570 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
Bruno Borges	27f2c62824	Verify JDK downloads with vendor checksums (#1167) ... * Verify JDK downloads with vendor checksums Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d * Handle missing vendor checksum values Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d * Preserve checksum error during cleanup failure Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d * Validate checksum metadata value types Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d * Clarify checksum documentation Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d * Expand vendor checksum verification Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d * Accept SHA-256 or SHA-512 for JetBrains checksum sibling JetBrains publishes a single, generically-named ".checksum" sibling whose digest algorithm isn't disclosed by the filename. Older JBR 11 builds (e.g. jbrsdk_nomod-11_0_16-*-b2043.64.tar.gz) publish a SHA-256 digest there, while newer builds publish SHA-512. The JetBrains installer previously assumed SHA-512 unconditionally, so verification failed with "Malformed sha512 checksum metadata ... expected a 128-character hexadecimal digest" for those older builds, breaking the jetbrains 11 e2e job on macOS and Windows. fetchChecksum now accepts a list of candidate algorithms and infers the actual algorithm from the returned digest's length, preferring the strongest match. The JetBrains installer passes ['sha512', 'sha256']; all other callers are unaffected since they already pass a single, vendor-disclosed algorithm. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d * Use SapMachine archive checksum files Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d	2026-07-29 04:43:56 -04:00
Bruno Borges	19c23b379e	Harden java-package validation (#1165) ... Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 10b8fe1e-18f4-42cb-8672-11215715a713	2026-07-29 00:50:01 -04:00
Bruno Borges	6e26972896	Add setup orchestration tests (#1163) ... Make the setup entrypoint import-safe and cover its validation, installation sequencing, post-install collaborators, caching, and failure handling directly. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a5ba8975-a9ac-4d2c-b41d-97c99689d1bd	2026-07-29 00:36:12 -04:00
Bruno Borges	5894ef6b27	Consolidate JDK metadata retry handling (#1162) ... * Consolidate JDK metadata retries Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a5e2549a-0d89-4c8f-b7f3-411ad21c8a06 * Expand distribution retry coverage Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a5e2549a-0d89-4c8f-b7f3-411ad21c8a06 --------- Copilot-Session: a5e2549a-0d89-4c8f-b7f3-411ad21c8a06	2026-07-29 00:09:37 -04:00
Bruno Borges	e1ce3a3428	Fail on mismatched Maven toolchain ID counts (#1161) ... * Fail on mismatched Maven toolchain IDs Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8c821981-7b21-45fe-9463-5bb375d7dce4 * Clarify Maven toolchain ID version counts Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8c821981-7b21-45fe-9463-5bb375d7dce4 --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8c821981-7b21-45fe-9463-5bb375d7dce4	2026-07-28 23:33:41 -04:00
Bruno Borges	ce75feb3d3	Reject invalid boolean input values (#1160) ... Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: c6daa6b5-31f5-46b2-a994-b8320b50a50d	2026-07-28 22:43:39 -04:00
Bruno Borges	382d4b753d	Fix caching when wrapper distributions are absent (#1151) ... * Fix missing wrapper cache distributions Skip optional Maven and Gradle wrapper cache saves when their distribution paths do not exist, while allowing the main dependency cache to save. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a43181c5-548d-4293-be58-b76c03cece79 * Use resolved paths for wrapper cache saves Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a43181c5-548d-4293-be58-b76c03cece79 * Rebuild action distributions Regenerate the setup and cleanup bundles after updating additional cache saves to use resolved paths. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a43181c5-548d-4293-be58-b76c03cece79 --------- Copilot-Session: a43181c5-548d-4293-be58-b76c03cece79	2026-07-28 19:14:06 -04:00
Bruno Borges	24d1ce4c2b	Document Java package compatibility (#1152) ... Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: de5ff500-7ba1-4b07-9805-cfc4036d6155	2026-07-28 18:47:14 -04:00
