From 94db2d73d84011a60831cdda8e4fa939f884877b Mon Sep 17 00:00:00 2001
From: =?UTF-8?q?=EC=9D=BC=ED=98=81?= <dnfjddk2@gmail.com>
Date: Sun, 23 Aug 2026 15:27:24 +0900
Subject: [PATCH] =?UTF-8?q?ci:=20lint=20=EC=9B=8C=ED=81=AC=ED=94=8C?=
 =?UTF-8?q?=EB=A1=9C=EC=9D=98=20setup-java=20Gradle=20=EC=BA=90=EC=8B=B1?=
 =?UTF-8?q?=EC=9D=84=20pinned=20setup-gradle=20=EB=A1=9C=20=ED=86=B5?=
 =?UTF-8?q?=EC=9D=BC?=
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

---
 .github/workflows/lint.yml | 10 +++++++++-
 1 file changed, 9 insertions(+), 1 deletion(-)

diff --git a/.github/workflows/lint.yml b/.github/workflows/lint.yml
index 4effa589a8..e6947063ff 100644
--- a/.github/workflows/lint.yml
+++ b/.github/workflows/lint.yml
@@ -22,7 +22,15 @@ jobs:
         with:
           distribution: 'temurin'
           java-version: '21'
-          cache: 'gradle'
+
+      # 캐싱 소유자는 setup-gradle 하나 — setup-java 의 cache: gradle 은 정책 테스트
+      # (supply-chain-policy.test.mjs)가 금지한다. wrapper 검증도 여기서 fail-closed.
+      - name: Set up Gradle and validate wrapper
+        uses: gradle/actions/setup-gradle@9c971963bec38e04b3d30dcc455b5382be2fdbfb # v6.3.0
+        with:
+          cache-provider: basic
+          cache-read-only: true
+          validate-wrappers: true
 
       - name: Run Ktlint
         uses: ScaCap/action-ktlint@master