128 Commits

Author	SHA1	Message	Date
Bruno Borges	a42a52cfb5	Add multiple Maven server credentials (#1239) ... Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-08-17 17:05:55 -04:00
jmjaffe37	3487f54461	Update setup-java for Microsoft's Build of OpenJDK: now pointing task to CDN that is always up-to-date (#1236) ... * Updated microsoft openjdk setup-java action * Update generated distribution * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Applied new fixes from npm run check * Update generated distribution --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-08-14 01:10:57 -04:00
Julien Dubois	d17a685945	Handle early dependency cache failures during Java setup (#1226) ... * Handle cache restore promise rejections Validate dependency cache providers before Java installation and settle cache restore failures immediately while preserving setup error precedence. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Make cache-rejection regression test deterministic Reject the cache restore only after it has started and while the Java installation is still pending, instead of relying on event-loop timing. Verified the test fails against the pre-fix implementation. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Validate cache input after required input checks Move the package-manager validation out of the top of run() so that missing java-version/java-version-file and toolchain id errors keep their original precedence. Validation now happens immediately before the cache restore is started, which still fails fast before any JDK download. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-08-06 23:04:13 -04:00
Julien Dubois	0b0c385478	Include gradle.properties in Gradle cache key (#1225) ... Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-08-06 23:00:23 -04:00
Julien Dubois	143564d5b9	Fix JetBrains GitHub token resolution (#1224) ... Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-08-06 11:46:13 -04:00
Julien Dubois	d0e61fe743	Fix JDK resolution cache platform identity (#1210) ... * Fix JDK resolution cache platform identity Include the effective Linux libc platform in JDK resolution cache keys so Alpine/musl and glibc runners cannot restore each other's release metadata. Bump the cache namespace and share Alpine detection with affected distributors.\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>\nCopilot-Session: 4f95577c-567c-47a8-92f2-b4dced527866 * Update generated action bundles Regenerate setup and cleanup distributions for the platform-aware JDK resolution cache.\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>\nCopilot-Session: 4f95577c-567c-47a8-92f2-b4dced527866 * Cover the platform-identity fallback and Alpine short-circuit getJavaPlatformIdentity's `?? platform` fallback and the alias path for platforms other than linux/darwin/win32 had no coverage, and isAlpineLinux had no direct test at all. Verified by mutation: replacing the fallback with a constant, and dropping the `platform === 'linux'` short-circuit from isAlpineLinux, both left the existing suite fully green. The added cases fail on each. The short-circuit case matters beyond coverage bookkeeping: it is what keeps the /etc/alpine-release probe from running on non-Linux runners, so a stray file can never make Windows or macOS resolve as musl. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 74248bb0-72af-41d8-b85d-b0f5836e68db * Carry the platform identity into the floating resolution request Merging main brought in #1219, which added getFloatingResolutionRequest as a second construction site for JdkResolutionRequest. It predates the required `platform` field, so the merged tree did not compile. The floating request already carries `source`, which pins the artifact bytes, so this changes no lookup behaviour on its own -- it keeps the two request builders consistent and the tree building. Also refreshes dist/, which the textual merge left stale. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 74248bb0-72af-41d8-b85d-b0f5836e68db --------- Co-authored-by: Bruno Borges <brborges@microsoft.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 74248bb0-72af-41d8-b85d-b0f5836e68db	2026-08-05 12:45:11 -04:00
Julien Dubois	634b0f0d18	Import Maven signing keys into an isolated GPG home (#1214) ... * Isolate Maven signing keys Import signing keys into an action-owned temporary GPG home, export GNUPGHOME, and remove the owned directory in the post action. Cover import failure, multiple keys and invocations, unrelated keyrings, missing state, and Windows path conversion. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Fix cleanup state assertion Account for isolated GPG-home cleanup when cache saving is disabled. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Update generated action bundles Apply repository formatting and commit the setup and cleanup bundles produced by the validated Node 24 build. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Address isolated GPG home review feedback Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-08-05 12:05:36 -04:00
Julien Dubois	f4bfb3ddea	Report concrete versions for floating Oracle JDK downloads (#1213) ... * Fix floating Oracle JDK version resolution Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Update generated distribution bundles Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Harden floating artifact cache identity Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Regenerate setup bundle after cache hardening Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Temporarily enable hosted full validation Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Export hosted formatting results Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Apply repository formatting Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Run hosted validation after formatting Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Correct floating version regression tests Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Remove temporary validation wiring Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Cache checksum-less floating artifacts by their response fingerprint Oracle and Oracle GraalVM do not always publish a `.sha256` sibling next to a `/latest/` artifact. Those floating releases were excluded from both the resolution cache and the JDK cache, so `cache-jdk` users lost caching entirely for them. A floating URL is a constant string, so it cannot serve as a cache identity on its own — a stale entry would be reused forever. Instead, derive a validator from the headers of the HEAD request that already resolves the artifact: the ETag when present, otherwise `Last-Modified` combined with `Content-Length`. Republishing changes the validator, which changes the cache key, so a new build is downloaded rather than masked. `getJdkReleaseIdentity` now falls back to that fingerprint before the URL, and the floating cache gates ask whether the release has a stable identity (checksum or fingerprint) rather than a checksum specifically. A floating release with neither is still left uncached. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-08-05 11:57:27 -04:00
