iframe-proxy

jdubois · 2026-08-05T13:13:00Z

Closes #1212

Summary

derive the concrete Java patch/build version from the extracted JDK release metadata for Oracle JDK and Oracle GraalVM /latest/ downloads
force floating requests through remote artifact fingerprinting and never trust source-less tool-cache matches
bind concrete-version resolution and JDK-cache reuse to the authoritative artifact checksum; when no checksum is available, bypass floating caches and download safely
preserve exact-version and GraalVM Community behavior while adding regression and scheduled multi-platform E2E output coverage
regenerate all required dist/ bundles with the repository CI toolchain

Validation

Full Basic validation matrix: Linux, macOS, and Windows (format, lint, build, 1,327 tests, audit): https://github.com/jdubois/setup-java/actions/runs/31010175674
Final generated dist/ comparison: https://github.com/jdubois/setup-java/actions/runs/31010359757
Local npm restore was blocked by the configured package proxy (404 for brace-expansion@5.0.9), so validation and bundle generation used the fork workflows as requested
bash -n __tests__/verify-java.sh
git diff --check

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot

Pull request overview

This PR fixes Oracle JDK and Oracle GraalVM “floating” (/latest/) downloads reporting and caching only the requested major version by deriving the concrete installed patch/build from the extracted JDK release metadata, and by binding floating resolution reuse to an immutable artifact identity (checksum).

Changes:

Add getJavaVersionFromReleaseFile() to read/normalize the concrete Java version from the extracted JDK release file (including macOS Contents/Home layout).
For Oracle JDK and Oracle GraalVM /latest/ downloads, cache toolcache/JDK-cache entries under the concrete installed version and record floating resolution mappings keyed by authoritative artifact identity.
Update E2E + unit/regression tests to validate output correctness, cache identities, and behavior across successive floating artifacts.

Show a summary per file

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Files reviewed: 12/19 changed files
Comments generated: 1
Review effort level: Lite

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Oracle and Oracle GraalVM do not always publish a `.sha256` sibling next to a `/latest/` artifact. Those floating releases were excluded from both the resolution cache and the JDK cache, so `cache-jdk` users lost caching entirely for them. A floating URL is a constant string, so it cannot serve as a cache identity on its own — a stale entry would be reused forever. Instead, derive a validator from the headers of the HEAD request that already resolves the artifact: the ETag when present, otherwise `Last-Modified` combined with `Content-Length`. Republishing changes the validator, which changes the cache key, so a new build is downloaded rather than masked. `getJdkReleaseIdentity` now falls back to that fingerprint before the URL, and the floating cache gates ask whether the release has a stable identity (checksum or fingerprint) rather than a checksum specifically. A floating release with neither is still left uncached. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

brunoborges · 2026-08-05T15:50:24Z

I pushed one commit to this branch (f733709) — hope that's alright, happy to drop it if you'd rather handle it separately.

Context: I had a parallel implementation of #1212 and compared the two. Yours is the better design — preferring JAVA_RUNTIME_VERSION over JAVA_VERSION picks up the build number (21.0.8+12 rather than 21.0.8), which matches what the other distributions report, and keying the resolution cache on the artifact checksum is much cleaner than what I had.

The one gap I wanted to close is the checksum-less case. Oracle and Oracle GraalVM don't always publish a .sha256 sibling next to a /latest/ artifact, and fetchChecksum returns undefined on a 404. Those releases were excluded from both the resolution cache and the JDK cache, so cache-jdk users lose caching entirely for them.

The naive fix — falling back to the URL identity — doesn't work: a /latest/ URL is a constant string, so the key would never invalidate and a stale JDK would be restored forever, which is exactly the bug this PR fixes. So the commit derives a validator from the HEAD response both installers already make:

getArtifactFingerprint(headers) in util.ts — ETag when present, otherwise Last-Modified + Content-Length together (neither alone is enough: one-second granularity, and a same-size rebuild). Returns undefined when the response carries no validator.
JavaDownloadRelease.fingerprint, set by the Oracle and GraalVM resolvers for floating releases only. No extra requests.
getJdkReleaseIdentity falls back to the fingerprint before the URL, and a new hasStableReleaseIdentity() replaces the four javaRelease.checksum gates. A floating release with neither checksum nor fingerprint is still left uncached, as before.

