From 0a71f9967f574280fb33a66e72d4a0f713991e9c Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89amonn=20McManus?= <emcmanus@google.com>
Date: Mon, 12 Oct 2026 21:44:35 +0000
Subject: [PATCH 1/3] Update CI to run with JDK 11.

Previously it was running with JDK 8. Obviously we would like it to run a more recent version yet,
but this seems to be the latest LTS version that works without other changes.
---
 .github/workflows/gradle.yaml | 25 ++++++++++++++-----------
 1 file changed, 14 insertions(+), 11 deletions(-)

diff --git a/.github/workflows/gradle.yaml b/.github/workflows/gradle.yaml
index 51194212..608e8eb4 100644
--- a/.github/workflows/gradle.yaml
+++ b/.github/workflows/gradle.yaml
@@ -6,14 +6,17 @@ jobs:
   tests:
     runs-on: ubuntu-latest
 
-    steps:
-      - uses: actions/checkout@v6
-      - name: Set up JDK 8
-        uses: actions/setup-java@v5
-        with:
-          java-version: '8'
-          distribution: 'adopt'
-      - name: Run Gradle Tests
-        uses: gradle/gradle-build-action@v2
-        with:
-          arguments: check 
+  steps:
+    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+      with:
+        persist-credentials: false
+    - name: Set up JDK 11
+      uses: actions/setup-java@@de7274f081f381c8f8158605e0321c36c376e2e6  # v6.0.1
+      with:
+        distribution: 'temurin'
+        java-version: '11'
+        java-package: 'jdk'
+    - name: Set up Gradle
+      uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
+    - name: Test with Gradle
+      run: ./gradlew check

From 5367b591fbe87a34c7461529c1354abfdf3096aa Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89amonn=20McManus?= <emcmanus@google.com>
Date: Mon, 12 Oct 2026 21:49:11 +0000
Subject: [PATCH 2/3] Fix syntax errors in gradle.yaml.

---
 .github/workflows/gradle.yaml | 28 ++++++++++++++--------------
 1 file changed, 14 insertions(+), 14 deletions(-)

diff --git a/.github/workflows/gradle.yaml b/.github/workflows/gradle.yaml
index 608e8eb4..572bfc04 100644
--- a/.github/workflows/gradle.yaml
+++ b/.github/workflows/gradle.yaml
@@ -6,17 +6,17 @@ jobs:
   tests:
     runs-on: ubuntu-latest
 
-  steps:
-    - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
-      with:
-        persist-credentials: false
-    - name: Set up JDK 11
-      uses: actions/setup-java@@de7274f081f381c8f8158605e0321c36c376e2e6  # v6.0.1
-      with:
-        distribution: 'temurin'
-        java-version: '11'
-        java-package: 'jdk'
-    - name: Set up Gradle
-      uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
-    - name: Test with Gradle
-      run: ./gradlew check
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1  # v7.0.1
+        with:
+          persist-credentials: false
+      - name: Set up JDK 11
+        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6  # v6.0.1
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+          java-package: 'jdk'
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
+      - name: Test with Gradle
+        run: ./gradlew check

From 873f354649f6566ec2576e0078a99139fbc2b97d Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=C3=89amonn=20McManus?= <emcmanus@google.com>
Date: Mon, 12 Oct 2026 21:55:27 +0000
Subject: [PATCH 3/3] Add explicit `permissions` clause.

---
 .github/workflows/gradle.yaml | 3 +++
 1 file changed, 3 insertions(+)

diff --git a/.github/workflows/gradle.yaml b/.github/workflows/gradle.yaml
index 572bfc04..90c50604 100644
--- a/.github/workflows/gradle.yaml
+++ b/.github/workflows/gradle.yaml
@@ -2,6 +2,9 @@ name: Java CI
 
 on: [pull_request, push]
 
+permissions:
+  contents: read #  to fetch code (actions/checkout)
+
 jobs:
   tests:
     runs-on: ubuntu-latest