· ReadyStack
Worked example
Real numbers from this tool, line by line.
A release workflow from a 250-person software vendor came back from the gate on 2026-09-21 with 6 Oracle-licensed Java pulls, and the JVM platform engineer who wrote it had never once seen a red build.
Nothing in that repository was broken. The tests passed, the container started, java -version printed what it was supposed to print. The only thing that had changed was the calendar.
Oracle's No-Fee Terms and Conditions cover a Java long term support release until one year after the next long term support release ships. JDK 25 shipped on 2025-09-16. That means the free window for JDK 21 closed on 2026-09-16. JDK 17 left the same window on 2024-09-19. Java 8 and Java 11 never had a No-Fee window at all: those are Oracle Technology Network builds, free for development and test, not for production.
So a line like distribution: 'oracle' in a setup-java step is not a bug that was introduced. It is a line that was free last week and is billable this week, in a file nobody reopened.
That is the part tooling normally misses. A vulnerability scanner asks whether the runtime is patched. An end-of-life linter asks whether the version is still supported. Neither asks the licensing question, because the licensing question has no answer that lives in the file. It lives in the difference between two dates: the day Oracle's window closed and the day you are reading.
grep oracle has the same blind spot from the other direction. It will find the word in six places and tell you nothing about which of the six matter, and a chatbot whose training data stops before September 2026 will cheerfully tell you Oracle JDK 21 is free to use in production. It was, when the model was trained.
The bill is what makes this worth an afternoon. Oracle Java SE Universal Subscription is list-priced at $15 per employee per month, counting every employee in the company, not every Java install. 250 employees x $15 per employee per month x 12 months = $45,000 a year. The unit of billing is the payroll, not the container count, which is why one forgotten line in one Jenkins agent script can price the whole company.
Oracle JDK License Gate reads the file you have open - a Dockerfile, a CI workflow, a shell script, an .sdkmanrc - and runs 9 rules over it with no network call. It catches distribution: oracle, distribution: graalvm (which is Oracle GraalVM, not the community build), a tarball pulled from download.oracle.com, a script that sends oraclelicense=accept to get past the download gate, an image from Oracle's own Java container registry, an Oracle jdk-NN rpm installed with yum or dnf, a third-party oracle-java installer package, a build variable that accepts the Oracle license on your behalf, and an SDKMAN vendor suffix of -oracle or -graal.
Every finding carries four things: the line number, the license basis, the free-window status on today's date, and the free line that replaces it. distribution: temurin. distribution: graalvm-community. eclipse-temurin:21-jdk. An Adoptium API URL. The swap is usually one word.
The bundled sample tells you the shape of a real repository. _fixtures/dirty.yml is a five-job release workflow; the gate reports 6 Oracle-licensed Java pulls in it. _fixtures/clean.yml is the same workflow with OpenJDK lines and reports 0.
Move the date backwards and the answers move with it. Run the same JDK 21 file with the date set to 2026-01-10 and the findings turn from a closed window into a countdown - 249 days from now - because the file was never the thing that changed.
15 seconds — what it actually does
Questions people ask
What does Oracle JDK License Gate actually do?
It reads the Dockerfile, CI workflow, shell script or .sdkmanrc you have open and names every line that pulls an Oracle-licensed Java runtime. Each finding carries the line number, the license basis, whether that Java version is inside Oracle's free window on today's date, and the free OpenJDK line that replaces it. 9 rules, no network call.
Who is this for?
JVM platform and build engineers at companies that sell software. If your repository provisions Java in a container image, a GitHub Actions job, a Jenkins agent script or SDKMAN, one of those lines decides whether your company owes Oracle a subscription. The people who write those lines are rarely the people who sign the license.
Why is grep or a chatbot not enough?
grep finds the word oracle. It cannot tell you that JDK 21 left Oracle's free No-Fee Terms window on 2026-09-16 and JDK 17 left it on 2024-09-19, so the same unchanged line was free last week and is not free today. A chatbot trained before September 2026 will still tell you Oracle JDK 21 is free in production.
What is free and what is paid?
Free: all 9 rules over the file you have open, every finding with its line number and its swap. That job finishes on its own. Paid, $29 once: the same rules swept over every file in the workspace, plus a dated evidence pack with file, line, distribution, license basis and swap, for procurement or an audit. Team and commercial use included.
What would this cost otherwise?
Oracle Java SE Universal Subscription is list-priced at $15 per employee per month, counting every employee in the company, not every Java install. 250 employees x $15 per employee per month x 12 months = $45,000 a year. The unit of billing is your payroll, not the number of containers that happen to run Java.
Why not just ask ChatGPT or another AI chat?
A general AI chat answers from training data with a cutoff date, cannot read your repository and names no rule version. Oracle JDK License Gate checks the file you open against 9 rules, each naming its legal or official basis, from a rule set dated 2026-09-21, and points at the exact line with the fix. For a filing, an audit or a client you need that dated result on your own files.
Ask about this tool
One question, answered by the person who built it. Your email only if you want the answer sent.