From e1399e7d3652a853c33c8011baecdefdfece62cc Mon Sep 17 00:00:00 2001
From: Kevin Liu <kevin.jq.liu@gmail.com>
Date: Thu, 14 May 2026 22:04:40 -0700
Subject: [PATCH 1/4] fix gradle cache

---
 .../workflows/api-binary-compatibility.yml    |  3 ++
 .github/workflows/cve-scan.yml                |  3 ++
 .github/workflows/delta-conversion-ci.yml     | 14 ++++++++++
 .github/workflows/flink-ci.yml                |  7 +++++
 .github/workflows/hive-ci.yml                 |  7 +++++
 .github/workflows/java-ci.yml                 | 28 +++++++++++++++++++
 .github/workflows/jmh-benchmarks.yml          |  3 ++
 .github/workflows/kafka-connect-ci.yml        |  7 +++++
 .../publish-iceberg-rest-fixture-docker.yml   |  3 ++
 .github/workflows/publish-snapshot.yml        |  3 ++
 .../workflows/recurring-jmh-benchmarks.yml    |  3 ++
 .github/workflows/spark-ci.yml                |  7 +++++
 12 files changed, 88 insertions(+)

diff --git a/.github/workflows/api-binary-compatibility.yml b/.github/workflows/api-binary-compatibility.yml
index 58a04c9427e0..4200bfef977f 100644
--- a/.github/workflows/api-binary-compatibility.yml
+++ b/.github/workflows/api-binary-compatibility.yml
@@ -60,6 +60,9 @@ jobs:
           distribution: zulu
           java-version: 17
       - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+        with:
+          # Read-only: small job; restore opportunistically from other jobs' caches but never write.
+          cache-read-only: true
       - run: |
           echo "Using the old version tag, as per git describe, of $(git describe)";
       - run: ./gradlew revapi --rerun-tasks
diff --git a/.github/workflows/cve-scan.yml b/.github/workflows/cve-scan.yml
index a255104013d2..8370f540b757 100644
--- a/.github/workflows/cve-scan.yml
+++ b/.github/workflows/cve-scan.yml
@@ -127,6 +127,9 @@ jobs:
         distribution: zulu
         java-version: 21
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2 # zizmor: ignore[cache-poisoning] -- cache writes are restricted to the default branch by setup-gradle
+      with:
+        # Read-only: small job; restore opportunistically from other jobs' caches but never write.
+        cache-read-only: true
     - name: Build ${{ matrix.distribution }}
       run: |
         ./gradlew -DsparkVersions= -DflinkVersions= \
diff --git a/.github/workflows/delta-conversion-ci.yml b/.github/workflows/delta-conversion-ci.yml
index 5b5eaddbd3cc..d9f3936f8a35 100644
--- a/.github/workflows/delta-conversion-ci.yml
+++ b/.github/workflows/delta-conversion-ci.yml
@@ -90,6 +90,13 @@ jobs:
           distribution: zulu
           java-version: ${{ matrix.jvm }}
       - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+        with:
+          # Writes cache on main; read-only otherwise.
+          cache-read-only: ${{ !(github.ref == 'refs/heads/main' && matrix.jvm == 17) }}
+          gradle-home-cache-cleanup: true
+          gradle-home-cache-excludes: |
+            caches/build-cache-1
+            caches/keyrings
       - run: echo -e "$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)\t$(hostname -f) $(hostname -s)" | sudo tee -a /etc/hosts
       - run: ./gradlew -DsparkVersions=3.5 -DscalaVersion=2.12 -DkafkaVersions= -DflinkVersions= :iceberg-delta-lake:check -Pquick=true -x javadoc
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -116,6 +123,13 @@ jobs:
           distribution: zulu
           java-version: ${{ matrix.jvm }}
       - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+        with:
+          # Writes cache on main; read-only otherwise.
+          cache-read-only: ${{ !(github.ref == 'refs/heads/main' && matrix.jvm == 17) }}
+          gradle-home-cache-cleanup: true
+          gradle-home-cache-excludes: |
+            caches/build-cache-1
+            caches/keyrings
       - run: echo -e "$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)\t$(hostname -f) $(hostname -s)" | sudo tee -a /etc/hosts
       - run: ./gradlew -DsparkVersions=3.5 -DscalaVersion=2.13 -DkafkaVersions= -DflinkVersions= :iceberg-delta-lake:check -Pquick=true -x javadoc
