 legs (ci.yml lines 1515–1516) run on every PR and in the merge queue, so the next such window would evict a queue entry.

Fix

• Restore gradle-<version>-bin.zip from the actions cache before Install Gradle in the shared *e2e-steps (e2e, e2e-extended, e2e-full, e2e-windows, e2e-macos), and save it from main (push and nightly) on a miss. This is the same pattern as the vexctl cache in Cache vexctl on every OS so release 504s can't fail coverage #2039.
• install-gradle.sh uses a zip already in place when it matches the pinned sha256. It deletes and re-downloads one that doesn't, so a bad cache entry can't fail a leg or be trusted.
• The key includes hashFiles('scripts/install-gradle.sh'), so changing a pin starts a fresh entry.
• gradle-compatibility.yml restores the same keys and saves nothing. Saving every OS × version there would add about 1 GB of near-duplicate zips to the repo cache.
• Two small fixes in the same script: the usage text now prints the whole header, and unzip -o makes a rerun into the same directory work.

No test is added, removed or moved. Required check names (ci-ok, clippy) are unchanged.

Proof

• Real download of Gradle 6.9.4: OK. With curl replaced by a stub that always fails with (22) 504:
  • cached zip present → install-gradle.sh: using the cached gradle-6.9.4-bin.zip, launcher printed, rc=0
  • corrupted cached zip → sha256 mismatch, zip removed, both origins tried, every origin failed, rc=1 (fails closed)
  • rerun into the same directory with stdin closed → rc=0 (unzip -o)
• python3 -B -m unittest discover -s scripts/tests: 411 tests OK. This includes test_merge_queue_fail_fast.CiWorkflowContract, which allows step tolerance only on capped cache restores. The save steps carry no continue-on-error; actions/cache/save only logs a warning when the key is already taken.
• shellcheck clean. actionlint and zizmor report the same findings as on main (zizmor: 58 before and after).

/code-review high

Fixed: the usage-header range, keying on the pins, unzip -o, and the cache footprint (gradle-compat is now restore-only). Not changed:

• Composite action to share key/path between workflows: two call sites don't justify one. The comments point each step at the other.
• Cross-OS single key: the runner temp paths differ per OS, so a cross-OS archive wouldn't restore to the right place. Per-OS keys are kept, and only Linux (4 versions) plus Windows 8.14.3 are saved, about 600 MB.
• Save timeout / one saver per version: this matches the vexctl save. It runs only on main, the zip is already compressed, and the losing saves cost a few seconds.

https://claude.ai/code/session_011f9aeT4udaLUf9uZoDNXAx

---

Generated by Claude Code

[Mikola Lysenko (mikolalysenko)]

bugbot run

---

Generated by Claude Code