Republishing changes the validator, which changes the key, so a new build is downloaded rather than masked.

41 suites / 1340 tests pass, along with format-check, lint, and a dist/ rebuild. I checked the guard is load-bearing: reverting hasStableReleaseIdentity to checksum-only fails exactly the two new caching tests.

Fix floating Oracle JDK version resolution

7d5cca5

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot AI lite review requested due to automatic review settings August 5, 2026 13:13

jdubois requested a review from a team as a code owner August 5, 2026 13:13

Copilot started reviewing on behalf of jdubois August 5, 2026 13:13

View session

Update generated distribution bundles

31535a4

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot AI reviewed Aug 5, 2026

View reviewed changes

Comment thread __tests__/distributors/oracle-installer.test.ts Outdated

jdubois and others added 9 commits August 5, 2026 15:18

Harden floating artifact cache identity

cb777ad

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Regenerate setup bundle after cache hardening

60916a0

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Temporarily enable hosted full validation

5beb795

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Export hosted formatting results

7f6d42e

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Apply repository formatting

a5fca2a

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Run hosted validation after formatting

1b0e897

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Correct floating version regression tests

897d54c

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Remove temporary validation wiring

7b1662f

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

brunoborges merged commit f4bfb3d into actions:main Aug 5, 2026
84 checks passed

brunoborges mentioned this pull request Aug 5, 2026

Reuse the tool cache for floating versions the resolution cache identified #1219

Merged

File	Description
src/util.ts	Adds release-file parsing + normalization to derive concrete installed Java versions.
src/jdk-resolution-cache.ts	Extends resolution identity to include immutable artifact identity (`source`) and persists `floating` safely.
src/distributions/oracle/installer.ts	Uses release metadata for floating installs and forces major-only stable requests through remote resolution.
src/distributions/graalvm/installer.ts	Same as Oracle JDK: concrete version from release file for floating installs + remote resolution for major-only Oracle GraalVM.
src/distributions/base-installer.ts	Adds floating-resolution restore/register flow keyed by artifact identity and integrates concrete-version validation for floating downloads.
.github/workflows/e2e-versions.yml	Extends E2E version verification to assert concrete output for floating Oracle/GraalVM major-only requests.
tests/verify-java.sh	Adds checks ensuring action output version matches installed Java, and requires concreteness for floating cases.
tests/util-install.test.ts	Adds unit coverage for release-file parsing/normalization including macOS layout.
tests/jdk-resolution-cache.test.ts	Adds coverage that different floating artifact identities produce distinct cache keys.
tests/distributors/oracle-installer.test.ts	Adds coverage for remote-resolution requirement (but currently contains a Jest structure bug).
tests/distributors/graalvm-installer.test.ts	Adds coverage for concrete caching of floating artifacts and remote-resolution requirement.
tests/distributors/base-installer.test.ts	Adds regression test ensuring two different floating artifacts under one major install/cache distinctly.

Sunbelt Computer Software

PL/B Language Development and Support

Navigation Menu

Repository navigation

Report concrete versions for floating Oracle JDK downloads - #1213

Report concrete versions for floating Oracle JDK downloads#1213
brunoborges merged 11 commits into
actions:mainfrom
jdubois:jdubois-fix-oracle-graalvm-floating-versions

jdubois commented Aug 5, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

brunoborges commented Aug 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Sunbelt Computer Software

PL/B Language Development and Support

Conversation

jdubois commented Aug 5, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Validation

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Review details

Uh oh!

Uh oh!

brunoborges commented Aug 5, 2026

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

jdubois commented Aug 5, 2026 •

edited

Loading