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
diff --git a/.github/workflows/flink-ci.yml b/.github/workflows/flink-ci.yml
index a33136b68412..e931ff83ee4d 100644
--- a/.github/workflows/flink-ci.yml
+++ b/.github/workflows/flink-ci.yml
@@ -94,6 +94,13 @@ jobs:
         distribution: zulu
         java-version: ${{ matrix.jvm }}
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+      with:
+        # Writes cache on main; read-only otherwise.
+        cache-read-only: ${{ !(github.ref == 'refs/heads/main' && matrix.jvm == 17 && matrix.flink == '2.1') }}
+        gradle-home-cache-cleanup: true
+        gradle-home-cache-excludes: |
+          caches/build-cache-1
+          caches/keyrings
     - run: echo -e "$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)\t$(hostname -f) $(hostname -s)" | sudo tee -a /etc/hosts
     - run: ./gradlew -DsparkVersions= -DkafkaVersions= -DflinkVersions=${{ matrix.flink }} :iceberg-flink:iceberg-flink-${{ matrix.flink }}:check :iceberg-flink:iceberg-flink-runtime-${{ matrix.flink }}:check -Pquick=true -x javadoc -DtestParallelism=auto
     - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
diff --git a/.github/workflows/hive-ci.yml b/.github/workflows/hive-ci.yml
index 2f0b981ea6a0..771310aff294 100644
--- a/.github/workflows/hive-ci.yml
+++ b/.github/workflows/hive-ci.yml
@@ -91,6 +91,13 @@ jobs:
         distribution: zulu
         java-version: ${{ matrix.jvm }}
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+      with:
+        # Writes cache on main; read-only otherwise.
+        cache-read-only: ${{ !(github.ref == 'refs/heads/main' && matrix.jvm == 17) }}
+        gradle-home-cache-cleanup: true
+        gradle-home-cache-excludes: |
+          caches/build-cache-1
+          caches/keyrings
     - run: echo -e "$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)\t$(hostname -f) $(hostname -s)" | sudo tee -a /etc/hosts
     - run: ./gradlew -DsparkVersions= -DflinkVersions= -DkafkaVersions= -Pquick=true :iceberg-mr:check -x javadoc
     - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
diff --git a/.github/workflows/java-ci.yml b/.github/workflows/java-ci.yml
index f807c78f5618..440938fcffe8 100644
--- a/.github/workflows/java-ci.yml
+++ b/.github/workflows/java-ci.yml
@@ -86,6 +86,13 @@ jobs:
         distribution: zulu
         java-version: ${{ matrix.jvm }}
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+      with:
+        # Writes cache on main; read-only otherwise.
+        cache-read-only: ${{ !(github.ref == 'refs/heads/main' && matrix.jvm == 17) }}
+        gradle-home-cache-cleanup: true
+        gradle-home-cache-excludes: |
+          caches/build-cache-1
+          caches/keyrings
     - run: echo -e "$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)\t$(hostname -f) $(hostname -s)" | sudo tee -a /etc/hosts
     - run: ./gradlew check -DsparkVersions= -DflinkVersions= -DkafkaVersions= -Pquick=true -x javadoc
     - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -110,6 +117,13 @@ jobs:
         distribution: zulu
         java-version: ${{ matrix.jvm }}
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+      with:
+        # Writes cache on main; read-only otherwise.
+        cache-read-only: ${{ !(github.ref == 'refs/heads/main' && matrix.jvm == 17) }}
+        gradle-home-cache-cleanup: true
+        gradle-home-cache-excludes: |
+          caches/build-cache-1
+          caches/keyrings
     - run: ./gradlew -DallModules build -x test -x javadoc -x integrationTest
 
   build-javadoc:
@@ -127,6 +141,13 @@ jobs:
         distribution: zulu
         java-version: ${{ matrix.jvm }}
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+      with:
+        # Writes cache on main; read-only otherwise.
+        cache-read-only: ${{ !(github.ref == 'refs/heads/main' && matrix.jvm == 17) }}
+        gradle-home-cache-cleanup: true
+        gradle-home-cache-excludes: |
+          caches/build-cache-1
+          caches/keyrings
     - run: ./gradlew -Pquick=true javadoc
 