Copilot	1c3b3d28f0	Support Temurin JDKs with JMOD files (#1149) ... * Initial plan * Add Temurin JMOD installation support * Rebuild action bundles * Use java-package for Temurin JMODs Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: e7d8c581-2d14-4ccc-aeca-afc0f3b0c2bc * Fix Temurin JMOD test paths on Windows Use platform-aware path construction for the JMOD copy and cache assertions so the Windows test expects backslash-normalized paths. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: e7d8c581-2d14-4ccc-aeca-afc0f3b0c2bc	2026-07-28 18:39:15 -04:00
Copilot	0b0bd25927	Add OpenJDK distribution (#1147) ... * Initial plan * Add OpenJDK distribution * Support archived OpenJDK release formats * Handle legacy OpenJDK URL layout * Resolve legacy OpenJDK build metadata * Rename OpenJDK distribution to oracle-openjdk Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2c93ae0c-bbf5-40f5-bf6e-40168d0e267f * Make OpenJDK tests platform independent Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2c93ae0c-bbf5-40f5-bf6e-40168d0e267f * Document Oracle OpenJDK early access builds Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2c93ae0c-bbf5-40f5-bf6e-40168d0e267f * Clarify Oracle OpenJDK security note Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2c93ae0c-bbf5-40f5-bf6e-40168d0e267f --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com> Copilot-Session: 2c93ae0c-bbf5-40f5-bf6e-40168d0e267f	2026-07-28 15:55:33 -04:00
Copilot	089b010dc8	Add force-download option for reproducible JDK builds (#1148) ... * Initial plan * Add force-download input * Build force-download action bundles --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-07-28 14:43:47 -04:00
Copilot	e07d36bbdd	Set GRAALVM_HOME for GraalVM distributions (#1146) ... * Initial plan * Set GRAALVM_HOME for GraalVM distributions * Rebuild setup action bundle --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>	2026-07-27 22:27:24 -04:00
Copilot	69304e5bab	Remediate npm audit findings and rebuild distributions (#1145) ... * Pin patched brace-expansion release * Rebuild action bundles * Refresh licensed npm cache records * Restore compatible brace expansion versions * Restore transitive dependency license records * Fix brace-expansion GHSA-mh99-v99m-4gvg vulnerability via npm overrides * Update licensed dependency records to fix CI license check --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>	2026-07-27 21:57:35 -04:00
Bruno Borges	f75542ba2b	Fix formatting issues in README.md (#1144)	2026-07-27 16:11:12 -04:00
Markus Hoffrogge	c59dceb0cd	chore(deps): fix npm audited vulnerabilities (#1140)	2026-07-27 14:34:04 -04:00
dependabot[bot]	8f48118d89	chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 (#1137) ... Bumps [typescript](https://github.com/microsoft/TypeScript) from 6.0.3 to 7.0.2. - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](https://github.com/microsoft/TypeScript/commits) --- updated-dependencies: - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-07-27 13:45:11 -04:00
dependabot[bot]	c79143eaae	chore(deps-dev): bump lint-staged from 17.0.8 to 17.2.0 (#1136) ... Bumps [lint-staged](https://github.com/lint-staged/lint-staged) from 17.0.8 to 17.2.0. - [Release notes](https://github.com/lint-staged/lint-staged/releases) - [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md) - [Commits](https://github.com/lint-staged/lint-staged/compare/v17.0.8...v17.2.0) --- updated-dependencies: - dependency-name: lint-staged dependency-version: 17.1.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-07-27 13:44:06 -04:00
dependabot[bot]	77c695c0d0	chore(deps-dev): bump @typescript-eslint/parser from 8.64.0 to 8.65.0 (#1138) ... Bumps [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) from 8.64.0 to 8.65.0. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.65.0/packages/parser) --- updated-dependencies: - dependency-name: "@typescript-eslint/parser" dependency-version: 8.64.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-07-27 13:42:04 -04:00
dependabot[bot]	7b26641a55	chore(deps): bump fast-xml-parser from 5.9.3 to 5.10.1 (#1142) ... Bumps [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) from 5.9.3 to 5.10.1. - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](https://github.com/NaturalIntelligence/fast-xml-parser/compare/v5.9.3...v5.10.1) --- updated-dependencies: - dependency-name: fast-xml-parser dependency-version: 5.10.1 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-07-27 13:38:57 -04:00
