609 Commits

This Branch

This Branch

All Branches

Author	SHA1	Message	Date
dependabot[bot]	7d5d4a7f19	chore(deps-dev): bump lint-staged from 17.2.0 to 17.3.0 (#1231) ... Bumps [lint-staged](https://github.com/lint-staged/lint-staged) from 17.2.0 to 17.3.0. - [Release notes](https://github.com/lint-staged/lint-staged/releases) - [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md) - [Commits](https://github.com/lint-staged/lint-staged/compare/v17.2.0...v17.3.0) --- updated-dependencies: - dependency-name: lint-staged dependency-version: 17.3.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-17 14:48:50 -04:00
dependabot[bot]	f974fff346	chore(deps-dev): bump @types/semver from 7.7.1 to 7.8.0 (#1229) ... Bumps [@types/semver](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/semver) from 7.7.1 to 7.8.0. - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/semver) --- updated-dependencies: - dependency-name: "@types/semver" dependency-version: 7.8.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-17 14:48:25 -04:00
dependabot[bot]	e96da06a44	chore(deps-dev): bump globals from 17.8.0 to 17.9.0 (#1233) ... Bumps [globals](https://github.com/sindresorhus/globals) from 17.8.0 to 17.9.0. - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](https://github.com/sindresorhus/globals/compare/v17.8.0...v17.9.0) --- updated-dependencies: - dependency-name: globals dependency-version: 17.9.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-08-17 14:47:55 -04:00
jmjaffe37	3487f54461	Update setup-java for Microsoft's Build of OpenJDK: now pointing task to CDN that is always up-to-date (#1236) ... * Updated microsoft openjdk setup-java action * Update generated distribution * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Applied new fixes from npm run check * Update generated distribution --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-08-14 01:10:57 -04:00
Copilot	d2bb5a81bf	Fix failing GitHub Actions job for graalvm 24-ea (#1227) ... * Initial plan * Normalize EA setup-java version output in verify-java.sh Co-authored-by: brunoborges <129743+brunoborges@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: brunoborges <129743+brunoborges@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-08-06 23:43:55 -04:00
Bruno Borges	a52a3de678	Fix js-yaml audit vulnerability (#1228) ... Upgrade the transitive js-yaml dependency to 3.15.1 to resolve GHSA-5p4m-2wfm-xmqj.\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-08-06 23:15:19 -04:00
Julien Dubois	d17a685945	Handle early dependency cache failures during Java setup (#1226) ... * Handle cache restore promise rejections Validate dependency cache providers before Java installation and settle cache restore failures immediately while preserving setup error precedence. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Make cache-rejection regression test deterministic Reject the cache restore only after it has started and while the Java installation is still pending, instead of relying on event-loop timing. Verified the test fails against the pre-fix implementation. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Validate cache input after required input checks Move the package-manager validation out of the top of run() so that missing java-version/java-version-file and toolchain id errors keep their original precedence. Validation now happens immediately before the cache restore is started, which still fails fast before any JDK download. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-08-06 23:04:13 -04:00
Julien Dubois	0b0c385478	Include gradle.properties in Gradle cache key (#1225) ... Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-08-06 23:00:23 -04:00
Julien Dubois	143564d5b9	Fix JetBrains GitHub token resolution (#1224) ... Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-08-06 11:46:13 -04:00
Julien Dubois	5580b78434	Fix SapMachine early-access filtering (#1217) ... * Fix SapMachine early-access filtering Ensure SapMachine EA requests exclude stable releases and cover string and boolean release metadata with competing fixture candidates.\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Update distribution bundle Regenerate the setup bundle for SapMachine release-class filtering.\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Format SapMachine regression tests Apply the repository Prettier format to the focused test additions.\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-08-05 12:59:08 -04:00
Bruno Borges	4fbd0bd19d	fix: select musl JDK artifacts on Alpine for five distributions (#1220) ... On Alpine, `getPlatformOption()` returned the glibc platform key for Dragonwell, Corretto, Zulu, Liberica and Liberica NIK, so the action resolved and installed a glibc JDK that cannot run under musl. Add a shared `isAlpineLinux()` helper and use it to select each vendor's musl artifacts: | distribution | glibc | musl | | ------------ | ------------- | -------------- | | Dragonwell | `linux` | `alpine-linux` | | Corretto | `linux` | `alpine` | | Zulu | `linux_glibc` | `linux_musl` | | Liberica | `linux` | `linux-musl` | | Liberica NIK | `linux` | `linux-musl` | Each key was verified against the vendor's live metadata API or manifest. There is deliberately no silent fallback to glibc when a vendor has no musl build for the requested version or architecture: the existing "could not find a version that satisfies" error fires instead. This matches the behaviour Temurin and SapMachine already have, and a glibc JDK would not run on musl anyway. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 74248bb0-72af-41d8-b85d-b0f5836e68db	2026-08-05 12:54:41 -04:00
Julien Dubois	d0e61fe743	Fix JDK resolution cache platform identity (#1210) ... * Fix JDK resolution cache platform identity Include the effective Linux libc platform in JDK resolution cache keys so Alpine/musl and glibc runners cannot restore each other's release metadata. Bump the cache namespace and share Alpine detection with affected distributors.\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>\nCopilot-Session: 4f95577c-567c-47a8-92f2-b4dced527866 * Update generated action bundles Regenerate setup and cleanup distributions for the platform-aware JDK resolution cache.\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>\nCopilot-Session: 4f95577c-567c-47a8-92f2-b4dced527866 * Cover the platform-identity fallback and Alpine short-circuit getJavaPlatformIdentity's `?? platform` fallback and the alias path for platforms other than linux/darwin/win32 had no coverage, and isAlpineLinux had no direct test at all. Verified by mutation: replacing the fallback with a constant, and dropping the `platform === 'linux'` short-circuit from isAlpineLinux, both left the existing suite fully green. The added cases fail on each. The short-circuit case matters beyond coverage bookkeeping: it is what keeps the /etc/alpine-release probe from running on non-Linux runners, so a stray file can never make Windows or macOS resolve as musl. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 74248bb0-72af-41d8-b85d-b0f5836e68db * Carry the platform identity into the floating resolution request Merging main brought in #1219, which added getFloatingResolutionRequest as a second construction site for JdkResolutionRequest. It predates the required `platform` field, so the merged tree did not compile. The floating request already carries `source`, which pins the artifact bytes, so this changes no lookup behaviour on its own -- it keeps the two request builders consistent and the tree building. Also refreshes dist/, which the textual merge left stale. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 74248bb0-72af-41d8-b85d-b0f5836e68db --------- Co-authored-by: Bruno Borges <brborges@microsoft.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 74248bb0-72af-41d8-b85d-b0f5836e68db	2026-08-05 12:45:11 -04:00
Julien Dubois	fb58a661f3	Fix JetBrains Runtime release pagination (#1218) ... * Fix JetBrains release pagination Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Update setup distribution Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-08-05 12:32:52 -04:00
Bruno Borges	2b61aea53d	Reuse the tool cache for floating versions the resolution cache identified (#1219) ... A floating Oracle JDK or Oracle GraalVM request now skips the tool-cache short-circuit entirely, so every job re-downloads and re-extracts the JDK even when the exact bytes the mutable URL currently serves are already installed locally. The JDK resolution cache is keyed on the artifact's checksum (or, failing that, its HTTP response fingerprint), so a hit proves which concrete version the URL is serving right now. Once it has vouched for that version, an existing tool-cache installation of exactly that version is the artifact the download would have produced, and can be reused. Reuse is therefore gated on the resolution cache hit, never on the requested major: an unidentified floating artifact still downloads, as does an explicit force-download. Co-authored-by: Bruno Borges <brunoborges@users.noreply.github.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: f2d9a891-a680-4b35-9644-cf2450f76f6d	2026-08-05 12:08:32 -04:00
Julien Dubois	634b0f0d18	Import Maven signing keys into an isolated GPG home (#1214) ... * Isolate Maven signing keys Import signing keys into an action-owned temporary GPG home, export GNUPGHOME, and remove the owned directory in the post action. Cover import failure, multiple keys and invocations, unrelated keyrings, missing state, and Windows path conversion. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Fix cleanup state assertion Account for isolated GPG-home cleanup when cache saving is disabled. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Update generated action bundles Apply repository formatting and commit the setup and cleanup bundles produced by the validated Node 24 build. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Address isolated GPG home review feedback Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-08-05 12:05:36 -04:00
Julien Dubois	f4bfb3ddea	Report concrete versions for floating Oracle JDK downloads (#1213) ... * Fix floating Oracle JDK version resolution Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Update generated distribution bundles Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Harden floating artifact cache identity Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Regenerate setup bundle after cache hardening Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Temporarily enable hosted full validation Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Export hosted formatting results Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Apply repository formatting Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Run hosted validation after formatting Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Correct floating version regression tests Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Remove temporary validation wiring Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Cache checksum-less floating artifacts by their response fingerprint Oracle and Oracle GraalVM do not always publish a `.sha256` sibling next to a `/latest/` artifact. Those floating releases were excluded from both the resolution cache and the JDK cache, so `cache-jdk` users lost caching entirely for them. A floating URL is a constant string, so it cannot serve as a cache identity on its own — a stale entry would be reused forever. Instead, derive a validator from the headers of the HEAD request that already resolves the artifact: the ETag when present, otherwise `Last-Modified` combined with `Content-Length`. Republishing changes the validator, which changes the cache key, so a new build is downloaded rather than masked. `getJdkReleaseIdentity` now falls back to that fingerprint before the URL, and the floating cache gates ask whether the release has a stable identity (checksum or fingerprint) rather than a checksum specifically. A floating release with neither is still left uncached. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-08-05 11:57:27 -04:00
Bruno Borges	ab597f914a	Cache resolved JDK releases to remove the vendor API from warm jobs (#1208) ... * Cache resolved JDK releases to remove the vendor API from warm jobs Only Temurin is preinstalled in the runner tool cache, so for every other distribution `findInToolcache()` misses on essentially every job. That forces a call to the distribution's metadata API before the JDK cache key can even be computed, which makes the vendor a hard per-job dependency even when the JDK bytes are already cached, and turns a vendor 403, 429, or outage into a job failure. Store the resolved release in a small companion cache entry keyed only on inputs known before any network call: runner OS, architecture, distribution, package type, requested version, and stability. A job that finds a current entry installs the JDK without contacting the metadata API at all. `@actions/cache` derives a cache version by hashing the requested paths, so save and restore paths must match. The entry therefore uses a path that excludes the date bucket while the key includes it, which lets restore keys fall back to an older bucket. An entry older than the current day is not used directly: the metadata API is still queried so floating requests such as `java-version: 21` keep picking up new releases, and the older entry is used only when that query fails. Because the entry also carries the download URL and checksum, that fallback works even when the JDK itself is not cached. Releases whose URL is not content-addressed are never stored. Oracle JDK and Oracle GraalVM build a `/latest/` URL for a major-only version, and its bytes change when a new build is published, so the URL and checksum are only consistent at the moment they are resolved. Mark those releases floating and skip recording them. Restored payloads are validated as untrusted input, and the post-job save rewrites the payload the key was computed for rather than uploading whatever is on disk, since a restore in a later step targets the same path. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: b76d8cb0-f629-46e1-bf9a-ffde06948644 * Widen the resolution freshness window from a day to a week A daily window gives no benefit to the repositories that need it most. A repository whose workflows run once a day would re-resolve on every job, and one running weekly would never see a current entry at all, yet those are exactly the repositories with nothing warm in the tool cache. Seven days is also the ceiling. GitHub removes cache entries that have not been accessed for seven days, so a longer window would leave the previous entry evicted by the time the window rolls over, removing the stale fallback at the moment it is most likely to be needed. It comfortably covers JDK release cadence, which is monthly at its fastest and usually quarterly. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: b76d8cb0-f629-46e1-bf9a-ffde06948644 * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Rebuild dist to match the linted source The pre-commit hook runs `eslint --fix` after `npm run check` has already built `dist/`, so the fix it applied to the resolution fallback warning in `base-installer.ts` never reached the bundle. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: b76d8cb0-f629-46e1-bf9a-ffde06948644 * Rebuild dist to match the linted source The autofix accepted on the pull request edited the resolution fallback warning in `base-installer.ts` through the GitHub UI, which does not run `npm run build`, so `dist/` still carried the pre-fix bundle. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: b76d8cb0-f629-46e1-bf9a-ffde06948644 --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Copilot-Session: b76d8cb0-f629-46e1-bf9a-ffde06948644	2026-08-04 23:58:03 -04:00
Bruno Borges	ef9440a2b8	docs: correct the mvn-toolchain-id default in README and action.yml (#1207) ... The generated toolchain ID is `${vendor}_${version}`, where vendor is the mvn-toolchain-vendor input falling back to distribution. Two places described this incorrectly. action.yml claimed the default was "${distribution}_${java-version}", which is wrong whenever mvn-toolchain-vendor is set, since overriding the vendor also changes the generated ID. The README used `${vendor}`, which is accurate but names something that is not an action input, leaving readers to guess where the value comes from. Both now name mvn-toolchain-vendor and state that it falls back to distribution. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 664777db-7250-417d-b94d-d5529ec3fec2	2026-08-04 23:29:25 -04:00
Bruno Borges	2dd851a56a	docs: cite reproducible JDK cache benchmark numbers (#1205) ... The JDK caching section quoted informal figures from the feature PR. The setup-java-benchmarks repository now has a JDK cache scenario workflow that reproduces the comparison end to end, so cite its numbers across two independent runs and name the workflow instead. Also record the cold-run cost, the flat build-step control, and the fact that the job-level median is noisier than the setup-step median, so the tradeoff is explicit rather than implying the speedup is free or precise. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 664777db-7250-417d-b94d-d5529ec3fec2	2026-08-04 23:28:41 -04:00
Bruno Borges	885218c5e4	Move the extracted JDK into the tool-cache and speed up extraction (#1206) ... Two wall-clock optimizations on the JDK install path. `tc.cacheDir` recursively copies the extracted tree into RUNNER_TOOL_CACHE, so a 200-600MB JDK is written to disk twice. The extraction directory and the tool-cache normally share a filesystem, so `cacheJdkDir` renames it instead and writes the `.complete` marker itself, mirroring the destination layout `tc.cacheDir` produces. It falls back to the copy when the tool-cache location is unknown, when the source is not a real directory (a symlinked source would otherwise leave a dangling entry once RUNNER_TEMP is cleaned), or when the rename fails - a cross-device tool-cache, or anti-virus holding a handle on Windows. The rename is atomic, so the source is still intact for the fallback. Extraction now uses `pigz` for tarballs when the runner provides it, and Windows zips go through the bundled `tar.exe` rather than `tc.extractZip`, which shells out to PowerShell's much slower `Expand-Archive`. Both fall back to the stock extraction and clean up the abandoned directory first. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: b76d8cb0-f629-46e1-bf9a-ffde06948644	2026-08-04 23:05:06 -04:00
Bruno Borges	2924169ccc	docs: correct README and advanced usage inconsistencies (#1204) ... - Fix stale claim that java-version and distribution are always mandatory - Fix security note that claimed no checksum/signature verification exists - Fix jdkfile toolchain example ID (jdkfile_1.6, not Oracle_1.6) - Clarify default toolchain ID derives from the vendor, not the distribution - Drop stale liberica-nik fallback claim; unsupported packages are rejected - Document IBM Semeru and add missing TOC/nav entries - Note that advanced-usage examples target the unreleased v6 on main - Replace retired ubuntu-20.04 runner and fix a heading level Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-08-04 22:08:10 -04:00
Bruno Borges	955f34f16f	Add conditional JDK caching (#1201) ... * Add JDK caching Cache resolved JDK tool-cache entries by exact platform and release identity, with a default-on cache-jdk input and explicit opt-out. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Apply batched suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Fix JDK cache CI validation Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Update brace-expansion security fix Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Refresh brace-expansion license metadata Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Refine JDK cache semantics Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Refine JDK cache documentation Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Simplify JDK cache identity Use one normalized runner OS dimension, reset the internal cache key schema for the unreleased feature, and align documentation, tests, and bundles. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Align JDK cache OS identity Use the established RUNNER_OS value directly and retain process.platform only as a non-Actions fallback. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Harden JDK cache saves and document tool-cache reuse Bind each JDK cache key to the installation identity it was computed for, keep post-job saves best-effort per entry, and state the real reuse and verification guarantee in the documentation. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs: restructure README caching section Rename '## Caching dependencies' to '## Caching' and add a what-gets-cached overview table covering the dependency, wrapper, and JDK caches. Lead with the common 'cache: maven' example and the dependency-cache material, and demote JDK caching into its own subsection. Also corrects the IMPORTANT callout, which implied JDK caching required an explicit opt-in; it is enabled implicitly whenever 'cache' is set. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs: fix caching documentation defects - Remove pull-request framing that compared behavior to `main`; state the tool-cache and `jdkfile` behavior directly and unconditionally. - Clarify that the JDK cache is a separate cache *entry* from the dependency and wrapper caches, while its *enablement* is coupled to `cache`, so the opening paragraph agrees with the enablement matrix. - Cite the actions/setup-java-benchmarks repository instead of an open PR and a self-referential PR comment, keeping the measured figures and caveats. - Keep the `cache`/`cache-jdk` matrix only in docs/advanced-usage.md and summarize the rules in prose in README.md to avoid divergence. - Describe the guarantee that a cache key is only saved with the installation it was computed for, instead of documenting inode/size/timestamp internals. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs: add V6 what's new entry for JDK caching Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: e2755464-4e83-47b6-ba71-731bb481b418 --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Copilot-Session: e2755464-4e83-47b6-ba71-731bb481b418	2026-08-04 21:54:10 -04:00
dependabot[bot]	7a9a8b1dcc	chore(deps): bump brace-expansion from 5.0.8 to 5.0.9 (#1202) ... * chore(deps): bump brace-expansion from 5.0.8 to 5.0.9 Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 5.0.8 to 5.0.9. - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](https://github.com/juliangruber/brace-expansion/compare/v5.0.8...v5.0.9) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 5.0.9 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * chore: rebuild distribution Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * chore: refresh dependency metadata Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-08-04 21:15:15 -04:00
Bruno Borges	f48de5f4c7	Highlight major changes in setup-java v6 (#1203) ... * docs: highlight major v6 changes Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs: separate JDK download highlights Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs: clarify v6 distribution highlights Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-08-04 19:57:24 -04:00
Bruno Borges	881ee1636f	docs: highlight major v5 changes (#1200) ... Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8e3b1604-55ad-4a37-91dd-65e424e71ba7	2026-08-04 18:53:31 -04:00
Bruno Borges	60b1ab8234	Update setup-java README action from v6 to v5 (#1199)	2026-08-04 17:06:55 -04:00
Bruno Borges	dd7dc10522	Document deprecation of legacy action versions (#1198) ... Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 62a37470-ba42-40e1-8fb4-f644cf05da02	2026-08-04 14:06:02 -04:00
Bruno Borges	7c6f629e2f	Reimagine setup-java README (#1192) ... * Implement new feature for user authentication and improve error handling * Clarify README review feedback Clarify distribution case sensitivity, GHES token defaults, and cache key placeholder notation in the README. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: f0ff1923-c6ca-472e-83b2-3a813ec6d781 * Update README to clarify V6 development status and enhance contributions section * Update README to recommend permissions for setup-java action in GitHub Actions * Restore README usage heading Rename the quick-start section to the conventional Usage heading used by setup actions. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: f0ff1923-c6ca-472e-83b2-3a813ec6d781 --------- Copilot-Session: f0ff1923-c6ca-472e-83b2-3a813ec6d781	2026-08-03 13:40:46 -04:00
dependabot[bot]	d72315472c	chore(deps): bump actions/upload-artifact from 6 to 7 (#1190) ... Bumps [actions/upload-artifact](https://github.com/actions/upload-artifact) from 6 to 7. - [Release notes](https://github.com/actions/upload-artifact/releases) - [Commits](https://github.com/actions/upload-artifact/compare/v6...v7) --- updated-dependencies: - dependency-name: actions/upload-artifact dependency-version: '7' dependency-type: direct:production update-type: version-update:semver-major ... Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>	2026-08-03 10:43:11 -04:00
Copilot	536de9e5ba	Remove legacy Adopt distributions in v6 (#1185) ... * Initial plan * Remove legacy Adopt distributions Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-07-31 15:48:18 -04:00
Bruno Borges	9a8c300417	Fix macOS e2e workflow assertions (#1184) ... Normalize ARM64 runner architecture when checking exported JAVA_HOME variables and skip the unsupported adopt-openj9 macOS arm64 version-file matrix entry. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: e78541cb-82b7-4fc2-8ffc-b1e5799efbce	2026-07-30 15:57:15 -04:00
Bruno Borges	5827477733	Optimize Maven configuration warm path (#1182) ... * Optimize Maven configuration warm path Avoid eager Maven XML initialization on warm JDK runs by using deterministic serializers for new Maven settings/toolchains files, lazy-loading xmlbuilder2 for existing toolchains merges, and deferring Maven configuration modules until after Java setup. Add targeted tests for XML escaping, lazy xmlbuilder2 loading, concurrent Maven configuration, and a manual benchmark workflow for warm-path validation. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4dc58426-5e20-44cb-af16-8da0965fac3b * Address Maven optimization PR feedback Make the toolchain XML generator consistently async, remove redundant Maven configuration await handling, and reuse the existing XML test helper. Configure CodeQL to skip generated dist output so newly split vendored chunks do not report duplicate generated-code alerts. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4dc58426-5e20-44cb-af16-8da0965fac3b * Apply rubber duck review suggestions Document XML attribute escaping, simplify Maven configuration awaiting, and add a regression test that feeds fast-path toolchains output into the merge path. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4dc58426-5e20-44cb-af16-8da0965fac3b * Delete .github/codeql/codeql-config.yml * Update codeql-analysis.yml * Replace xmlbuilder2 in Maven toolchain merge Use fast-xml-parser for existing toolchains.xml parsing and serialize merged Maven toolchains deterministically. This removes the bundled xmlbuilder2 DOM/XML builder chunk from dist while preserving merge behavior for custom attributes, custom toolchains, partial entries, duplicate filtering, and escaping. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4dc58426-5e20-44cb-af16-8da0965fac3b * Move Maven benchmark out of setup-java Remove the Maven warm-path benchmark workflow and helper script from setup-java. Benchmark coverage is being moved to actions/setup-java-benchmarks so this action repository only carries the runtime optimization, tests, and generated distribution artifacts. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4dc58426-5e20-44cb-af16-8da0965fac3b --------- Copilot-Session: 4dc58426-5e20-44cb-af16-8da0965fac3b	2026-07-30 15:09:35 -04:00
Bruno Borges	3cc3643700	Optimize Temurin tool-cache fast path with lazy loading (#1179) ... * Optimize Temurin tool-cache fast path - Lazy-load distribution installers so only the selected distro module is initialized - Defer cache feature/cache module loading until cache input is provided - Start cache restore early and await it safely alongside Java setup flow - Update orchestration and lazy-loading tests; regenerate dist artifacts Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: cc2c0256-c55e-4a35-a584-5bed7e8b11ad * Address PR review comments - Lazy-load cache save in cleanup path so no-cache runs avoid cache module init in post action - Stage dist/setup/package.json in release script for chunked setup bundle completeness Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: cc2c0256-c55e-4a35-a584-5bed7e8b11ad * Fix CodeQL comment tag filter finding Patch is-unsafe's XML comment-close detector during builds so generated bundles recognize both HTML comment end forms and satisfy CodeQL until the dependency publishes a fix. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 277302b1-aa95-4012-817b-9752cdaee14e * Rebuild generated dist bundles Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: cc2c0256-c55e-4a35-a584-5bed7e8b11ad --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: cc2c0256-c55e-4a35-a584-5bed7e8b11ad Copilot-Session: 277302b1-aa95-4012-817b-9752cdaee14e	2026-07-29 17:53:33 -04:00
Bruno Borges	6937f5eb31	Centralize OS/architecture capability validation (#1178) ... * Centralize platform capability validation Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 10e35b75-928f-4ef7-984e-605895c5d88e * Address PR review feedback Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 10e35b75-928f-4ef7-984e-605895c5d88e * Regenerate dist after platform validation updates Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 10e35b75-928f-4ef7-984e-605895c5d88e	2026-07-29 15:46:29 -04:00
Bruno Borges	0b56831a10	Add dependency cache path overrides (#1175) ... * Add dependency cache path overrides Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dd650d36-9c97-4ca4-9ec8-39b37f99a07c * Clarify supported dependency cache managers Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dd650d36-9c97-4ca4-9ec8-39b37f99a07c * Fix custom cache path CI checks Align the custom cache save and restore key inputs and use the workflow hash to avoid a previously populated cache entry. Rebuild the distribution bundles. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dd650d36-9c97-4ca4-9ec8-39b37f99a07c --------- Copilot-Session: dd650d36-9c97-4ca4-9ec8-39b37f99a07c	2026-07-29 14:43:55 -04:00
Bruno Borges	9f43141311	Restore dependency and wrapper caches concurrently (#1174) ... * Restore dependency and wrapper caches concurrently Run primary dependency and wrapper cache restores in parallel while preserving existing outputs and save semantics. Add unit and E2E coverage for concurrent restore behavior, wrapper cache validation, and additional-cache error handling. Include a manual benchmark workflow for baseline-vs-candidate restore timing comparisons across OSes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d43ec3dd-96c7-4eb3-909e-b8123cd12d3c * Address PR review comments Use env variables for cache-hit values in benchmark record steps to avoid expression expansion in run commands, and rename E2E restore step labels for clarity. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d43ec3dd-96c7-4eb3-909e-b8123cd12d3c * Stabilize wrapper cache restore checks Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d43ec3dd-96c7-4eb3-909e-b8123cd12d3c	2026-07-29 13:41:24 -04:00
Bruno Borges	ec4dbbe20d	Test Temurin 25 on hosted runners (#1172) ... * Test Temurin 25 on hosted runners Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9def8ac6-e148-4a8e-bb50-a3ee1948fc52 * Recommend Temurin for hosted runners Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9def8ac6-e148-4a8e-bb50-a3ee1948fc52 * Clarify hosted Temurin guidance Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9def8ac6-e148-4a8e-bb50-a3ee1948fc52 * Test downloaded Microsoft JDKs Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 9def8ac6-e148-4a8e-bb50-a3ee1948fc52 --------- Copilot-Session: 9def8ac6-e148-4a8e-bb50-a3ee1948fc52	2026-07-29 10:41:44 -04:00
Bruno Borges	62f345fa33	Add read-only dependency cache mode (#1169) ... Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: b3f6f152-8ac4-4c29-b04a-acac8e100777	2026-07-29 10:20:14 -04:00
Bruno Borges	bcd3ba3d32	Reduce change-time Java E2E matrix (#1170) ... Run a representative smoke matrix on pull requests and main while reserving the exhaustive compatibility matrix for scheduled, manual, and release-branch runs. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 235c81b4-58ae-494e-9907-e19c841c6a53	2026-07-29 10:17:23 -04:00
Bruno Borges	27f2c62824	Verify JDK downloads with vendor checksums (#1167) ... * Verify JDK downloads with vendor checksums Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d * Handle missing vendor checksum values Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d * Preserve checksum error during cleanup failure Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d * Validate checksum metadata value types Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d * Clarify checksum documentation Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d * Expand vendor checksum verification Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d * Accept SHA-256 or SHA-512 for JetBrains checksum sibling JetBrains publishes a single, generically-named ".checksum" sibling whose digest algorithm isn't disclosed by the filename. Older JBR 11 builds (e.g. jbrsdk_nomod-11_0_16-*-b2043.64.tar.gz) publish a SHA-256 digest there, while newer builds publish SHA-512. The JetBrains installer previously assumed SHA-512 unconditionally, so verification failed with "Malformed sha512 checksum metadata ... expected a 128-character hexadecimal digest" for those older builds, breaking the jetbrains 11 e2e job on macOS and Windows. fetchChecksum now accepts a list of candidate algorithms and infers the actual algorithm from the returned digest's length, preferring the strongest match. The JetBrains installer passes ['sha512', 'sha256']; all other callers are unaffected since they already pass a single, vendor-disclosed algorithm. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d * Use SapMachine archive checksum files Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a800a031-600e-4d28-b23e-be309555d38d	2026-07-29 04:43:56 -04:00