   check-runtime-deps:
@@ -140,4 +161,11 @@ jobs:
         distribution: zulu
         java-version: 17
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+      with:
+        # Writes cache on main; read-only otherwise.
+        cache-read-only: ${{ github.ref != 'refs/heads/main' }}
+        gradle-home-cache-cleanup: true
+        gradle-home-cache-excludes: |
+          caches/build-cache-1
+          caches/keyrings
     - run: ./gradlew checkAllRuntimeDeps -q -DallModules=true
diff --git a/.github/workflows/jmh-benchmarks.yml b/.github/workflows/jmh-benchmarks.yml
index e2c9522a757c..1225532a6f31 100644
--- a/.github/workflows/jmh-benchmarks.yml
+++ b/.github/workflows/jmh-benchmarks.yml
@@ -104,6 +104,9 @@ jobs:
         distribution: zulu
         java-version: 17
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+      with:
+        # Disabled: dispatched against arbitrary repo/ref inputs; never restore or write to avoid cache poisoning.
+        cache-disabled: true
     - run: echo -e "$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)\t$(hostname -f) $(hostname -s)" | sudo tee -a /etc/hosts
 
     - name: Run Benchmark
diff --git a/.github/workflows/kafka-connect-ci.yml b/.github/workflows/kafka-connect-ci.yml
index 8f1951c7564a..3a188fc9986c 100644
--- a/.github/workflows/kafka-connect-ci.yml
+++ b/.github/workflows/kafka-connect-ci.yml
@@ -91,6 +91,13 @@ jobs:
         distribution: zulu
         java-version: ${{ matrix.jvm }}
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+      with:
+        # Writes cache on main; read-only otherwise.
+        cache-read-only: ${{ !(github.ref == 'refs/heads/main' && matrix.jvm == 17) }}
+        gradle-home-cache-cleanup: true
+        gradle-home-cache-excludes: |
+          caches/build-cache-1
+          caches/keyrings
     - run: echo -e "$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)\t$(hostname -f) $(hostname -s)" | sudo tee -a /etc/hosts
     - run: |
         ./gradlew -DsparkVersions= -DflinkVersions= -DkafkaVersions=3 \
diff --git a/.github/workflows/publish-iceberg-rest-fixture-docker.yml b/.github/workflows/publish-iceberg-rest-fixture-docker.yml
index 264e402deaac..0b1d8a2339de 100644
--- a/.github/workflows/publish-iceberg-rest-fixture-docker.yml
+++ b/.github/workflows/publish-iceberg-rest-fixture-docker.yml
@@ -49,6 +49,9 @@ jobs:
         distribution: zulu
         java-version: 21
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+      with:
+        # Read-only: small job; restore opportunistically from other jobs' caches but never write.
+        cache-read-only: true
     - name: Build Iceberg Open API project
       run: ./gradlew :iceberg-open-api:shadowJar
     - name: Login to Docker Hub
diff --git a/.github/workflows/publish-snapshot.yml b/.github/workflows/publish-snapshot.yml
index a8557c44f32b..8354d2b4b5bb 100644
--- a/.github/workflows/publish-snapshot.yml
+++ b/.github/workflows/publish-snapshot.yml
@@ -44,6 +44,9 @@ jobs:
           distribution: zulu
           java-version: 17
       - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+        with:
+          # Read-only: small job; restore opportunistically from other jobs' caches but never write.
+          cache-read-only: true
       - env:
           NEXUS_USER: ${{ secrets.NEXUS_USER }}
           NEXUS_PW: ${{ secrets.NEXUS_PW }}
diff --git a/.github/workflows/recurring-jmh-benchmarks.yml b/.github/workflows/recurring-jmh-benchmarks.yml
index 88bb10566e43..98addbc7a41e 100644
--- a/.github/workflows/recurring-jmh-benchmarks.yml
+++ b/.github/workflows/recurring-jmh-benchmarks.yml
@@ -59,6 +59,9 @@ jobs:
           distribution: zulu
           java-version: 17
       - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+        with:
+          # Read-only: small job; restore opportunistically from other jobs' caches but never write.
+          cache-read-only: true
       - run: echo -e "$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)\t$(hostname -f) $(hostname -s)" | sudo tee -a /etc/hosts
 
