mirror of
https://github.com/actions/setup-java.git
synced 2026-06-29 18:40:33 +03:00
John
b150355f04
* Add verify-signature plumbing and Temurin verification support * Rebuild dist after signature verification changes * Refine signature verification errors and regenerate dist * refactor: make gpg.ts generic, move Adoptium-specific constant to temurin distribution * fix: mock renameWinArchive in temurin tests and add signature e2e job * refactor: bundle Adoptium public key, replace keyserver lookup with local import * feat: add verify-signature-public-key input to allow custom GPG key override * refactor: extract Adoptium public key to adoptium-key.ts; tighten gpg.ts cleanup scope * Add verify-signature plumbing and Temurin verification support * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Add Microsoft signature verification support * Regenerate dist bundles for Microsoft signature checks * Harden Microsoft signature URL handling * Add setup-java-microsoft-signature-verification e2e job * chore: regenerate dist files * Fix e2e-versions: remove duplicate job, update signature jobs to checkout@v7 with env vars * Fix Prettier formatting in test files * fix: mock renameWinArchive in microsoft-installer tests to fix Windows CI failure * fix: use --homedir flag instead of GNUPGHOME env var for Windows GPG compatibility The Git-bundled GPG on Windows (MSYS2-based) does not automatically convert Windows-style paths in environment variables like GNUPGHOME. This caused GPG to fail with exit code 2 when verifying Microsoft JDK signatures on Windows, because the GNUPGHOME path (D:\a\_temp\...) was not recognized as a valid POSIX path. Fix: pass --homedir as an explicit command-line argument to both gpg --import and gpg --verify. MSYS2 does correctly convert Windows paths in command-line arguments, so this approach works reliably on Windows, Linux, and macOS. * fix: convert Windows paths to POSIX format for MSYS2 GPG on Windows The Git-bundled GPG on Windows (C:\Program Files\Git\usr\bin\gpg.exe) is an MSYS2-based binary that uses POSIX path conventions internally. When Windows-style paths with backslashes and drive letters (D:\a\_temp\...) are passed as arguments, GPG may fail to resolve them correctly, resulting in a fatal error (exit code 2). Fix: add a toGpgPath() helper that converts Windows paths to MSYS2 POSIX format (/d/a/_temp/...) before passing them to any gpg command. On Linux and macOS the helper is a no-op. Applied to all four paths used in verifyPackageSignature: - gpgHome (--homedir argument) - publicKeyFile (--import argument) - signaturePath (--verify signature argument) - archivePath (--verify data argument) * Fix gpg test formatting --------- Co-authored-by: copilot-swe-agent[bot] <198982749+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>
98 lines
4.7 KiB
YAML
98 lines
4.7 KiB
YAML
name: 'Setup Java JDK'
|
|
description: 'Set up a specific version of the Java JDK and add the
|
|
command-line tools to the PATH'
|
|
author: 'GitHub'
|
|
inputs:
|
|
java-version:
|
|
description: 'The Java version to set up. Takes a whole or semver Java version. See examples of supported syntax in README file'
|
|
required: false
|
|
java-version-file:
|
|
description: 'The path to a file containing the Java version to set up (.java-version, .tool-versions, .sdkmanrc). Used when java-version is not set. See examples of supported syntax in README file'
|
|
required: false
|
|
distribution:
|
|
description: 'Java distribution. See the list of supported distributions in README file'
|
|
required: true
|
|
java-package:
|
|
description: 'The package type (jdk, jre, jdk+fx, jre+fx)'
|
|
required: false
|
|
default: 'jdk'
|
|
architecture:
|
|
description: "The architecture of the package (defaults to the action runner's architecture)"
|
|
required: false
|
|
jdkFile:
|
|
description: 'Path to where the compressed JDK is located'
|
|
required: false
|
|
check-latest:
|
|
description: 'Set this option if you want the action to check for the latest available version that satisfies the version spec'
|
|
required: false
|
|
default: false
|
|
verify-signature:
|
|
description: 'Verify downloaded Java package signatures when supported by the selected distribution'
|
|
required: false
|
|
default: false
|
|
verify-signature-public-key:
|
|
description: 'ASCII-armored GPG public key used to verify the downloaded package signature. Overrides the default bundled key for the selected distribution.'
|
|
required: false
|
|
server-id:
|
|
description: 'ID of the distributionManagement repository in the pom.xml
|
|
file. Default is `github`'
|
|
required: false
|
|
default: 'github'
|
|
server-username:
|
|
description: 'Environment variable name for the username for authentication
|
|
to the Apache Maven repository. Default is $GITHUB_ACTOR'
|
|
required: false
|
|
default: 'GITHUB_ACTOR'
|
|
server-password:
|
|
description: 'Environment variable name for password or token for
|
|
authentication to the Apache Maven repository. Default is $GITHUB_TOKEN'
|
|
required: false
|
|
default: 'GITHUB_TOKEN'
|
|
settings-path:
|
|
description: 'Path to where the settings.xml file will be written. Default is ~/.m2.'
|
|
required: false
|
|
overwrite-settings:
|
|
description: 'Overwrite the settings.xml file if it exists. Default is "true".'
|
|
required: false
|
|
default: true
|
|
gpg-private-key:
|
|
description: 'GPG private key to import. Default is empty string.'
|
|
required: false
|
|
default: ''
|
|
gpg-passphrase:
|
|
description: 'Environment variable name for the GPG private key passphrase. Defaults to GPG_PASSPHRASE when gpg-private-key is set; ignored otherwise.'
|
|
required: false
|
|
cache:
|
|
description: 'Name of the build platform to cache dependencies. It can be "maven", "gradle" or "sbt".'
|
|
required: false
|
|
cache-dependency-path:
|
|
description: 'The path to a dependency file: pom.xml, build.gradle, build.sbt, etc. This option can be used with the `cache` option. If this option is omitted, the action searches for the dependency file in the entire repository. This option supports wildcards and a list of file names for caching multiple dependencies.'
|
|
required: false
|
|
job-status:
|
|
description: 'Workaround to pass job status to post job step. This variable is not intended for manual setting'
|
|
required: false
|
|
default: ${{ job.status }}
|
|
token:
|
|
description: The token used to authenticate when fetching version manifests hosted on github.com, such as for the Microsoft Build of OpenJDK. When running this action on github.com, the default value is sufficient. When running on GHES, you can pass a personal access token for github.com if you are experiencing rate limiting.
|
|
required: false
|
|
default: ${{ github.server_url == 'https://github.com' && github.token || '' }}
|
|
mvn-toolchain-id:
|
|
description: 'Name of Maven Toolchain ID if the default name of "${distribution}_${java-version}" is not wanted. See examples of supported syntax in Advanced Usage file'
|
|
required: false
|
|
mvn-toolchain-vendor:
|
|
description: 'Name of Maven Toolchain Vendor if the default name of "${distribution}" is not wanted. See examples of supported syntax in Advanced Usage file'
|
|
required: false
|
|
outputs:
|
|
distribution:
|
|
description: 'Distribution of Java that has been installed'
|
|
version:
|
|
description: 'Actual version of the java environment that has been installed'
|
|
path:
|
|
description: 'Path to where the java environment has been installed (same as $JAVA_HOME)'
|
|
cache-hit:
|
|
description: 'A boolean value to indicate an exact match was found for the primary key'
|
|
runs:
|
|
using: 'node24'
|
|
main: 'dist/setup/index.js'
|
|
post: 'dist/cleanup/index.js'
|