Bruno Borges	19c23b379e	Harden java-package validation (#1165) ... Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 10b8fe1e-18f4-42cb-8672-11215715a713	2026-07-29 00:50:01 -04:00
Bruno Borges	6e26972896	Add setup orchestration tests (#1163) ... Make the setup entrypoint import-safe and cover its validation, installation sequencing, post-install collaborators, caching, and failure handling directly. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a5ba8975-a9ac-4d2c-b41d-97c99689d1bd	2026-07-29 00:36:12 -04:00
Bruno Borges	5894ef6b27	Consolidate JDK metadata retry handling (#1162) ... * Consolidate JDK metadata retries Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a5e2549a-0d89-4c8f-b7f3-411ad21c8a06 * Expand distribution retry coverage Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a5e2549a-0d89-4c8f-b7f3-411ad21c8a06 --------- Copilot-Session: a5e2549a-0d89-4c8f-b7f3-411ad21c8a06	2026-07-29 00:09:37 -04:00
Bruno Borges	e1ce3a3428	Fail on mismatched Maven toolchain ID counts (#1161) ... * Fail on mismatched Maven toolchain IDs Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8c821981-7b21-45fe-9463-5bb375d7dce4 * Clarify Maven toolchain ID version counts Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8c821981-7b21-45fe-9463-5bb375d7dce4 --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 8c821981-7b21-45fe-9463-5bb375d7dce4	2026-07-28 23:33:41 -04:00
Bruno Borges	ce75feb3d3	Reject invalid boolean input values (#1160) ... Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: c6daa6b5-31f5-46b2-a994-b8320b50a50d	2026-07-28 22:43:39 -04:00
Bruno Borges	382d4b753d	Fix caching when wrapper distributions are absent (#1151) ... * Fix missing wrapper cache distributions Skip optional Maven and Gradle wrapper cache saves when their distribution paths do not exist, while allowing the main dependency cache to save. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a43181c5-548d-4293-be58-b76c03cece79 * Use resolved paths for wrapper cache saves Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a43181c5-548d-4293-be58-b76c03cece79 * Rebuild action distributions Regenerate the setup and cleanup bundles after updating additional cache saves to use resolved paths. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a43181c5-548d-4293-be58-b76c03cece79 --------- Copilot-Session: a43181c5-548d-4293-be58-b76c03cece79	2026-07-28 19:14:06 -04:00
Bruno Borges	24d1ce4c2b	Document Java package compatibility (#1152) ... Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: de5ff500-7ba1-4b07-9805-cfc4036d6155	2026-07-28 18:47:14 -04:00
Copilot	1c3b3d28f0	Support Temurin JDKs with JMOD files (#1149) ... * Initial plan * Add Temurin JMOD installation support * Rebuild action bundles * Use java-package for Temurin JMODs Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: e7d8c581-2d14-4ccc-aeca-afc0f3b0c2bc * Fix Temurin JMOD test paths on Windows Use platform-aware path construction for the JMOD copy and cache assertions so the Windows test expects backslash-normalized paths. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: e7d8c581-2d14-4ccc-aeca-afc0f3b0c2bc	2026-07-28 18:39:15 -04:00
Copilot	0b0bd25927	Add OpenJDK distribution (#1147) ... * Initial plan * Add OpenJDK distribution * Support archived OpenJDK release formats * Handle legacy OpenJDK URL layout * Resolve legacy OpenJDK build metadata * Rename OpenJDK distribution to oracle-openjdk Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2c93ae0c-bbf5-40f5-bf6e-40168d0e267f * Make OpenJDK tests platform independent Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2c93ae0c-bbf5-40f5-bf6e-40168d0e267f * Document Oracle OpenJDK early access builds Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2c93ae0c-bbf5-40f5-bf6e-40168d0e267f * Clarify Oracle OpenJDK security note Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 2c93ae0c-bbf5-40f5-bf6e-40168d0e267f --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com> Copilot-Session: 2c93ae0c-bbf5-40f5-bf6e-40168d0e267f	2026-07-28 15:55:33 -04:00
Copilot	089b010dc8	Add force-download option for reproducible JDK builds (#1148) ... * Initial plan * Add force-download input * Build force-download action bundles --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-07-28 14:43:47 -04:00