Bruno Borges	ab597f914a	Cache resolved JDK releases to remove the vendor API from warm jobs (#1208) ... * Cache resolved JDK releases to remove the vendor API from warm jobs Only Temurin is preinstalled in the runner tool cache, so for every other distribution `findInToolcache()` misses on essentially every job. That forces a call to the distribution's metadata API before the JDK cache key can even be computed, which makes the vendor a hard per-job dependency even when the JDK bytes are already cached, and turns a vendor 403, 429, or outage into a job failure. Store the resolved release in a small companion cache entry keyed only on inputs known before any network call: runner OS, architecture, distribution, package type, requested version, and stability. A job that finds a current entry installs the JDK without contacting the metadata API at all. `@actions/cache` derives a cache version by hashing the requested paths, so save and restore paths must match. The entry therefore uses a path that excludes the date bucket while the key includes it, which lets restore keys fall back to an older bucket. An entry older than the current day is not used directly: the metadata API is still queried so floating requests such as `java-version: 21` keep picking up new releases, and the older entry is used only when that query fails. Because the entry also carries the download URL and checksum, that fallback works even when the JDK itself is not cached. Releases whose URL is not content-addressed are never stored. Oracle JDK and Oracle GraalVM build a `/latest/` URL for a major-only version, and its bytes change when a new build is published, so the URL and checksum are only consistent at the moment they are resolved. Mark those releases floating and skip recording them. Restored payloads are validated as untrusted input, and the post-job save rewrites the payload the key was computed for rather than uploading whatever is on disk, since a restore in a later step targets the same path. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: b76d8cb0-f629-46e1-bf9a-ffde06948644 * Widen the resolution freshness window from a day to a week A daily window gives no benefit to the repositories that need it most. A repository whose workflows run once a day would re-resolve on every job, and one running weekly would never see a current entry at all, yet those are exactly the repositories with nothing warm in the tool cache. Seven days is also the ceiling. GitHub removes cache entries that have not been accessed for seven days, so a longer window would leave the previous entry evicted by the time the window rolls over, removing the stale fallback at the moment it is most likely to be needed. It comfortably covers JDK release cadence, which is monthly at its fastest and usually quarterly. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: b76d8cb0-f629-46e1-bf9a-ffde06948644 * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Rebuild dist to match the linted source The pre-commit hook runs `eslint --fix` after `npm run check` has already built `dist/`, so the fix it applied to the resolution fallback warning in `base-installer.ts` never reached the bundle. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: b76d8cb0-f629-46e1-bf9a-ffde06948644 * Rebuild dist to match the linted source The autofix accepted on the pull request edited the resolution fallback warning in `base-installer.ts` through the GitHub UI, which does not run `npm run build`, so `dist/` still carried the pre-fix bundle. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: b76d8cb0-f629-46e1-bf9a-ffde06948644 --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Copilot-Session: b76d8cb0-f629-46e1-bf9a-ffde06948644	2026-08-04 23:58:03 -04:00
Bruno Borges	885218c5e4	Move the extracted JDK into the tool-cache and speed up extraction (#1206) ... Two wall-clock optimizations on the JDK install path. `tc.cacheDir` recursively copies the extracted tree into RUNNER_TOOL_CACHE, so a 200-600MB JDK is written to disk twice. The extraction directory and the tool-cache normally share a filesystem, so `cacheJdkDir` renames it instead and writes the `.complete` marker itself, mirroring the destination layout `tc.cacheDir` produces. It falls back to the copy when the tool-cache location is unknown, when the source is not a real directory (a symlinked source would otherwise leave a dangling entry once RUNNER_TEMP is cleaned), or when the rename fails - a cross-device tool-cache, or anti-virus holding a handle on Windows. The rename is atomic, so the source is still intact for the fallback. Extraction now uses `pigz` for tarballs when the runner provides it, and Windows zips go through the bundled `tar.exe` rather than `tc.extractZip`, which shells out to PowerShell's much slower `Expand-Archive`. Both fall back to the stock extraction and clean up the abandoned directory first. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: b76d8cb0-f629-46e1-bf9a-ffde06948644	2026-08-04 23:05:06 -04:00
Bruno Borges	955f34f16f	Add conditional JDK caching (#1201) ... * Add JDK caching Cache resolved JDK tool-cache entries by exact platform and release identity, with a default-on cache-jdk input and explicit opt-out. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Apply batched suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Fix JDK cache CI validation Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Update brace-expansion security fix Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Refresh brace-expansion license metadata Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Refine JDK cache semantics Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Refine JDK cache documentation Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Simplify JDK cache identity Use one normalized runner OS dimension, reset the internal cache key schema for the unreleased feature, and align documentation, tests, and bundles. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Align JDK cache OS identity Use the established RUNNER_OS value directly and retain process.platform only as a non-Actions fallback. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Harden JDK cache saves and document tool-cache reuse Bind each JDK cache key to the installation identity it was computed for, keep post-job saves best-effort per entry, and state the real reuse and verification guarantee in the documentation. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs: restructure README caching section Rename '## Caching dependencies' to '## Caching' and add a what-gets-cached overview table covering the dependency, wrapper, and JDK caches. Lead with the common 'cache: maven' example and the dependency-cache material, and demote JDK caching into its own subsection. Also corrects the IMPORTANT callout, which implied JDK caching required an explicit opt-in; it is enabled implicitly whenever 'cache' is set. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs: fix caching documentation defects - Remove pull-request framing that compared behavior to `main`; state the tool-cache and `jdkfile` behavior directly and unconditionally. - Clarify that the JDK cache is a separate cache *entry* from the dependency and wrapper caches, while its *enablement* is coupled to `cache`, so the opening paragraph agrees with the enablement matrix. - Cite the actions/setup-java-benchmarks repository instead of an open PR and a self-referential PR comment, keeping the measured figures and caveats. - Keep the `cache`/`cache-jdk` matrix only in docs/advanced-usage.md and summarize the rules in prose in README.md to avoid divergence. - Describe the guarantee that a cache key is only saved with the installation it was computed for, instead of documenting inode/size/timestamp internals. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs: add V6 what's new entry for JDK caching Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: e2755464-4e83-47b6-ba71-731bb481b418 --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Copilot-Session: e2755464-4e83-47b6-ba71-731bb481b418	2026-08-04 21:54:10 -04:00
dependabot[bot]	7a9a8b1dcc	chore(deps): bump brace-expansion from 5.0.8 to 5.0.9 (#1202) ... * chore(deps): bump brace-expansion from 5.0.8 to 5.0.9 Bumps [brace-expansion](https://github.com/juliangruber/brace-expansion) from 5.0.8 to 5.0.9. - [Release notes](https://github.com/juliangruber/brace-expansion/releases) - [Commits](https://github.com/juliangruber/brace-expansion/compare/v5.0.8...v5.0.9) --- updated-dependencies: - dependency-name: brace-expansion dependency-version: 5.0.9 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * chore: rebuild distribution Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * chore: refresh dependency metadata Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-08-04 21:15:15 -04:00
Bruno Borges	3cc3643700	Optimize Temurin tool-cache fast path with lazy loading (#1179) ... * Optimize Temurin tool-cache fast path - Lazy-load distribution installers so only the selected distro module is initialized - Defer cache feature/cache module loading until cache input is provided - Start cache restore early and await it safely alongside Java setup flow - Update orchestration and lazy-loading tests; regenerate dist artifacts Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: cc2c0256-c55e-4a35-a584-5bed7e8b11ad * Address PR review comments - Lazy-load cache save in cleanup path so no-cache runs avoid cache module init in post action - Stage dist/setup/package.json in release script for chunked setup bundle completeness Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: cc2c0256-c55e-4a35-a584-5bed7e8b11ad * Fix CodeQL comment tag filter finding Patch is-unsafe's XML comment-close detector during builds so generated bundles recognize both HTML comment end forms and satisfy CodeQL until the dependency publishes a fix. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 277302b1-aa95-4012-817b-9752cdaee14e * Rebuild generated dist bundles Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: cc2c0256-c55e-4a35-a584-5bed7e8b11ad --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: cc2c0256-c55e-4a35-a584-5bed7e8b11ad Copilot-Session: 277302b1-aa95-4012-817b-9752cdaee14e	2026-07-29 17:53:33 -04:00
Bruno Borges	0b56831a10	Add dependency cache path overrides (#1175) ... * Add dependency cache path overrides Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dd650d36-9c97-4ca4-9ec8-39b37f99a07c * Clarify supported dependency cache managers Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dd650d36-9c97-4ca4-9ec8-39b37f99a07c * Fix custom cache path CI checks Align the custom cache save and restore key inputs and use the workflow hash to avoid a previously populated cache entry. Rebuild the distribution bundles. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: dd650d36-9c97-4ca4-9ec8-39b37f99a07c --------- Copilot-Session: dd650d36-9c97-4ca4-9ec8-39b37f99a07c	2026-07-29 14:43:55 -04:00
Bruno Borges	9f43141311	Restore dependency and wrapper caches concurrently (#1174) ... * Restore dependency and wrapper caches concurrently Run primary dependency and wrapper cache restores in parallel while preserving existing outputs and save semantics. Add unit and E2E coverage for concurrent restore behavior, wrapper cache validation, and additional-cache error handling. Include a manual benchmark workflow for baseline-vs-candidate restore timing comparisons across OSes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d43ec3dd-96c7-4eb3-909e-b8123cd12d3c * Address PR review comments Use env variables for cache-hit values in benchmark record steps to avoid expression expansion in run commands, and rename E2E restore step labels for clarity. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: d43ec3dd-96c7-4eb3-909e-b8123cd12d3c * Stabilize wrapper cache restore checks Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Copilot-Session: d43ec3dd-96c7-4eb3-909e-b8123cd12d3c	2026-07-29 13:41:24 -04:00
Bruno Borges	62f345fa33	Add read-only dependency cache mode (#1169) ... Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: b3f6f152-8ac4-4c29-b04a-acac8e100777	2026-07-29 10:20:14 -04:00
Bruno Borges	ce75feb3d3	Reject invalid boolean input values (#1160) ... Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: c6daa6b5-31f5-46b2-a994-b8320b50a50d	2026-07-28 22:43:39 -04:00