       - name: Run Benchmark
diff --git a/.github/workflows/spark-ci.yml b/.github/workflows/spark-ci.yml
index 2761491c3e01..b439c020ee1c 100644
--- a/.github/workflows/spark-ci.yml
+++ b/.github/workflows/spark-ci.yml
@@ -101,6 +101,13 @@ jobs:
           distribution: zulu
           java-version: ${{ matrix.jvm }}
       - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
+        with:
+          # Writes cache on main; read-only otherwise.
+          cache-read-only: ${{ !(github.ref == 'refs/heads/main' && matrix.jvm == 17 && matrix.spark == '4.1' && matrix.scala == '2.13') }}
+          gradle-home-cache-cleanup: true
+          gradle-home-cache-excludes: |
+            caches/build-cache-1
+            caches/keyrings
       - uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
         with:
           tool-cache: false

From cb508e61dc82ea8ef43a3c52ccc727d0fd23a41f Mon Sep 17 00:00:00 2001
From: Kevin Liu <kevin.jq.liu@gmail.com>
Date: Thu, 14 May 2026 22:20:49 -0700
Subject: [PATCH 2/4] cache cleanup is enabled by default

---
 .github/workflows/delta-conversion-ci.yml | 2 --
 .github/workflows/flink-ci.yml            | 1 -
 .github/workflows/hive-ci.yml             | 1 -
 .github/workflows/java-ci.yml             | 4 ----
 .github/workflows/kafka-connect-ci.yml    | 1 -
 .github/workflows/spark-ci.yml            | 1 -
 6 files changed, 10 deletions(-)

diff --git a/.github/workflows/delta-conversion-ci.yml b/.github/workflows/delta-conversion-ci.yml
index d9f3936f8a35..5d8444190bcc 100644
--- a/.github/workflows/delta-conversion-ci.yml
+++ b/.github/workflows/delta-conversion-ci.yml
@@ -93,7 +93,6 @@ jobs:
         with:
           # Writes cache on main; read-only otherwise.
           cache-read-only: ${{ !(github.ref == 'refs/heads/main' && matrix.jvm == 17) }}
-          gradle-home-cache-cleanup: true
           gradle-home-cache-excludes: |
             caches/build-cache-1
             caches/keyrings
@@ -126,7 +125,6 @@ jobs:
         with:
           # Writes cache on main; read-only otherwise.
           cache-read-only: ${{ !(github.ref == 'refs/heads/main' && matrix.jvm == 17) }}
-          gradle-home-cache-cleanup: true
           gradle-home-cache-excludes: |
             caches/build-cache-1
             caches/keyrings
diff --git a/.github/workflows/flink-ci.yml b/.github/workflows/flink-ci.yml
index e931ff83ee4d..51b7a614c198 100644
--- a/.github/workflows/flink-ci.yml
+++ b/.github/workflows/flink-ci.yml
@@ -97,7 +97,6 @@ jobs:
       with:
         # Writes cache on main; read-only otherwise.
         cache-read-only: ${{ !(github.ref == 'refs/heads/main' && matrix.jvm == 17 && matrix.flink == '2.1') }}
-        gradle-home-cache-cleanup: true
         gradle-home-cache-excludes: |
           caches/build-cache-1
           caches/keyrings
diff --git a/.github/workflows/hive-ci.yml b/.github/workflows/hive-ci.yml
index 771310aff294..ae56af46a60d 100644
--- a/.github/workflows/hive-ci.yml
+++ b/.github/workflows/hive-ci.yml
@@ -94,7 +94,6 @@ jobs:
       with:
         # Writes cache on main; read-only otherwise.
         cache-read-only: ${{ !(github.ref == 'refs/heads/main' && matrix.jvm == 17) }}
-        gradle-home-cache-cleanup: true
         gradle-home-cache-excludes: |
           caches/build-cache-1
           caches/keyrings
diff --git a/.github/workflows/java-ci.yml b/.github/workflows/java-ci.yml
index 440938fcffe8..7e5738aee00d 100644
--- a/.github/workflows/java-ci.yml
+++ b/.github/workflows/java-ci.yml
@@ -89,7 +89,6 @@ jobs:
       with:
         # Writes cache on main; read-only otherwise.
         cache-read-only: ${{ !(github.ref == 'refs/heads/main' && matrix.jvm == 17) }}
-        gradle-home-cache-cleanup: true
         gradle-home-cache-excludes: |
           caches/build-cache-1
           caches/keyrings
@@ -120,7 +119,6 @@ jobs:
       with:
         # Writes cache on main; read-only otherwise.
         cache-read-only: ${{ !(github.ref == 'refs/heads/main' && matrix.jvm == 17) }}
-        gradle-home-cache-cleanup: true
         gradle-home-cache-excludes: |
           caches/build-cache-1
           caches/keyrings
@@ -144,7 +142,6 @@ jobs:
       with:
         # Writes cache on main; read-only otherwise.
         cache-read-only: ${{ !(github.ref == 'refs/heads/main' && matrix.jvm == 17) }}
-        gradle-home-cache-cleanup: true
         gradle-home-cache-excludes: |
           caches/build-cache-1
           caches/keyrings
@@ -164,7 +161,6 @@ jobs:
       with:
         # Writes cache on main; read-only otherwise.
         cache-read-only: ${{ github.ref != 'refs/heads/main' }}
-        gradle-home-cache-cleanup: true
         gradle-home-cache-excludes: |
           caches/build-cache-1
           caches/keyrings
diff --git a/.github/workflows/kafka-connect-ci.yml b/.github/workflows/kafka-connect-ci.yml
index 3a188fc9986c..7e9d4f6c7da1 100644
--- a/.github/workflows/kafka-connect-ci.yml
+++ b/.github/workflows/kafka-connect-ci.yml
@@ -94,7 +94,6 @@ jobs:
       with:
         # Writes cache on main; read-only otherwise.
         cache-read-only: ${{ !(github.ref == 'refs/heads/main' && matrix.jvm == 17) }}
-        gradle-home-cache-cleanup: true
         gradle-home-cache-excludes: |
           caches/build-cache-1
           caches/keyrings
diff --git a/.github/workflows/spark-ci.yml b/.github/workflows/spark-ci.yml
index b439c020ee1c..5cf055919053 100644
--- a/.github/workflows/spark-ci.yml
+++ b/.github/workflows/spark-ci.yml
@@ -104,7 +104,6 @@ jobs:
         with:
           # Writes cache on main; read-only otherwise.
           cache-read-only: ${{ !(github.ref == 'refs/heads/main' && matrix.jvm == 17 && matrix.spark == '4.1' && matrix.scala == '2.13') }}
-          gradle-home-cache-cleanup: true
           gradle-home-cache-excludes: |
             caches/build-cache-1
             caches/keyrings

From c436303c4aec28be5825ddd6453539e8e5da9b3f Mon Sep 17 00:00:00 2001
From: Kevin Liu <kevin.jq.liu@gmail.com>
Date: Fri, 15 May 2026 09:10:34 -0700
Subject: [PATCH 3/4] 1 global writer

---
 .github/workflows/delta-conversion-ci.yml | 14 +++--------
 .github/workflows/flink-ci.yml            |  9 +++----
 .github/workflows/hive-ci.yml             |  7 ++----
 .github/workflows/java-ci.yml             | 30 +++++++++--------------
 .github/workflows/kafka-connect-ci.yml    |  7 ++----
 .github/workflows/spark-ci.yml            |  9 +++----
 6 files changed, 28 insertions(+), 48 deletions(-)