dependabot[bot]	e08df439e0	chore(deps): bump actions/setup-python from 6 to 7 (#1143) ... Bumps [actions/setup-python](https://github.com/actions/setup-python) from 6 to 7. - [Release notes](https://github.com/actions/setup-python/releases) - [Commits](https://github.com/actions/setup-python/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/setup-python dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-07-27 13:38:27 -04:00
dependabot[bot]	cd3b6000e4	chore(deps-dev): bump @typescript-eslint/eslint-plugin (#1135) ... Bumps [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) from 8.63.0 to 8.64.0. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.64.0/packages/eslint-plugin) --- updated-dependencies: - dependency-name: "@typescript-eslint/eslint-plugin" dependency-version: 8.64.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-27 13:11:27 -04:00
Bruno Borges	c3d7ccbf81	Clarify credential environment variable inputs (#1134) ... * Clarify credential environment variable inputs Rename credential-related inputs to make their environment-variable semantics explicit while preserving deprecated aliases with migration warnings. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 70a3daa8-dbc9-4eb0-a57b-df198a459315 * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-07-17 20:10:58 -04:00
Haritha	46f6294045	docs: update setup-java examples (#1131) ... * docs: update setup-java examples * docs: fix YAML example indentation Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 190c65c4-f5aa-4595-8e2e-26266fbcb37f * docs: note v6 development status Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 190c65c4-f5aa-4595-8e2e-26266fbcb37f --------- Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-07-16 14:25:45 -04:00
Bruno Borges	e40a8e0642	Add an option to disable Java problem matchers (#1133) ... * Add problem matcher opt-out Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 38eb7886-7ea3-4e4d-8d5f-e3f975135053 * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-07-16 11:28:10 -04:00
Philip Gai	6e2e32e729	chore(deps): bump @actions/cache to 6.2.0 (#1128) ... * chore(deps): bump @actions/cache to 6.2.0 Bump @actions/cache from ^6.1.0 to ^6.2.0 and rebuild the vendored dist/ bundles. 6.2.0 honors ACTIONS_CACHE_MODE to skip restore/save when the effective cache-mode disallows it, and surfaces a core.warning (instead of failing the run) when the cache service denies a read/write due to token scopes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0046a2b8-0238-4ac6-93f6-70c4e60b5630 * chore: update licensed record for @actions/cache 6.2.0 Refresh the cached licensed dependency record so the version matches the bumped @actions/cache 6.2.0. License text, summary, and homepage are unchanged; only the version field was stale, which failed the "Check licenses" CI job. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0046a2b8-0238-4ac6-93f6-70c4e60b5630 --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-07-15 17:16:17 -04:00
Bruno Borges	38fa86f9e4	Document missing action inputs in README (#1130) ... * Document missing action inputs Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4b9fa143-418b-44da-aff0-7a7938148e39 * Apply suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-07-15 16:33:32 -04:00
jmjaffe37	ecd5f809c2	Updated msft json for now (#1129)	2026-07-15 16:33:24 -04:00
Bruno Borges	4a24efdcc9	Use YAML anchors to reduce boilerplate in e2e-versions workflow (#1126) ... * Use YAML anchors to reduce boilerplate in e2e-versions workflow No-behavior-change refactor. Introduces a `&checkout_step` anchor for the identical Checkout step (aliased via `*checkout_step` in the other 16 jobs) and a `&default_os` anchor for the common `[macos-latest, windows-latest, ubuntu-latest]` matrix list (aliased via `*default_os` in the 11 other jobs that use that exact list). Lists that differ (macos-15-intel, ubuntu-latest only, windows-latest+ubuntu-22.04) are left untouched. Once anchors are expanded the document is byte-for-byte equivalent to the original. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Fix merge conflicts: adopt consolidated jobs from main, preserve YAML anchors --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>	2026-07-15 11:49:48 -04:00
