From 293df939efc054d02f504db5034cc104e76a869f Mon Sep 17 00:00:00 2001 From: Miguel Allende Date: Thu, 10 Sep 2026 18:07:40 +0200 Subject: [PATCH 1/2] disable maven cache in release workflow --- .github/workflows/maven-goal/action.yml | 3 +-- .mvn/maven.config | 3 ++- 2 files changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/maven-goal/action.yml b/.github/workflows/maven-goal/action.yml index 4cf9c6e9..d0379824 100644 --- a/.github/workflows/maven-goal/action.yml +++ b/.github/workflows/maven-goal/action.yml @@ -20,11 +20,10 @@ runs: using: "composite" steps: - name: Set up JDK - uses: actions/setup-java@v4 + uses: actions/setup-java@v6 with: java-version-file: .java-version distribution: ${{ inputs.distribution }} - cache: 'maven' - run: "${COMMAND}" shell: ${{ inputs.shell }} env: diff --git a/.mvn/maven.config b/.mvn/maven.config index df90860a..39230e54 100644 --- a/.mvn/maven.config +++ b/.mvn/maven.config @@ -2,4 +2,5 @@ -Dorg.slf4j.simpleLogger.log.org.apache.maven.cli.transfer.Slf4jMavenTransferListener=warn -Dhttps.protocols=TLSv1.2 -Dmaven.wagon.http.retryHandler.count=3 --Dmaven.wagon.httpconnectionManager.ttlSeconds=25 \ No newline at end of file +-Dmaven.wagon.httpconnectionManager.ttlSeconds=25 +-Daether.checksumPolicy=fail \ No newline at end of file From 01bc901c21f185c1ae2043154189a115a2039ecc Mon Sep 17 00:00:00 2001 From: Miguel Allende Date: Fri, 11 Sep 2026 14:55:30 +0200 Subject: [PATCH 2/2] document why maven cache stays disabled Co-Authored-By: Claude Sonnet 5 --- .github/workflows/maven-goal/action.yml | 2 ++ 1 file changed, 2 insertions(+) diff --git a/.github/workflows/maven-goal/action.yml b/.github/workflows/maven-goal/action.yml index d0379824..3ffdb66f 100644 --- a/.github/workflows/maven-goal/action.yml +++ b/.github/workflows/maven-goal/action.yml @@ -24,6 +24,8 @@ runs: with: java-version-file: .java-version distribution: ${{ inputs.distribution }} + # cache intentionally disabled (cache poisoning risk): shared by CI and release + # workflows with no per-caller toggle, so it's off everywhere. elastic/observability-robots#3261 - run: "${COMMAND}" shell: ${{ inputs.shell }} env: