* Support exact Corretto release versions
Corretto users cannot pin the release used by their local builds and
production. Accept full release numbers so a workflow keeps using its
chosen release after Amazon publishes a newer patch.
* Fix Corretto release review findings
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Bruno Borges <brborges@microsoft.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fix Liberica SDKMAN patch release resolution
Preserve BellSoft's fourth version component as SDKMAN patch metadata and cover real API version formats for Java 17 and 25.
Fixes#1290
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d5b53868-538f-4c5f-b2aa-c66dc4ad06e2
* Fix Liberica patch ordering and build-less requests
Share overridable matching and ordering with toolcache selection. Keep patch-only requests distinct from exact SDKMAN build requests and cover the reported API pair across remote and cached resolution.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d5b53868-538f-4c5f-b2aa-c66dc4ad06e2
---------
Copilot-Session: d5b53868-538f-4c5f-b2aa-c66dc4ad06e2
Accept 4-part versions with build metadata (X.Y.Z.P+B -> X.Y.Z+P.B) and
match exact Temurin requests against OpenJDK-derived version keys, since the
Adoptium API semver folds the patch into the build number (26.0.2+101) and
adds LTS metadata (25.0.4+7.0.LTS).
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Azul reports hotfix releases like 25.0.4.1 as java_version=[25,0,4,1]
with openjdk_build_number=1 (SDKMAN '25.0.4+1.1'). Sorting candidates via
semver.compareBuild ranked 25.0.4+7 above 25.0.4+1.1, so ranges such as
'25' resolved to the older build. Compare java_version, build number and
distro_version numerically instead.
Fixes: #1275
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Initial plan
* Fix signature verification GPG homes on long runner paths
* Keep macOS GPG verification homes within socket limits
Use /tmp for signature verification on macOS while preserving runner temp behavior elsewhere. Cover long and canonical OS temp paths and regenerate action bundles.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 32d31c8d-ddbc-4e57-a5c3-f70588fef3f3
---------
Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com>
Co-authored-by: Bruno Borges <brborges@microsoft.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 32d31c8d-ddbc-4e57-a5c3-f70588fef3f3
* Fix import-safe checks when scripts are run from a path with symlinks
In v6, setup-java was made "import-safe" to facilitate testing. This
prevents setup-java & cleanup-java from doing anything when their
sources get imported.
This works fine in the general case, but actually invoking the script
(`node setup-java/index.js`) when the path to the script contains
symlinks led to the script incorrectly believing it was imported, and
refuse to actually run.
To fix this, we pass `process.argv[1]` through `fs.realpathSync`, which
resolves symlinks in the path.
Fixes#1264
* Preserve import safety when resolving symlink entrypoints
Share entrypoint detection between setup and cleanup, handle non-file entrypoints safely, and normalize both paths for preserved symlinks. Add real-process regression coverage and rebuild action bundles.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 831c32f2-a275-45bd-a92b-c387372a1554
* Update js-yaml to fix merge-source denial of service
Bump the transitive development dependency from 3.15.1 to 3.15.2 to address GHSA-2883-xcg3-v3hh without changing dependency ranges or CI checks.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 831c32f2-a275-45bd-a92b-c387372a1554
---------
Co-authored-by: Bruno Borges <brborges@microsoft.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 831c32f2-a275-45bd-a92b-c387372a1554
Update public examples and release messaging to make v6 the recommended stable version, include late-cycle v6 features, and increase the JetBrains test timeout to avoid cold-run flakes.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 24e3d384-3bda-4ca3-b1fc-f49e340c174f
* Updated microsoft openjdk setup-java action
* Update generated distribution
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Applied new fixes from npm run check
* Update generated distribution
---------
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Handle cache restore promise rejections
Validate dependency cache providers before Java installation and settle cache restore failures immediately while preserving setup error precedence.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Make cache-rejection regression test deterministic
Reject the cache restore only after it has started and while the Java
installation is still pending, instead of relying on event-loop timing.
Verified the test fails against the pre-fix implementation.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Validate cache input after required input checks
Move the package-manager validation out of the top of run() so that
missing java-version/java-version-file and toolchain id errors keep
their original precedence. Validation now happens immediately before
the cache restore is started, which still fails fast before any JDK
download.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Bruno Borges <brborges@microsoft.com>
* Fix SapMachine early-access filtering
Ensure SapMachine EA requests exclude stable releases and cover string and boolean release metadata with competing fixture candidates.\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Update distribution bundle
Regenerate the setup bundle for SapMachine release-class filtering.\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Format SapMachine regression tests
Apply the repository Prettier format to the focused test additions.\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Bruno Borges <brborges@microsoft.com>
On Alpine, `getPlatformOption()` returned the glibc platform key for
Dragonwell, Corretto, Zulu, Liberica and Liberica NIK, so the action
resolved and installed a glibc JDK that cannot run under musl.
Add a shared `isAlpineLinux()` helper and use it to select each vendor's
musl artifacts:
| distribution | glibc | musl |
| ------------ | ------------- | -------------- |
| Dragonwell | `linux` | `alpine-linux` |
| Corretto | `linux` | `alpine` |
| Zulu | `linux_glibc` | `linux_musl` |
| Liberica | `linux` | `linux-musl` |
| Liberica NIK | `linux` | `linux-musl` |
Each key was verified against the vendor's live metadata API or manifest.
There is deliberately no silent fallback to glibc when a vendor has no
musl build for the requested version or architecture: the existing "could
not find a version that satisfies" error fires instead. This matches the
behaviour Temurin and SapMachine already have, and a glibc JDK would not
run on musl anyway.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 74248bb0-72af-41d8-b85d-b0f5836e68db
* Fix JDK resolution cache platform identity
Include the effective Linux libc platform in JDK resolution cache keys so Alpine/musl and glibc runners cannot restore each other's release metadata. Bump the cache namespace and share Alpine detection with affected distributors.\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>\nCopilot-Session: 4f95577c-567c-47a8-92f2-b4dced527866
* Update generated action bundles
Regenerate setup and cleanup distributions for the platform-aware JDK resolution cache.\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>\nCopilot-Session: 4f95577c-567c-47a8-92f2-b4dced527866
* Cover the platform-identity fallback and Alpine short-circuit
getJavaPlatformIdentity's `?? platform` fallback and the alias path for
platforms other than linux/darwin/win32 had no coverage, and isAlpineLinux
had no direct test at all.
Verified by mutation: replacing the fallback with a constant, and dropping
the `platform === 'linux'` short-circuit from isAlpineLinux, both left the
existing suite fully green. The added cases fail on each.
The short-circuit case matters beyond coverage bookkeeping: it is what keeps
the /etc/alpine-release probe from running on non-Linux runners, so a stray
file can never make Windows or macOS resolve as musl.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 74248bb0-72af-41d8-b85d-b0f5836e68db
* Carry the platform identity into the floating resolution request
Merging main brought in #1219, which added getFloatingResolutionRequest
as a second construction site for JdkResolutionRequest. It predates the
required `platform` field, so the merged tree did not compile.
The floating request already carries `source`, which pins the artifact
bytes, so this changes no lookup behaviour on its own -- it keeps the two
request builders consistent and the tree building.
Also refreshes dist/, which the textual merge left stale.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 74248bb0-72af-41d8-b85d-b0f5836e68db
---------
Co-authored-by: Bruno Borges <brborges@microsoft.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 74248bb0-72af-41d8-b85d-b0f5836e68db
A floating Oracle JDK or Oracle GraalVM request now skips the tool-cache
short-circuit entirely, so every job re-downloads and re-extracts the JDK
even when the exact bytes the mutable URL currently serves are already
installed locally.
The JDK resolution cache is keyed on the artifact's checksum (or, failing
that, its HTTP response fingerprint), so a hit proves which concrete
version the URL is serving right now. Once it has vouched for that
version, an existing tool-cache installation of exactly that version is
the artifact the download would have produced, and can be reused.
Reuse is therefore gated on the resolution cache hit, never on the
requested major: an unidentified floating artifact still downloads, as
does an explicit force-download.
Co-authored-by: Bruno Borges <brunoborges@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: f2d9a891-a680-4b35-9644-cf2450f76f6d
* Isolate Maven signing keys
Import signing keys into an action-owned temporary GPG home, export GNUPGHOME, and remove the owned directory in the post action. Cover import failure, multiple keys and invocations, unrelated keyrings, missing state, and Windows path conversion.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fix cleanup state assertion
Account for isolated GPG-home cleanup when cache saving is disabled.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Update generated action bundles
Apply repository formatting and commit the setup and cleanup bundles produced by the validated Node 24 build.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address isolated GPG home review feedback
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Bruno Borges <brborges@microsoft.com>