Bruno Borges	cc8cdedf67	Consolidate duplicate jobs in e2e-versions workflow (#1125) ... Merge the three EA jobs (zulu, temurin, sapmachine) into a single setup-java-ea-versions job driven by a matrix include list, and merge the two signature-verification jobs (temurin, microsoft) into a single setup-java-signature-verification job with a distribution matrix dimension. Test coverage is unchanged: all 15 EA combos and all 12 signature combos still run. Copilot-Session: 9924b163-0ad2-4f8c-b038-0f00220a3157 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-07-15 11:30:35 -04:00
Bruno Borges	4b0728bd0d	Extract repeated directory-check assertions into check-dir.sh helper (#1127) ... * Extract repeated directory-check assertions into check-dir.sh helper The e2e-cache.yml workflow repeated the same inline shell block many times to assert a cache directory exists (and list it), plus inverse checks that a directory does NOT exist (the gradle2/maven2/sbt2 cache-miss jobs). Add `__tests__/check-dir.sh` (POSIX sh, executable) with a `check-dir.sh <dir> [present|absent]` interface and replace every inline check with a call to it, passing already-expanded $HOME paths to avoid tilde-expansion pitfalls. The sbt jobs override working-directory, so they call the helper via $GITHUB_WORKSPACE. Per-OS Coursier conditionals and all build steps are left unchanged. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Address review: argc guard in check-dir.sh, fix sbt ubuntu matrix conditionals - check-dir.sh: with set -u, invoking without a <dir> argument failed with an opaque "parameter not set" error. Add an explicit argc check that prints a usage message and exits 2 (distinct from the assertion failure code 1). - e2e-cache.yml: the sbt-save and sbt-restore jobs run on an ubuntu-22.04 matrix entry, but their coursier-cache steps were guarded by 'if: matrix.os == "ubuntu-latest"', so those checks never executed on Ubuntu. Align the conditionals with the matrix (ubuntu-22.04), matching the newer sbt1/sbt2 jobs. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-07-15 11:14:40 -04:00
Bruno Borges	7d485884af	Use gpg.passphraseEnvName instead of the deprecated gpg.passphrase server (#1123) ... * Use gpg.passphraseEnvName instead of gpg.passphrase server The maven-gpg-plugin's `gpg.passphrase`/`passphraseServerId` mechanism is deprecated and fails when the plugin's `bestPractices` mode is enabled. Stop writing the `gpg.passphrase` server to settings.xml and instead set `gpg.passphraseEnvName` via an active profile when the configured passphrase env var name differs from the plugin default (MAVEN_GPG_PASSPHRASE). The default `gpg-passphrase` input value (GPG_PASSPHRASE) is unchanged, so the plugin reads the same environment variable as before. Fixes #760 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Fix settings.xml publishing validation Update the publishing e2e check to assert the settings.xml generated when gpg-passphrase is MAVEN_GPG_PASSPHRASE. In that default case the action no longer writes a gpg.passphrase server entry. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7d0a510e-aebf-4ec4-a667-efeb3e4edeb1 * Default gpg-passphrase to MAVEN_GPG_PASSPHRASE Align the default `gpg-passphrase` input value with the maven-gpg-plugin default environment variable name (MAVEN_GPG_PASSPHRASE). With this default, setup-java writes no extra GPG configuration to settings.xml and the plugin reads the passphrase from MAVEN_GPG_PASSPHRASE out of the box. Also document that reading the passphrase from an environment variable via `gpg.passphraseEnvName` requires maven-gpg-plugin 3.2.0 or newer. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7d0a510e-aebf-4ec4-a667-efeb3e4edeb1 * Document gpg-passphrase breaking change in V6 Add a "Breaking changes in V6" section to the README covering the switch to gpg.passphraseEnvName, the new MAVEN_GPG_PASSPHRASE default, and the maven-gpg-plugin 3.2.0+ requirement. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7d0a510e-aebf-4ec4-a667-efeb3e4edeb1 * Keep GPG_PASSPHRASE default for v5 compatibility Revert the gpg-passphrase input default back to GPG_PASSPHRASE so existing v5 workflows that set the GPG_PASSPHRASE environment variable keep working without changes. setup-java writes gpg.passphraseEnvName=GPG_PASSPHRASE into an active profile, so the maven-gpg-plugin reads the same variable as before. The only remaining compatibility requirement is maven-gpg-plugin 3.2.0+, which is documented in the README and advanced usage guide. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7d0a510e-aebf-4ec4-a667-efeb3e4edeb1 * Clarify GPG passphrase profile compatibility Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7d0a510e-aebf-4ec4-a667-efeb3e4edeb1 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-07-15 10:33:09 -04:00