diff --git a/.github/workflows/delta-conversion-ci.yml b/.github/workflows/delta-conversion-ci.yml
index 5d8444190bcc..1f9d1839804c 100644
--- a/.github/workflows/delta-conversion-ci.yml
+++ b/.github/workflows/delta-conversion-ci.yml
@@ -91,11 +91,8 @@ jobs:
           java-version: ${{ matrix.jvm }}
       - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
         with:
-          # Writes cache on main; read-only otherwise.
-          cache-read-only: ${{ !(github.ref == 'refs/heads/main' && matrix.jvm == 17) }}
-          gradle-home-cache-excludes: |
-            caches/build-cache-1
-            caches/keyrings
+          # Read-only: java-ci's build-checks (17) is the global canonical writer.
+          cache-read-only: true
       - run: echo -e "$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)\t$(hostname -f) $(hostname -s)" | sudo tee -a /etc/hosts
       - run: ./gradlew -DsparkVersions=3.5 -DscalaVersion=2.12 -DkafkaVersions= -DflinkVersions= :iceberg-delta-lake:check -Pquick=true -x javadoc
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -123,11 +120,8 @@ jobs:
           java-version: ${{ matrix.jvm }}
       - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
         with:
-          # Writes cache on main; read-only otherwise.
-          cache-read-only: ${{ !(github.ref == 'refs/heads/main' && matrix.jvm == 17) }}
-          gradle-home-cache-excludes: |
-            caches/build-cache-1
-            caches/keyrings
+          # Read-only: java-ci's build-checks (17) is the global canonical writer.
+          cache-read-only: true
       - run: echo -e "$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)\t$(hostname -f) $(hostname -s)" | sudo tee -a /etc/hosts
       - run: ./gradlew -DsparkVersions=3.5 -DscalaVersion=2.13 -DkafkaVersions= -DflinkVersions= :iceberg-delta-lake:check -Pquick=true -x javadoc
       - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
diff --git a/.github/workflows/flink-ci.yml b/.github/workflows/flink-ci.yml
index 51b7a614c198..77738da9dd5a 100644
--- a/.github/workflows/flink-ci.yml
+++ b/.github/workflows/flink-ci.yml
@@ -95,11 +95,10 @@ jobs:
         java-version: ${{ matrix.jvm }}
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
       with:
-        # Writes cache on main; read-only otherwise.
-        cache-read-only: ${{ !(github.ref == 'refs/heads/main' && matrix.jvm == 17 && matrix.flink == '2.1') }}
-        gradle-home-cache-excludes: |
-          caches/build-cache-1
-          caches/keyrings
+        # Read-only: java-ci's build-checks (17) is the global canonical writer.
+        # Its `-DallModules build` resolves the union dependency closure, so the
+        # content-addressed dependencies cache covers Flink modules too.
+        cache-read-only: true
     - run: echo -e "$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)\t$(hostname -f) $(hostname -s)" | sudo tee -a /etc/hosts
     - run: ./gradlew -DsparkVersions= -DkafkaVersions= -DflinkVersions=${{ matrix.flink }} :iceberg-flink:iceberg-flink-${{ matrix.flink }}:check :iceberg-flink:iceberg-flink-runtime-${{ matrix.flink }}:check -Pquick=true -x javadoc -DtestParallelism=auto
     - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
diff --git a/.github/workflows/hive-ci.yml b/.github/workflows/hive-ci.yml
index ae56af46a60d..477ff47f2701 100644
--- a/.github/workflows/hive-ci.yml
+++ b/.github/workflows/hive-ci.yml
@@ -92,11 +92,8 @@ jobs:
         java-version: ${{ matrix.jvm }}
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
       with:
-        # Writes cache on main; read-only otherwise.
-        cache-read-only: ${{ !(github.ref == 'refs/heads/main' && matrix.jvm == 17) }}
-        gradle-home-cache-excludes: |
-          caches/build-cache-1
-          caches/keyrings
+        # Read-only: java-ci's build-checks (17) is the global canonical writer.
+        cache-read-only: true
     - run: echo -e "$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)\t$(hostname -f) $(hostname -s)" | sudo tee -a /etc/hosts
     - run: ./gradlew -DsparkVersions= -DflinkVersions= -DkafkaVersions= -Pquick=true :iceberg-mr:check -x javadoc
     - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
diff --git a/.github/workflows/java-ci.yml b/.github/workflows/java-ci.yml
index 7e5738aee00d..d18b5e33aa4c 100644
--- a/.github/workflows/java-ci.yml
+++ b/.github/workflows/java-ci.yml
@@ -87,11 +87,10 @@ jobs:
         java-version: ${{ matrix.jvm }}
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
       with:
-        # Writes cache on main; read-only otherwise.
-        cache-read-only: ${{ !(github.ref == 'refs/heads/main' && matrix.jvm == 17) }}
-        gradle-home-cache-excludes: |
-          caches/build-cache-1
-          caches/keyrings
+        # Read-only: build-checks (17) is the canonical writer for the
+        # shared java-ci gradle-home config-hash; this job restores from
+        # it via setup-gradle's restore-keys prefix walk.
+        cache-read-only: true
     - run: echo -e "$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)\t$(hostname -f) $(hostname -s)" | sudo tee -a /etc/hosts
     - run: ./gradlew check -DsparkVersions= -DflinkVersions= -DkafkaVersions= -Pquick=true -x javadoc
     - uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
@@ -119,9 +118,6 @@ jobs:
       with:
         # Writes cache on main; read-only otherwise.
         cache-read-only: ${{ !(github.ref == 'refs/heads/main' && matrix.jvm == 17) }}
-        gradle-home-cache-excludes: |
-          caches/build-cache-1
-          caches/keyrings
     - run: ./gradlew -DallModules build -x test -x javadoc -x integrationTest
 
