From b8c964846cc10bc8a6a1f8291b6c91090e515d8b Mon Sep 17 00:00:00 2001
From: Greyson Parrelli <greyson@signal.org>
Date: Tue, 2 Jun 2026 10:36:22 -0400
Subject: [PATCH] Add gradle cache support to CI.

---
 .github/workflows/android.yml | 12 ++++++++++--
 .github/workflows/diffuse.yml | 10 +++++++++-
 2 files changed, 19 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/android.yml b/.github/workflows/android.yml
index 3a0616cc6f..d177d6a8d9 100644
--- a/.github/workflows/android.yml
+++ b/.github/workflows/android.yml
@@ -5,7 +5,7 @@ on:
   push:
     branches:
     - 'main'
-    - '7.**'
+    - '8.**'
 
 permissions:
   contents: read # to fetch code (actions/checkout)
@@ -27,12 +27,20 @@ jobs:
       with:
         distribution: temurin
         java-version: 17
-        cache: gradle
 
     - name: Validate Gradle Wrapper
       uses: gradle/actions/wrapper-validation@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6
       # gh api repos/gradle/actions/commits/v6 --jq '.sha'
 
+    - name: Set up Gradle
+      uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6
+      # gh api repos/gradle/actions/commits/v6 --jq '.sha'
+      with:
+        # Only 8.** branch builds write to the cache; everything else (PRs, etc.) reads only.
+        cache-read-only: ${{ !startsWith(github.ref, 'refs/heads/8.') }}
+        # Required to persist the Gradle configuration cache across runs.
+        cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
+
     - name: Build with Gradle
       run: ./gradlew qa
 
diff --git a/.github/workflows/diffuse.yml b/.github/workflows/diffuse.yml
index 3e8b05e22a..57faed6b28 100644
--- a/.github/workflows/diffuse.yml
+++ b/.github/workflows/diffuse.yml
@@ -28,7 +28,15 @@ jobs:
       with:
         distribution: temurin
         java-version: 17
-        cache: gradle
+
+    - name: Set up Gradle
+      uses: gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6
+      # gh api repos/gradle/actions/commits/v6 --jq '.sha'
+      with:
+        # PR-only workflow: always read from the cache, never write.
+        cache-read-only: true
+        # Required to read the Gradle configuration cache persisted by 8.** builds.
+        cache-encryption-key: ${{ secrets.GRADLE_ENCRYPTION_KEY }}
 
     - name: Install NDK
       run: echo "y" | ${ANDROID_SDK_ROOT}/cmdline-tools/latest/bin/sdkmanager --install "ndk;${{ env.NDK_VERSION }}"