Bruno Borges	c3568cc9d9	Consolidate cache-dependency-path e2e workflow and add maven/sbt coverage (#1124) ... * Merge cache-dependency-path e2e workflow into e2e-cache Fold the standalone 'Validate cache with cache-dependency-path option' workflow into e2e-cache.yml and delete the separate file. The three gradle1-save/gradle1-restore/gradle2-restore jobs are copied verbatim, preserving their matrix, cache-dependency-path inputs, and needs relationships. No change in test coverage. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 635b89fa-5c35-49e1-a257-dc9001ebb8db * Add cache-dependency-path e2e coverage for maven and sbt Previously only gradle exercised the cache-dependency-path input. Mirror the gradle save/restore(hit)/restore(miss) pattern for maven and sbt: - maven1-save/maven1-restore/maven2-restore - sbt1-save/sbt1-restore/sbt2-restore Each save+restore pair uses the same cache-dependency-path so the restore is a hit, while the second restore points at a new maven2/sbt2 fixture whose different dependencies produce a different hash, so the cache is a miss (directory not created). New fixtures added under __tests__/cache. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 635b89fa-5c35-49e1-a257-dc9001ebb8db --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-07-15 10:28:27 -04:00
Bruno Borges	81c13a41f9	Cache Maven and Gradle wrapper distributions separately from the dependency cache (#1097) ... * Cache Maven wrapper distribution separately from the local repository The Maven wrapper distribution (~/.m2/wrapper/dists) was cached in the same entry as the local Maven repository (~/.m2/repository), keyed on a hash of **/pom.xml (plus wrapper properties and extensions). Because pom.xml changes frequently and no restoreKeys are used (by design, #269), almost every change produces a full cache miss and the wrapper distribution is re-downloaded via mvnw — which intermittently fails due to upstream rate limiting. The wrapper distribution only depends on maven-wrapper.properties, which changes very rarely. Give it its own cache entry keyed solely on **/.mvn/wrapper/maven-wrapper.properties so it survives the frequent pom.xml changes that rotate the main dependency cache key. - Add a generic additionalCaches concept to PackageManager, restored and saved independently with name-scoped state keys. - Move ~/.m2/wrapper/dists out of the main maven path into a maven-wrapper additional cache; skip silently when the project does not use mvnw. - Keep cache-hit / cache-primary-key outputs driven by the main cache. - Update tests, docs, and rebuild dist bundles. Fixes #1095 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Cache Gradle wrapper distribution separately from the dependency cache (#1098) The Gradle wrapper distribution (~/.gradle/wrapper) only depends on gradle-wrapper.properties, which changes rarely, but it was previously cached in the same entry as ~/.gradle/caches, keyed on volatile **/*.gradle* files with no restoreKeys (issue #269). Every dependency change therefore re-downloaded the wrapper. Move ~/.gradle/wrapper into a dedicated `gradle-wrapper` additional cache keyed only on **/gradle-wrapper.properties, reusing the additionalCaches infrastructure introduced for the Maven wrapper fix. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Fix broken try/catch in saveAdditionalCache and rebuild dist The autofix commits dropped the `} catch (error) {` line in saveAdditionalCache, leaving a `try` block without a catch and a dangling `error` reference, which broke compilation and Prettier. Restore the catch clause, reformat, and regenerate the dist bundles. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Address cache.ts review feedback - saveAdditionalCache: handle @actions/cache ValidationError (thrown when the cache paths do not resolve, e.g. the wrapper distribution was never downloaded) by skipping instead of failing the post step. Add a test. - Point the Gradle wrapper cache comment at issue #269 (Gradle wrapper cache churn) instead of the Maven-specific #1095. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Document Gradle Wrapper distribution caching in README Add a parallel "Gradle Wrapper" note alongside the Maven Wrapper note, so the new behavior for cache: 'gradle' (caching ~/.gradle/wrapper in a separate entry keyed on **/gradle-wrapper.properties) is documented. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-07-14 17:14:23 -04:00