   build-javadoc:
@@ -140,11 +136,10 @@ jobs:
         java-version: ${{ matrix.jvm }}
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
       with:
-        # Writes cache on main; read-only otherwise.
-        cache-read-only: ${{ !(github.ref == 'refs/heads/main' && matrix.jvm == 17) }}
-        gradle-home-cache-excludes: |
-          caches/build-cache-1
-          caches/keyrings
+        # Read-only: build-checks (17) is the canonical writer for the
+        # shared java-ci gradle-home config-hash; this job restores from
+        # it via setup-gradle's restore-keys prefix walk.
+        cache-read-only: true
     - run: ./gradlew -Pquick=true javadoc
 
   check-runtime-deps:
@@ -159,9 +154,8 @@ jobs:
         java-version: 17
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
       with:
-        # Writes cache on main; read-only otherwise.
-        cache-read-only: ${{ github.ref != 'refs/heads/main' }}
-        gradle-home-cache-excludes: |
-          caches/build-cache-1
-          caches/keyrings
+        # Read-only: build-checks (17) is the canonical writer for java-ci.
+        # Its `-DallModules build` resolves the runtime-dep superset this job
+        # needs, so the content-addressed dependencies cache covers us.
+        cache-read-only: true
     - run: ./gradlew checkAllRuntimeDeps -q -DallModules=true
diff --git a/.github/workflows/kafka-connect-ci.yml b/.github/workflows/kafka-connect-ci.yml
index 7e9d4f6c7da1..c8de0e177ba3 100644
--- a/.github/workflows/kafka-connect-ci.yml
+++ b/.github/workflows/kafka-connect-ci.yml
@@ -92,11 +92,8 @@ jobs:
         java-version: ${{ matrix.jvm }}
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
       with:
-        # Writes cache on main; read-only otherwise.
-        cache-read-only: ${{ !(github.ref == 'refs/heads/main' && matrix.jvm == 17) }}
-        gradle-home-cache-excludes: |
-          caches/build-cache-1
-          caches/keyrings
+        # Read-only: java-ci's build-checks (17) is the global canonical writer.
+        cache-read-only: true
     - run: echo -e "$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)\t$(hostname -f) $(hostname -s)" | sudo tee -a /etc/hosts
     - run: |
         ./gradlew -DsparkVersions= -DflinkVersions= -DkafkaVersions=3 \
diff --git a/.github/workflows/spark-ci.yml b/.github/workflows/spark-ci.yml
index 5cf055919053..001d73c4278d 100644
--- a/.github/workflows/spark-ci.yml
+++ b/.github/workflows/spark-ci.yml
@@ -102,11 +102,10 @@ jobs:
           java-version: ${{ matrix.jvm }}
       - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
         with:
-          # Writes cache on main; read-only otherwise.
-          cache-read-only: ${{ !(github.ref == 'refs/heads/main' && matrix.jvm == 17 && matrix.spark == '4.1' && matrix.scala == '2.13') }}
-          gradle-home-cache-excludes: |
-            caches/build-cache-1
-            caches/keyrings
+          # Read-only: java-ci's build-checks (17) is the global canonical writer.
+          # Its `-DallModules build` resolves the union dependency closure, so the
+          # content-addressed dependencies cache covers Spark modules too.
+          cache-read-only: true
       - uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
         with:
           tool-cache: false

