From 9bf0c4322f2e8daae8d6cb3a4190807746a9ad1c Mon Sep 17 00:00:00 2001
From: RappyTV <rappytv@rappytv.com>
Date: Thu, 23 Apr 2026 23:20:01 +0200
Subject: [PATCH 1/2] chore: Harden gradle supply chain

---
 .github/workflows/build.yml              | 21 ++++++---------------
 gradle/wrapper/gradle-wrapper.properties |  3 ++-
 scripts/update-gradle-sha.sh             | 21 +++++++++++++++++++++
 3 files changed, 29 insertions(+), 16 deletions(-)
 create mode 100644 scripts/update-gradle-sha.sh

diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml
index c8a49e7..4582323 100644
--- a/.github/workflows/build.yml
+++ b/.github/workflows/build.yml
@@ -13,24 +13,15 @@ jobs:
     steps:
       - uses: actions/checkout@v5
       - name: Set up JDK 25
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v4
         with:
           distribution: 'corretto'
           java-version: '25'
-      - name: Cache Gradle dependencies
-        uses: actions/cache@v5
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@v4
         with:
-          path: ~/.gradle/caches
-          key: gradle-${{ runner.os }}-${{ hashFiles('**/*.gradle*', '**/gradle-wrapper.properties') }}
-          restore-keys: |
-            gradle-${{ runner.os }}-
-      - name: Cache Gradle wrapper
-        uses: actions/cache@v5
-        with:
-          path: ~/.gradle/wrapper
-          key: gradle-wrapper-${{ runner.os }}-${{ hashFiles('**/gradle/wrapper/gradle-wrapper.properties') }}
-          restore-keys: |
-            gradle-wrapper-${{ runner.os }}-
+          validate-wrappers: true
+          cache-read-only: ${{ github.ref != format('refs/heads/{0}', github.event.repository.default_branch) }}
       - name: Grant execute permission for gradlew
         run: chmod +x gradlew
       - name: Build with Gradle
@@ -39,4 +30,4 @@ jobs:
         uses: actions/upload-artifact@v6
         with:
           name: Artifacts
-          path: build/libs/*-release.jar
+          path: build/libs/*-release.jar
\ No newline at end of file
diff --git a/gradle/wrapper/gradle-wrapper.properties b/gradle/wrapper/gradle-wrapper.properties
index ac57dd1..a4b3c9c 100644
--- a/gradle/wrapper/gradle-wrapper.properties
+++ b/gradle/wrapper/gradle-wrapper.properties
@@ -1,5 +1,6 @@
 distributionBase=GRADLE_USER_HOME
 distributionPath=wrapper/dists
-distributionUrl=https\://services.gradle.org/distributions/gradle-9.2.1-bin.zip
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.4.1-bin.zip
 zipStoreBase=GRADLE_USER_HOME
 zipStorePath=wrapper/dists
+distributionSha256Sum=2ab2958f2a1e51120c326cad6f385153bb11ee93b3c216c5fccebfdfbb7ec6cb
diff --git a/scripts/update-gradle-sha.sh b/scripts/update-gradle-sha.sh
new file mode 100644
index 0000000..bcb5094
--- /dev/null
+++ b/scripts/update-gradle-sha.sh
@@ -0,0 +1,21 @@
+#!/usr/bin/env bash
+# Pins distributionSha256Sum in gradle-wrapper.properties to the official
+# checksum published by Gradle for the current distributionUrl.
+set -euo pipefail
+
+PROPS="$(dirname "$0")/../gradle/wrapper/gradle-wrapper.properties"
+
+url="$(grep -E '^distributionUrl=' "$PROPS" | cut -d= -f2- | sed 's|\\:|:|g')"
+[ -n "$url" ] || { echo "distributionUrl not found in $PROPS" >&2; exit 1; }
+
+sha="$(curl -fsSL "${url}.sha256")"
+[ -n "$sha" ] || { echo "failed to fetch ${url}.sha256" >&2; exit 1; }
+
+if grep -qE '^distributionSha256Sum=' "$PROPS"; then
+  sed -i.bak "s|^distributionSha256Sum=.*|distributionSha256Sum=${sha}|" "$PROPS"
+  rm -f "${PROPS}.bak"
+else
+  printf 'distributionSha256Sum=%s\n' "$sha" >> "$PROPS"
+fi
+
+echo "pinned $(basename "$url") -> $sha"
\ No newline at end of file

From 59818f428c014dbc5870b44a93826e6d6f094ea5 Mon Sep 17 00:00:00 2001
From: RappyTV <rappytv@rappytv.com>
Date: Thu, 23 Apr 2026 23:20:27 +0200
Subject: [PATCH 2/2] chore: Bump version

---
 build.gradle.kts | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/build.gradle.kts b/build.gradle.kts
index 0061055..c467776 100644
--- a/build.gradle.kts
+++ b/build.gradle.kts
@@ -6,7 +6,7 @@ plugins {
 val versions = providers.gradleProperty("net.labymod.minecraft-versions").get().split(";")
 
 group = "org.example"
-version = providers.environmentVariable("VERSION").getOrElse("1.1.0")
+version = providers.environmentVariable("VERSION").getOrElse("1.1.1")
 
 labyMod {
     defaultPackageName = "com.rappytv.betterfriends"