Antonin Delpeuch	3c85b14378	feat: Update recommended configuration for GPG signing (#608) ... * Update recommended configuration for GPG signing This attempts to document the new recommended configuration to sign artifacts with the maven-gpg-plugin as part of the deploy process. It imitates this PR from the maintainer of the maven-gpg-plugin: https://github.com/xerial/sqlite-jdbc/pull/1082/files Notes that this requires the maven-gpg-plugin version 3.2.0 or above, not sure if this is worth adding to the documentation as I expect this guide will mostly be followed by people setting up a new project (hopefully using the latest version of the plugin by default). @cstamas I hope I got it right, feel free to suggest any improvements * Remove unnecessary comment * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * docs: tidy GPG signing section for bc signer - Remove leftover gpg.passphrase server from the GitHub Packages settings.xml example - Clarify that the bc signer needs no gpg binary, keychain import, or pinentry loopback - Document the legacy gpg-private-key/gpg-passphrase input path alongside it - Note the MAVEN_GPG_KEY must be an ASCII-armored (TSK) secret key Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 50be9bf4-3414-43f2-8454-03c2d9e61973 * docs: add legacy GPG signing example alongside bc signer Restore a complete, clearly-labeled legacy path (setup-java gpg-private-key/ gpg-passphrase inputs) for maven-gpg-plugin < 3.2.0 or the gpg executable: full workflow YAML, the generated gpg.passphrase server, and the --pinentry-mode loopback pom.xml snippet. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 50be9bf4-3414-43f2-8454-03c2d9e61973 --------- Co-authored-by: Bruno Borges <bruno.borges@gmail.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-07-14 16:45:40 -04:00
Copilot	80c368b720	Disable persisted checkout credentials in e2e workflow (#1115) ... * Initial plan * Disable persisted checkout credentials in e2e set-default job (alert #124) --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-07-14 16:11:17 -04:00
Copilot	cd57b95697	Fix template injection in e2e-versions.yml (zizmor alert #122) (#1120) ... * Initial plan * Fix template injection in e2e-versions.yml (zizmor alert #122) --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>	2026-07-14 15:55:49 -04:00
Copilot	7a475d86d1	Fix template injection (zizmor alert #118) in e2e-versions.yml (#1114) ... * Initial plan * Fix template injection alert #118 in e2e-versions.yml --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>	2026-07-14 15:36:28 -04:00
Pasha Finkelshteyn	92f9362dd0	dist: Support Liberica NIK (#878) (#1112) ... Add the `liberica-nik` distribution (Liberica Native Image Kit), a GraalVM-based build from BELL Software resolved via the Bell-SW `/v1/nik/releases` API. - `java-version` matches the embedded JDK version (from the release's `liberica` component), consistent with every other distribution. - `java-package: jdk` installs the `standard` bundle; `jdk+fx` installs the `full` bundle with JavaFX/Swing support. - Supported on Linux, macOS and Windows for x64 and aarch64. Signed-off-by: asm0dey <pavel.finkelshtein@gmail.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-07-14 14:49:31 -04:00