From 2a1d7383b2207307308e249a7ec68aa165ab5f66 Mon Sep 17 00:00:00 2001
From: Kevin Liu <kevin.jq.liu@gmail.com>
Date: Fri, 15 May 2026 14:39:02 -0700
Subject: [PATCH 4/4] align comment

---
 .github/workflows/flink-ci.yml |  2 --
 .github/workflows/java-ci.yml  | 12 +++---------
 .github/workflows/spark-ci.yml |  2 --
 3 files changed, 3 insertions(+), 13 deletions(-)

diff --git a/.github/workflows/flink-ci.yml b/.github/workflows/flink-ci.yml
index 77738da9dd5a..565b8fd79672 100644
--- a/.github/workflows/flink-ci.yml
+++ b/.github/workflows/flink-ci.yml
@@ -96,8 +96,6 @@ jobs:
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
       with:
         # Read-only: java-ci's build-checks (17) is the global canonical writer.
-        # Its `-DallModules build` resolves the union dependency closure, so the
-        # content-addressed dependencies cache covers Flink modules too.
         cache-read-only: true
     - run: echo -e "$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)\t$(hostname -f) $(hostname -s)" | sudo tee -a /etc/hosts
     - run: ./gradlew -DsparkVersions= -DkafkaVersions= -DflinkVersions=${{ matrix.flink }} :iceberg-flink:iceberg-flink-${{ matrix.flink }}:check :iceberg-flink:iceberg-flink-runtime-${{ matrix.flink }}:check -Pquick=true -x javadoc -DtestParallelism=auto
diff --git a/.github/workflows/java-ci.yml b/.github/workflows/java-ci.yml
index d18b5e33aa4c..40937642c27c 100644
--- a/.github/workflows/java-ci.yml
+++ b/.github/workflows/java-ci.yml
@@ -87,9 +87,7 @@ jobs:
         java-version: ${{ matrix.jvm }}
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
       with:
-        # Read-only: build-checks (17) is the canonical writer for the
-        # shared java-ci gradle-home config-hash; this job restores from
-        # it via setup-gradle's restore-keys prefix walk.
+        # Read-only: java-ci's build-checks (17) is the global canonical writer.
         cache-read-only: true
     - run: echo -e "$(ip addr show eth0 | grep "inet\b" | awk '{print $2}' | cut -d/ -f1)\t$(hostname -f) $(hostname -s)" | sudo tee -a /etc/hosts
     - run: ./gradlew check -DsparkVersions= -DflinkVersions= -DkafkaVersions= -Pquick=true -x javadoc
@@ -136,9 +134,7 @@ jobs:
         java-version: ${{ matrix.jvm }}
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
       with:
-        # Read-only: build-checks (17) is the canonical writer for the
-        # shared java-ci gradle-home config-hash; this job restores from
-        # it via setup-gradle's restore-keys prefix walk.
+        # Read-only: java-ci's build-checks (17) is the global canonical writer.
         cache-read-only: true
     - run: ./gradlew -Pquick=true javadoc
 
@@ -154,8 +150,6 @@ jobs:
         java-version: 17
     - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
       with:
-        # Read-only: build-checks (17) is the canonical writer for java-ci.
-        # Its `-DallModules build` resolves the runtime-dep superset this job
-        # needs, so the content-addressed dependencies cache covers us.
+        # Read-only: java-ci's build-checks (17) is the global canonical writer.
         cache-read-only: true
     - run: ./gradlew checkAllRuntimeDeps -q -DallModules=true
diff --git a/.github/workflows/spark-ci.yml b/.github/workflows/spark-ci.yml
index 001d73c4278d..5b13ae9bc463 100644
--- a/.github/workflows/spark-ci.yml
+++ b/.github/workflows/spark-ci.yml
@@ -103,8 +103,6 @@ jobs:
       - uses: gradle/actions/setup-gradle@0723195856401067f7a2779048b490ace7a47d7c # v5.0.2
         with:
           # Read-only: java-ci's build-checks (17) is the global canonical writer.
-          # Its `-DallModules build` resolves the union dependency closure, so the
-          # content-addressed dependencies cache covers Spark modules too.
           cache-read-only: true
       - uses: jlumbroso/free-disk-space@54081f138730dfa15788a46383842cd2f914a1be # v1.3.1
         with: