audit-build-ci

Audit the build and CI configuration for subtle correctness risks.

Read the build files and CI workflows before analyzing:

• build.gradle.kts (root and caffeine module)
• gradle/plugins/ (custom Gradle plugins)
• .github/workflows/ (GitHub Actions)
• gradle.properties

Consider:

• Misconfigured dependency scopes
• Incorrect test isolation
• Non-reproducible builds
• Incorrect Gradle cache configuration
• Missing failure modes (tests passing when they shouldn't)
• Incorrect CI matrix coverage
• Silent test skipping
• Multi-line YAML values that get interpolated elsewhere (a > folded scalar keeps a trailing newline; splicing one into another folded scalar embeds that newline mid-string, so a consumer splitting on literal spaces mis-parses the spliced-in value's last token)
• Performance problems in the build
• Security issues (dependency vulnerabilities, secret exposure)
• Bad practices that could cause false confidence
• Retry and re-run paths (in-job retry loops, workflow_run re-runners) and what each treats as infrastructure. A job that exceeds timeout-minutes concludes cancelled, not failure, and a hung test reaches CI that way
• Matrix legs that name a JDK distribution: without a vendor constraint, toolchain resolution may pick another detected JDK of the same version

Report only issues that could cause incorrect artifacts, missing failures, or false confidence in test results.

Price a CI finding against live history, not only the YAML: gh api for the ruleset and check-run conclusions, gh run view <id> --log (with --attempt/--job) for what a green run actually hid. A mechanism in a workflow and a run that concealed a failure are separate claims. Read-only queries only.