Bruno Borges	71cfe8e0ed	Preserve Maven toolchains across repeated setup-java runs (#1099) (#1111) ... * Preserve Maven toolchains across repeated setup-java runs (#1099) Toolchain generation was gated behind the `overwrite-settings` input, which is documented to control only regeneration of `settings.xml`. Because `generateToolchainDefinition` already performs a non-destructive merge (existing JDK, custom, and user-managed toolchains are preserved, and only an entry with the same `type` + `provides.id` is replaced), skipping the write when `overwrite-settings: false` caused later setup-java executions to drop toolchain entries registered by earlier runs. Decouple toolchains generation from `overwrite-settings`: the toolchains file is now always written, so consecutive runs accumulate every JDK. `settings.xml` behavior (auth.ts) is unchanged. - src/toolchains.ts: drop overwriteSettings from configureToolchains / createToolchainsSettings / writeToolchainsFileToDisk; always write. - __tests__/toolchains.test.ts: update call sites, rewrite the "does not overwrite" test to assert non-destructive extension, and add a regression test for consecutive configureToolchains executions. - docs/advanced-usage.md: clarify merge is non-destructive and independent of overwrite-settings. - dist/setup/index.js: rebuilt. Fixes #1099 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0bcec457-b86b-4902-b6e6-6dfd6b2570f7 * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-07-14 07:54:11 -04:00
dependabot[bot]	eb6157cd13	chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 (#1102) ... * chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 Bumps [typescript](https://github.com/microsoft/TypeScript) from 6.0.3 to 7.0.2. - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](https://github.com/microsoft/TypeScript/commits) --- updated-dependencies: - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> * fix: restore TypeScript 6 compatibility with eslint stack @typescript-eslint currently requires typescript <6.1.0, so TypeScript 7 breaks npm ci in CI jobs. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 267dc9e4-4d46-424a-9f4e-6c2b2e6e2e57 --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-07-13 14:16:51 -04:00
John Jiang	2adeb10550	dist: Cover Tencent Kona JDK 25 (#1108) ... - Update Tencent Kona documentation to list JDK 25 as supported - Add Kona 25 to the e2e verification matrix (ubuntu, windows, macos) - Extend Kona test fixture with real Kona 25.0.3 release entries - Add unit tests covering Kona 25 selection across all platforms Signed-off-by: John Jiang <johnsjiang@tencent.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-07-13 14:08:24 -04:00
dependabot[bot]	23f8c419c6	chore(deps-dev): bump @types/node from 26.1.0 to 26.1.1 (#1104) ... Bumps [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) from 26.1.0 to 26.1.1. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) --- updated-dependencies: - dependency-name: "@types/node" dependency-version: 26.1.1 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-07-13 13:55:40 -04:00
dependabot[bot]	6f7d7a6eb1	chore(deps): bump actions/checkout from 6 to 7 (#1106) ... Bumps [actions/checkout](https://github.com/actions/checkout) from 6 to 7. - [Release notes](https://github.com/actions/checkout/releases) - [Changelog](https://github.com/actions/checkout/blob/main/CHANGELOG.md) - [Commits](https://github.com/actions/checkout/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/checkout dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-07-13 13:50:12 -04:00
dependabot[bot]	2301a55b6d	chore(deps-dev): bump prettier from 3.9.4 to 3.9.5 (#1105) ... Bumps [prettier](https://github.com/prettier/prettier) from 3.9.4 to 3.9.5. - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](https://github.com/prettier/prettier/compare/3.9.4...3.9.5) --- updated-dependencies: - dependency-name: prettier dependency-version: 3.9.5 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-07-13 13:43:44 -04:00
dependabot[bot]	2789aa9170	chore(deps-dev): bump eslint-plugin-n from 18.2.1 to 18.2.2 (#1103) ... Bumps [eslint-plugin-n](https://github.com/eslint-community/eslint-plugin-n) from 18.2.1 to 18.2.2. - [Release notes](https://github.com/eslint-community/eslint-plugin-n/releases) - [Changelog](https://github.com/eslint-community/eslint-plugin-n/blob/master/CHANGELOG.md) - [Commits](https://github.com/eslint-community/eslint-plugin-n/compare/v18.2.1...v18.2.2) --- updated-dependencies: - dependency-name: eslint-plugin-n dependency-version: 18.2.2 dependency-type: direct:development update-type: version-update:semver-patch ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-07-13 13:40:19 -04:00