Bruno Borges	382d4b753d	Fix caching when wrapper distributions are absent (#1151) ... * Fix missing wrapper cache distributions Skip optional Maven and Gradle wrapper cache saves when their distribution paths do not exist, while allowing the main dependency cache to save. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a43181c5-548d-4293-be58-b76c03cece79 * Use resolved paths for wrapper cache saves Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a43181c5-548d-4293-be58-b76c03cece79 * Rebuild action distributions Regenerate the setup and cleanup bundles after updating additional cache saves to use resolved paths. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: a43181c5-548d-4293-be58-b76c03cece79 --------- Copilot-Session: a43181c5-548d-4293-be58-b76c03cece79	2026-07-28 19:14:06 -04:00
Copilot	089b010dc8	Add force-download option for reproducible JDK builds (#1148) ... * Initial plan * Add force-download input * Build force-download action bundles --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-07-28 14:43:47 -04:00
Copilot	69304e5bab	Remediate npm audit findings and rebuild distributions (#1145) ... * Pin patched brace-expansion release * Rebuild action bundles * Refresh licensed npm cache records * Restore compatible brace expansion versions * Restore transitive dependency license records * Fix brace-expansion GHSA-mh99-v99m-4gvg vulnerability via npm overrides * Update licensed dependency records to fix CI license check --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>	2026-07-27 21:57:35 -04:00
Markus Hoffrogge	c59dceb0cd	chore(deps): fix npm audited vulnerabilities (#1140)	2026-07-27 14:34:04 -04:00
Bruno Borges	c3d7ccbf81	Clarify credential environment variable inputs (#1134) ... * Clarify credential environment variable inputs Rename credential-related inputs to make their environment-variable semantics explicit while preserving deprecated aliases with migration warnings. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 70a3daa8-dbc9-4eb0-a57b-df198a459315 * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-07-17 20:10:58 -04:00
Bruno Borges	e40a8e0642	Add an option to disable Java problem matchers (#1133) ... * Add problem matcher opt-out Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 38eb7886-7ea3-4e4d-8d5f-e3f975135053 * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-07-16 11:28:10 -04:00
Philip Gai	6e2e32e729	chore(deps): bump @actions/cache to 6.2.0 (#1128) ... * chore(deps): bump @actions/cache to 6.2.0 Bump @actions/cache from ^6.1.0 to ^6.2.0 and rebuild the vendored dist/ bundles. 6.2.0 honors ACTIONS_CACHE_MODE to skip restore/save when the effective cache-mode disallows it, and surfaces a core.warning (instead of failing the run) when the cache service denies a read/write due to token scopes. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0046a2b8-0238-4ac6-93f6-70c4e60b5630 * chore: update licensed record for @actions/cache 6.2.0 Refresh the cached licensed dependency record so the version matches the bumped @actions/cache 6.2.0. License text, summary, and homepage are unchanged; only the version field was stale, which failed the "Check licenses" CI job. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 0046a2b8-0238-4ac6-93f6-70c4e60b5630 --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-07-15 17:16:17 -04:00
Bruno Borges	7d485884af	Use gpg.passphraseEnvName instead of the deprecated gpg.passphrase server (#1123) ... * Use gpg.passphraseEnvName instead of gpg.passphrase server The maven-gpg-plugin's `gpg.passphrase`/`passphraseServerId` mechanism is deprecated and fails when the plugin's `bestPractices` mode is enabled. Stop writing the `gpg.passphrase` server to settings.xml and instead set `gpg.passphraseEnvName` via an active profile when the configured passphrase env var name differs from the plugin default (MAVEN_GPG_PASSPHRASE). The default `gpg-passphrase` input value (GPG_PASSPHRASE) is unchanged, so the plugin reads the same environment variable as before. Fixes #760 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Fix settings.xml publishing validation Update the publishing e2e check to assert the settings.xml generated when gpg-passphrase is MAVEN_GPG_PASSPHRASE. In that default case the action no longer writes a gpg.passphrase server entry. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7d0a510e-aebf-4ec4-a667-efeb3e4edeb1 * Default gpg-passphrase to MAVEN_GPG_PASSPHRASE Align the default `gpg-passphrase` input value with the maven-gpg-plugin default environment variable name (MAVEN_GPG_PASSPHRASE). With this default, setup-java writes no extra GPG configuration to settings.xml and the plugin reads the passphrase from MAVEN_GPG_PASSPHRASE out of the box. Also document that reading the passphrase from an environment variable via `gpg.passphraseEnvName` requires maven-gpg-plugin 3.2.0 or newer. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7d0a510e-aebf-4ec4-a667-efeb3e4edeb1 * Document gpg-passphrase breaking change in V6 Add a "Breaking changes in V6" section to the README covering the switch to gpg.passphraseEnvName, the new MAVEN_GPG_PASSPHRASE default, and the maven-gpg-plugin 3.2.0+ requirement. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7d0a510e-aebf-4ec4-a667-efeb3e4edeb1 * Keep GPG_PASSPHRASE default for v5 compatibility Revert the gpg-passphrase input default back to GPG_PASSPHRASE so existing v5 workflows that set the GPG_PASSPHRASE environment variable keep working without changes. setup-java writes gpg.passphraseEnvName=GPG_PASSPHRASE into an active profile, so the maven-gpg-plugin reads the same variable as before. The only remaining compatibility requirement is maven-gpg-plugin 3.2.0+, which is documented in the README and advanced usage guide. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7d0a510e-aebf-4ec4-a667-efeb3e4edeb1 * Clarify GPG passphrase profile compatibility Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 7d0a510e-aebf-4ec4-a667-efeb3e4edeb1 Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-07-15 10:33:09 -04:00
Bruno Borges	81c13a41f9	Cache Maven and Gradle wrapper distributions separately from the dependency cache (#1097) ... * Cache Maven wrapper distribution separately from the local repository The Maven wrapper distribution (~/.m2/wrapper/dists) was cached in the same entry as the local Maven repository (~/.m2/repository), keyed on a hash of **/pom.xml (plus wrapper properties and extensions). Because pom.xml changes frequently and no restoreKeys are used (by design, #269), almost every change produces a full cache miss and the wrapper distribution is re-downloaded via mvnw — which intermittently fails due to upstream rate limiting. The wrapper distribution only depends on maven-wrapper.properties, which changes very rarely. Give it its own cache entry keyed solely on **/.mvn/wrapper/maven-wrapper.properties so it survives the frequent pom.xml changes that rotate the main dependency cache key. - Add a generic additionalCaches concept to PackageManager, restored and saved independently with name-scoped state keys. - Move ~/.m2/wrapper/dists out of the main maven path into a maven-wrapper additional cache; skip silently when the project does not use mvnw. - Keep cache-hit / cache-primary-key outputs driven by the main cache. - Update tests, docs, and rebuild dist bundles. Fixes #1095 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Cache Gradle wrapper distribution separately from the dependency cache (#1098) The Gradle wrapper distribution (~/.gradle/wrapper) only depends on gradle-wrapper.properties, which changes rarely, but it was previously cached in the same entry as ~/.gradle/caches, keyed on volatile **/*.gradle* files with no restoreKeys (issue #269). Every dependency change therefore re-downloaded the wrapper. Move ~/.gradle/wrapper into a dedicated `gradle-wrapper` additional cache keyed only on **/gradle-wrapper.properties, reusing the additionalCaches infrastructure introduced for the Maven wrapper fix. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Fix broken try/catch in saveAdditionalCache and rebuild dist The autofix commits dropped the `} catch (error) {` line in saveAdditionalCache, leaving a `try` block without a catch and a dangling `error` reference, which broke compilation and Prettier. Restore the catch clause, reformat, and regenerate the dist bundles. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Address cache.ts review feedback - saveAdditionalCache: handle @actions/cache ValidationError (thrown when the cache paths do not resolve, e.g. the wrapper distribution was never downloaded) by skipping instead of failing the post step. Add a test. - Point the Gradle wrapper cache comment at issue #269 (Gradle wrapper cache churn) instead of the Maven-specific #1095. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Document Gradle Wrapper distribution caching in README Add a parallel "Gradle Wrapper" note alongside the Maven Wrapper note, so the new behavior for cache: 'gradle' (caching ~/.gradle/wrapper in a separate entry keyed on **/gradle-wrapper.properties) is documented. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-07-14 17:14:23 -04:00
Bruno Borges	174d4b5609	Support pinning java-version as "latest" (#1093) ... * Support pinning java-version as "latest" Add a `latest` alias for the `java-version` input that floats to the newest available stable (GA) release. It is normalized to the SemVer wildcard at the base-installer layer and always resolves from remote (like `check-latest: true`). List-based distributions resolve it automatically via the existing newest-first matching. Corretto selects its newest available major; Oracle and GraalVM look up the newest GA major via the Adoptium API and request it, failing with an actionable error if that major isn't published yet. The jdkfile distribution rejects `latest`. Closes #832 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Clarify latest note for oracle/graalvm version resolution vs download Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * graalvm-community: float latest to its own newest GA release GraalVM Community publishes its releases on GitHub, so the `latest` alias now matches against that real release list using the SemVer wildcard instead of asking the Adoptium API for the newest GA major. This prevents `latest` from hard-failing when GraalVM lags behind a freshly released Java major (e.g. Adoptium reports 26 before GraalVM ships it). Oracle GraalVM has no listing endpoint, so it keeps deriving the newest major from Adoptium and errors clearly if that major is not yet published. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Give latest+qualifier inputs (e.g. latest-ea) a targeted error Inputs like 'latest-ea' had their '-ea' suffix stripped and fell through to the generic SemVer validation, failing with a confusing "'latest' is not valid SemVer" message even though 'latest' is supported. Add an explicit guard so any 'latest*' value other than exactly 'latest' throws a targeted error explaining that 'latest' resolves GA releases only and cannot be combined with '-ea' or other qualifiers. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-07-09 20:11:03 -04:00
Bruno Borges	f848fd1976	feat: expose cache-primary-key output (#597) (#1088) ... * feat: expose cache-primary-key output (#597) Expose the primary cache key computed by the caching logic as a new `cache-primary-key` action output, so workflows can compose the built-in setup-java cache key with actions/cache or actions/cache/restore across steps and dependent jobs. - src/cache.ts: set the `cache-primary-key` output in restore() - action.yml: declare the new output - README.md: document the new output - __tests__/cache.test.ts: assert the output is set - dist: rebuild Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * chore: rebuild dist Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-07-09 11:19:31 -04:00
Bruno Borges	4db08ef6bf	Infer distribution from asdf .tool-versions vendor prefix (#1084) ... * Infer distribution from asdf .tool-versions vendor prefix asdf-java encodes the JDK vendor as a prefix on the version string in .tool-versions (e.g. `java temurin-17.0.3+7`). Capture that prefix and map it to a setup-java distribution, mirroring the existing .sdkmanrc behavior. Unknown prefixes warn and fall back to the distribution input. Fixes #1081 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>	2026-07-08 12:57:52 -04:00
Bruno Borges	7dbccc66ee	Rename jdkFile input to jdk-file with deprecated alias (#1083) ... * Rename jdkFile input to jdk-file with deprecated alias Add a standardized `jdk-file` input to match the lowercase-dash naming used by every other action input. The camelCase `jdkFile` input is kept as a deprecated alias: it still works, but emits a deprecation warning and may be removed in a future release. `jdk-file` takes precedence when both are provided. Updates docs and the local-file e2e workflow (one case intentionally keeps using the deprecated alias for coverage) and regenerates the dist bundles. Fixes #1077 Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs: keep jdkFile in switching-to-v2 guide The switching-to-v2 migration guide uses actions/setup-java@v2, which only supports the camelCase jdkFile input. Keep the new jdk-file spelling in current-version docs only. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>	2026-07-08 12:44:58 -04:00
Priya Gupta	f7121373a9	Migrate to ESM and upgrade dependencies (#1078) ... * Migrate to ESM and upgrade dependencies * fix: update import statement for JSON module in kona-installer test --------- Co-authored-by: George Adams <georgeadams1995@gmail.com>	2026-07-08 10:15:00 +01:00
Copilot	2a07c83aea	feat: add .mvn/extensions.xml to Maven cache key pattern (#1041) ... * Initial plan * feat: add .mvn/extensions.xml to Maven cache key pattern Closes #990 Maven build extensions declared in `.mvn/extensions.xml` can introduce additional plugin dependencies (e.g. lifecycle participants, custom packaging types). Including this file in the cache key hash ensures that changes to extensions — which affect what plugin JARs Maven downloads — properly invalidate the cache, preventing stale caches from missing newly-required plugin dependencies. Changes: - src/cache.ts: add `**/.mvn/extensions.xml` to Maven pattern array - __tests__/cache.test.ts: update pattern expectations; add new test - README.md: document the new file in the Maven cache key hash list * test: update maven cache error test name for extensions.xml --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-07-08 10:07:54 +01:00
Lukasz	0f481fcb61	feat: Add distribution detection support to .sdkmanrc file (#975) ... * feat: Add distribution detection support to .sdkmanrc file Extends .sdkmanrc support to automatically detect Java distribution from SDKMAN identifiers (e.g., java=21.0.5-tem maps to temurin distribution). Makes distribution input optional when using .sdkmanrc with distribution suffix. * fix: align SDKMAN sem identifier mapping * fix: support SDKMAN albba identifier * docs: clarify sdkmanrc distribution inference scope Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Add Tencent Kona SDKMAN mapping and format sdkmanrc docs as a table - Map SDKMAN 'kona' identifier to the 'kona' distribution (added in #672) - Add a .sdkmanrc test case for the kona suffix - Convert the inline SDKMAN suffix mapping in advanced-usage.md to a table - Rebuild dist bundles Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Bruno Borges <brborges@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <bruno.borges@gmail.com>	2026-07-07 14:49:12 -04:00
Guillaume Smet	6657b99340	feat: Add set-default option (#1017) ... * Add set-default option This option allows to install an additional JDK without making it the default one. I have wanted this for quite a long time as I'm running custom GitHub Actions with Java, which might require a specific JDK and I don't want to pollute the JDK that is used by the overall workflow calling the action. And I'm apparently not alone as there was a preexisting issue. Fixes #560 * Dedupe setJavaDefault and document multi-version/toolchain behavior - Refactor setJavaDefault to delegate shared output/env logic to setJavaEnvironment, avoiding duplication between the two. - Document that set-default applies to all JDKs in a multiline java-version, and that installed JDKs remain registered in Maven toolchains regardless of set-default. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * test: fix Prettier formatting in base-installer test Resolves the failing 'Basic validation / build' format-check on __tests__/distributors/base-installer.test.ts (line exceeded print width). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Bruno Borges <brborges@microsoft.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-07-07 12:38:57 -04:00
Bruno Borges	6c4d4a5025	feat: suppress Maven transfer progress via MAVEN_ARGS by default (add show-download-progress input) (#1053) ... * feat: suppress Maven transfer progress via MAVEN_ARGS by default Set MAVEN_ARGS to include -ntp (--no-transfer-progress) so Maven invocations in the job produce cleaner CI logs without download/transfer progress noise. Add a new optional 'show-download-progress' input (default false); set it to true to keep the progress output. The change preserves any existing MAVEN_ARGS value (the flag is appended, not overwritten) and is idempotent (it won't add the flag twice if -ntp or --no-transfer-progress is already present). Applies on all platforms; honored by Maven 3.9.0+ and the Maven Wrapper, and is a no-op for non-Maven builds. - action.yml: add show-download-progress input - src/constants.ts: add input + MAVEN_ARGS constants - src/maven-args.ts: new configureMavenArgs() - src/setup-java.ts: invoke configureMavenArgs() during setup - __tests__/maven-args.test.ts: unit tests - docs/advanced-usage.md: document the behavior and input - dist: rebuild bundled action Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Update generated dist for Maven args log change --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>	2026-07-02 17:12:50 -04:00
John	b150355f04	feat: Add verify-signature plumbing and Temurin+Microsoft verification support (#1060) ... * Add verify-signature plumbing and Temurin verification support * Rebuild dist after signature verification changes * Refine signature verification errors and regenerate dist * refactor: make gpg.ts generic, move Adoptium-specific constant to temurin distribution * fix: mock renameWinArchive in temurin tests and add signature e2e job * refactor: bundle Adoptium public key, replace keyserver lookup with local import * feat: add verify-signature-public-key input to allow custom GPG key override * refactor: extract Adoptium public key to adoptium-key.ts; tighten gpg.ts cleanup scope * Add verify-signature plumbing and Temurin verification support * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Add Microsoft signature verification support * Regenerate dist bundles for Microsoft signature checks * Harden Microsoft signature URL handling * Add setup-java-microsoft-signature-verification e2e job * chore: regenerate dist files * Fix e2e-versions: remove duplicate job, update signature jobs to checkout@v7 with env vars * Fix Prettier formatting in test files * fix: mock renameWinArchive in microsoft-installer tests to fix Windows CI failure * fix: use --homedir flag instead of GNUPGHOME env var for Windows GPG compatibility The Git-bundled GPG on Windows (MSYS2-based) does not automatically convert Windows-style paths in environment variables like GNUPGHOME. This caused GPG to fail with exit code 2 when verifying Microsoft JDK signatures on Windows, because the GNUPGHOME path (D:\a\_temp\...) was not recognized as a valid POSIX path. Fix: pass --homedir as an explicit command-line argument to both gpg --import and gpg --verify. MSYS2 does correctly convert Windows paths in command-line arguments, so this approach works reliably on Windows, Linux, and macOS. * fix: convert Windows paths to POSIX format for MSYS2 GPG on Windows The Git-bundled GPG on Windows (C:\Program Files\Git\usr\bin\gpg.exe) is an MSYS2-based binary that uses POSIX path conventions internally. When Windows-style paths with backslashes and drive letters (D:\a\_temp\...) are passed as arguments, GPG may fail to resolve them correctly, resulting in a fatal error (exit code 2). Fix: add a toGpgPath() helper that converts Windows paths to MSYS2 POSIX format (/d/a/_temp/...) before passing them to any gpg command. On Linux and macOS the helper is a no-op. Applied to all four paths used in verifyPackageSignature: - gpgHome (--homedir argument) - publicKeyFile (--import argument) - signaturePath (--verify signature argument) - archivePath (--verify data argument) * Fix gpg test formatting --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>	2026-06-29 13:19:49 +01:00
Bruno Borges	525097081d	Update undici artifacts to 6.27.0 (license cache + dist) (#1040) ... * Update undici license cache to 6.27.0 The Licensed check failed because the cached license record for undici was pinned to 6.24.1 while the installed dependency is 6.27.0, causing "license: mit, allowed: false" / source enumeration errors. Regenerate the cached record with `licensed cache` so it matches the installed version. `licensed status` now reports 0 errors. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Rebuild dist with undici 6.27.0 The committed dist/ bundle was built with undici 6.24.1, but the lockfile resolves undici 6.27.0. The check-dist workflow rebuilds the bundle and detected this drift (uncommitted changes after build). Rebuild dist/setup and dist/cleanup with `npm run build` so the committed bundle matches the installed undici 6.27.0, aligning with the license cache update in this PR. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-06-22 16:43:17 -04:00
mahabaleshwars	ce7f9ce621	Add Maven Wrapper cache feature (#1027) ... * add Maven Wrapper distribution caching * update test case --------- Co-authored-by: Bruno Borges <bruno.borges@gmail.com>	2026-06-22 09:45:18 -05:00
Jason Ginchereau	6e9017e125	Bump @actions/cache to 5.1.0, handle cache write denied (#1026)	2026-06-22 09:16:01 +01:00
Sean Proctor	baa1691374	fix: reject non-semver candidate versions in isVersionSatisfies (#1009) ... Distributions like JetBrains Runtime publish 4-segment versions such as '17.0.8.1+1080.1' that the semver package rejects. Both compareBuild and satisfies throw on these, which surfaced to users as "Error: Invalid Version: 17.0.8.1+1080.1" and aborted the whole install when any available version was non-semver. Guard with an early semver.valid check so unparseable versions are treated as a non-match. Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>	2026-06-17 22:47:02 -05:00
dependabot[bot]	f300429fba	Bump @typescript-eslint/parser from 8.48.0 to 8.61.1 (#1021) ... * Bump @typescript-eslint/parser from 8.48.0 to 8.61.1 Bumps [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) from 8.48.0 to 8.61.1. - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.61.1/packages/parser) --- updated-dependencies: - dependency-name: "@typescript-eslint/parser" dependency-version: 8.61.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * run licensed and update dist --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: George Adams <georgeadams1995@gmail.com>	2026-06-16 15:12:38 -07:00
dependabot[bot]	ad2b38190b	Bump @vercel/ncc from 0.38.1 to 0.44.0 (#1018) ... * Bump @vercel/ncc from 0.38.1 to 0.44.0 Bumps [@vercel/ncc](https://github.com/vercel/ncc) from 0.38.1 to 0.44.0. - [Release notes](https://github.com/vercel/ncc/releases) - [Commits](https://github.com/vercel/ncc/compare/0.38.1...0.44.0) --- updated-dependencies: - dependency-name: "@vercel/ncc" dependency-version: 0.44.0 dependency-type: direct:development update-type: version-update:semver-minor ... Signed-off-by: dependabot[bot] <support@github.com> * recompile dist --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: George Adams <georgeadams1995@gmail.com>	2026-06-16 09:37:47 +02:00
John	43120bc3c3	Implement pagination with link headers for Adoptium based apis (#1014) ... * Use Link headers for Adoptium pagination * Fix nullable pagination URL types and rebuild dist * Add 1000-page safeguard for JetBrains pagination * Adjust plan for pagination safeguard scope * Move pagination safeguard to non-JetBrains installers * Add 1000-page safeguard to Adopt Temurin and Semeru pagination * Fix Prettier formatting in adopt, semeru, and temurin installer files * Fix CI audit failure by updating vulnerable transitive deps * Address PR review: RFC-compliant Link parsing, SSRF validation, centralized constant - Make getNextPageUrlFromLinkHeader RFC 8288 compliant by splitting link-values and checking for rel=next anywhere in the parameters, not just as the first parameter after the semicolon. - Add validatePaginationUrl utility to reject pagination URLs that point to unexpected origins (SSRF mitigation). - Centralize MAX_PAGINATION_PAGES in util.ts instead of duplicating across Adopt, Semeru, and Temurin installers. - Add tests for rel not being the first parameter, and for URL origin validation. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Address code review feedback on pagination implementation - Tighten rel regex with word boundary to prevent false positives (e.g., rel="nextsomething" no longer matches). - Use parsed.origin comparison in validatePaginationUrl to correctly handle explicit default ports (e.g., :443 for HTTPS). - Fix pagination safeguard tests to use same-origin URLs so they actually exercise the 1000-page limit instead of being rejected by origin validation on the first request. - Add test for rel="nextsomething" not matching. - Add test for explicit default port acceptance. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> * Fix prettier formatting in util.test.ts * Rebuild dist/ to fix check-dist CI failure --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>	2026-06-12 11:50:16 +01:00
dependabot[bot]	039af37997	Bump picomatch, @types/jest, jest, jest-circus and ts-jest (#1016) ... * Bump picomatch, @types/jest, jest, jest-circus and ts-jest Bumps [picomatch](https://github.com/micromatch/picomatch) to 4.0.4 and updates ancestor dependencies [picomatch](https://github.com/micromatch/picomatch), [@types/jest](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/jest), [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest), [jest-circus](https://github.com/jestjs/jest/tree/HEAD/packages/jest-circus) and [ts-jest](https://github.com/kulshekhar/ts-jest). These dependencies need to be updated together. Updates `picomatch` from 4.0.3 to 4.0.4 - [Release notes](https://github.com/micromatch/picomatch/releases) - [Changelog](https://github.com/micromatch/picomatch/blob/master/CHANGELOG.md) - [Commits](https://github.com/micromatch/picomatch/compare/4.0.3...4.0.4) Updates `@types/jest` from 29.5.14 to 30.0.0 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/jest) Updates `jest` from 29.7.0 to 30.4.2 - [Release notes](https://github.com/jestjs/jest/releases) - [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/jestjs/jest/commits/v30.4.2/packages/jest) Updates `jest-circus` from 29.7.0 to 30.4.2 - [Release notes](https://github.com/jestjs/jest/releases) - [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/jestjs/jest/commits/v30.4.2/packages/jest-circus) Updates `ts-jest` from 29.3.0 to 29.4.11 - [Release notes](https://github.com/kulshekhar/ts-jest/releases) - [Changelog](https://github.com/kulshekhar/ts-jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/kulshekhar/ts-jest/compare/v29.3.0...v29.4.11) --- updated-dependencies: - dependency-name: "@types/jest" dependency-version: 30.0.0 dependency-type: direct:development - dependency-name: jest dependency-version: 30.4.2 dependency-type: direct:development - dependency-name: jest-circus dependency-version: 30.4.2 dependency-type: direct:development - dependency-name: picomatch dependency-version: 4.0.4 dependency-type: indirect - dependency-name: ts-jest dependency-version: 29.4.11 dependency-type: direct:development ... Signed-off-by: dependabot[bot] <support@github.com> * run licensed and update dist --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: George Adams <georgeadams1995@gmail.com>	2026-06-12 10:05:41 +01:00
George Adams	1071fc12d6	fix: resolve npm audit vulnerabilities in fast-xml-builder and fast-xml-parser (#1015) ... * fix: update dependency license records and resolve npm audit vulnerabilities - Bump fast-xml-builder 1.1.4 → 1.2.0 (GHSA-5wm8-gmm8-39j9) - Bump fast-xml-parser 5.5.10 → 5.8.0 (GHSA-gh4j-gqv2-49f6) - Bump strnum 2.2.3 → 2.4.0 - Bump path-expression-matcher 1.4.0 → 1.5.0 - Add license records for new deps @nodable/entities and xml-naming * fix: add anynum license record and rebuild dist * re-run licensed	2026-06-12 09:49:51 +01:00
Copilot	c76542e033	chore: upgrade dependencies (@actions/core, cache, glob, http-client, tool-cache, xmlbuilder2) (#999) ... * chore: upgrade dependencies and update license cache Agent-Logs-Url: https://github.com/actions/setup-java/sessions/55ba1e4b-a515-4177-8a35-44bffa4ad0c0 Co-authored-by: lmvysakh <187510632+lmvysakh@users.noreply.github.com> * chore: upgrade @actions/exec ^1.0.4→^2.0.0 and @actions/io ^1.0.2→^2.0.0 Agent-Logs-Url: https://github.com/actions/setup-java/sessions/8be3df50-f347-42da-9734-73f71bf89d40 Co-authored-by: lmvysakh <187510632+lmvysakh@users.noreply.github.com> --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: lmvysakh <187510632+lmvysakh@users.noreply.github.com>	2026-04-15 12:30:24 -05:00
dependabot[bot]	1d018f9b8b	Bump minimatch from 3.1.2 to 3.1.5 (#984) ... * Bump minimatch from 3.1.2 to 3.1.5 Bumps [minimatch](https://github.com/isaacs/minimatch) from 3.1.2 to 3.1.5. - [Changelog](https://github.com/isaacs/minimatch/blob/main/changelog.md) - [Commits](https://github.com/isaacs/minimatch/compare/v3.1.2...v3.1.5) --- updated-dependencies: - dependency-name: minimatch dependency-version: 3.1.5 dependency-type: indirect ... Signed-off-by: dependabot[bot] <support@github.com> * Check failure fix --------- Signed-off-by: dependabot[bot] <support@github.com> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: gowridurgad <gowridurgad@gmail.com>	2026-03-02 15:50:04 -06:00
Salman Chishti	d81c4e45f3	Upgrade @actions/cache to v5 (#968) ... * Upgrade @actions/cache to v5 - Bump @actions/cache from 4.0.3 to 5.0.0 - Update license cache files for new/updated dependencies - Rebuild dist bundles - Mark @actions/http-client as reviewed in licensed config (MIT license text present but detected as 'other') * chore: Update version to 5.0.1 in package.json and package-lock.json * upgrade actions/cache to 5.0.1 --------- Co-authored-by: Aparna Jyothi <aparnajyothi-y@github.com>	2026-01-20 09:24:36 -06:00
guicamest	4e7e684fbb	feat: Add support for .sdkmanrc file in java-version-file parameter (#736) ... * chore(e2e-versions): Add e2e test scenario on `setup-java-version-from-file-major-minor-patch-with-dist` for `.sdkmanrc` * chore(e2e-versions): Update `setup-java-version-from-file-major-minor-patch-with-dist` test to include the file name of the java-version-file that is used * feat: Add support for `.sdkmanrc` as *Java Version File* * chore: Add test for the latest known sdkman java versions * docs(advanced-usage): Document support for `.sdkmanrc` as java-version-file * chore(docs): Anyone can contribute and maintain 🤷 * Update advanced-usage.md Add example step/file for `.sdkmanrc` * Update advanced-usage.md * Update util.ts * chore: format and rebuild * chore: untouch toolchains.ts * fix check dist error --------- Co-authored-by: mahabaleshwars <147705296+mahabaleshwars@users.noreply.github.com>	2025-11-25 13:36:29 -06:00
mahabaleshwars	46c56d6f92	Add GitHub Token Support for GraalVM and Refactor Code (#849) ... * Code updated to let code accept github token and refactored the code. * github token accept through environment variable * fix test error * audit fix commit * update package-lock.json * Update GraalVM Tests * Lint Issue Resolve * Update Test case for Windows * update with enhance code and test	2025-11-18 12:04:23 -06:00