dependabot[bot]	28fb8cb06b	chore(deps-dev): bump eslint from 10.6.0 to 10.7.0 (#1101) ... Bumps [eslint](https://github.com/eslint/eslint) from 10.6.0 to 10.7.0. - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](https://github.com/eslint/eslint/compare/v10.6.0...v10.7.0) --- updated-dependencies: - dependency-name: eslint dependency-version: 10.7.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-07-13 13:29:17 -04:00
Bruno Borges	174d4b5609	Support pinning java-version as "latest" (#1093) ... * Support pinning java-version as "latest" Add a `latest` alias for the `java-version` input that floats to the newest available stable (GA) release. It is normalized to the SemVer wildcard at the base-installer layer and always resolves from remote (like `check-latest: true`). List-based distributions resolve it automatically via the existing newest-first matching. Corretto selects its newest available major; Oracle and GraalVM look up the newest GA major via the Adoptium API and request it, failing with an actionable error if that major isn't published yet. The jdkfile distribution rejects `latest`. Closes #832 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Clarify latest note for oracle/graalvm version resolution vs download Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * graalvm-community: float latest to its own newest GA release GraalVM Community publishes its releases on GitHub, so the `latest` alias now matches against that real release list using the SemVer wildcard instead of asking the Adoptium API for the newest GA major. This prevents `latest` from hard-failing when GraalVM lags behind a freshly released Java major (e.g. Adoptium reports 26 before GraalVM ships it). Oracle GraalVM has no listing endpoint, so it keeps deriving the newest major from Adoptium and errors clearly if that major is not yet published. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Give latest+qualifier inputs (e.g. latest-ea) a targeted error Inputs like 'latest-ea' had their '-ea' suffix stripped and fell through to the generic SemVer validation, failing with a confusing "'latest' is not valid SemVer" message even though 'latest' is supported. Add an explicit guard so any 'latest*' value other than exactly 'latest' throws a targeted error explaining that 'latest' resolves GA releases only and cannot be combined with '-ea' or other qualifiers. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-07-09 20:11:03 -04:00
Bruno Borges	86ce8e6cc8	docs: clarify Maven cache paths and key hash inputs (#1096) ... Address post-merge review feedback on #1094: the intro paragraph described the cache too narrowly. setup-java caches both ~/.m2/repository and ~/.m2/wrapper/dists, and the default key hashes **/pom.xml plus .mvn/wrapper/maven-wrapper.properties and .mvn/extensions.xml, so changing wrapper/extensions files also invalidates the cache. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-07-09 17:14:05 -04:00
Bruno Borges	90be2728bc	docs: document seeding the Maven cache for plugin dependencies (#1094) ... * docs: document Maven cache seeding for plugin dependencies (#990) Explain that setup-java's maven cache only stores what a run downloads and is not re-saved on a hit, so plugin dependencies resolved lazily (e.g. by maven-shade-plugin) can be missing from the cache. Document a dependency resolution 'seed' step (dependency:go-offline + dependency:resolve-plugins) in README and a fuller advanced-usage section with a goal-comparison table, single-job and separate-seed-job examples, and caveats. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs: note gradle cache has the same limitation, point to setup-gradle (#990) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs: shorten README maven cache note, link to advanced docs (#990) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs: cover the parallel multi-job cache race in the seed-job example (#705) Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-07-09 16:03:22 -04:00
Bruno Borges	3157986b3f	Support multi-field Java versions like 18.0.1.1 (#1092) ... Java's version scheme (JEP 322) can contain more than the three numeric fields SemVer allows, e.g. 18.0.1.1 or 11.0.9.1. normalizeVersion() rejected these inputs. Convert exact multi-field versions to SemVer build notation (18.0.1.1 -> 18.0.1+1) before validation, reusing the existing convertVersionToSemver() helper. Ranges, EA tags, and inputs that already carry build metadata are left untouched. Fixes: #326 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-07-09 15:24:02 -04:00