Upgrade actions/setup-java to v6 by brunoborges · Pull Request #30094 · ccxt/ccxt · GitHub
Skip to content

Upgrade actions/setup-java to v6 - #30094

Closed
brunoborges wants to merge 1 commit into
ccxt:masterfrom
brunoborges:chore/setup-java-v6-batch08-ccxt
Closed

brunoborges wants to merge 1 commit into
ccxt:masterfrom
brunoborges:chore/setup-java-v6-batch08-ccxt

Conversation

@brunoborges

Copy link
Copy Markdown

Summary

Upgrade all active GitHub workflow references from actions/setup-java@v5 to @v6.

Validation

  • git diff --check
  • Verified no setup-java references older than v6 remain in active workflows

No generated source files were changed.

Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>

@carlotestor carlotestor left a comment

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Summary

Bumps actions/setup-java from @v5 to @v6 at all four call sites (java.yml ×2, release.yml, release-short.yml). The title claim checks out — setup-java@v5 appears exactly 4 times in the repo, all 4 are updated, and no setup-java reference exists anywhere outside .github/workflows/.

I checked each documented v6 breaking change against how this repo actually calls the action. None of them apply:

v6 change This repo Impact
Legacy adopt distributions removed (#1185) all 4 sites use distribution: temurin none
jdkFile renamed to jdk-file (deprecated alias kept) input not used none
gpg.passphraseEnvName replaces deprecated gpg.passphrase no gpg-* inputs none
Invalid boolean input values now rejected (#1160) no boolean inputs passed none
Zulu Discovery API → Azul Metadata API (#1010) temurin, not zulu none
ESM migration (#1078) runs.using is node24 in both v5 and v6 — runner runtime is unchanged none

Every call site passes only distribution: temurin + java-version: '21', which is the narrowest possible input surface. The diff is correct and complete.

Two things worth a maintainer's attention before merging. Neither is a defect in the diff:

  • v6.0.0 is roughly three hours old. Published 2026-08-24T15:53Z; this PR opened 2026-08-24T18:43Z. The floating v6 tag currently resolves to dd06d9c. Adopting a same-day .0 major on release-critical workflows is a scheduling judgement, not a code one.
  • This PR's CI has not exercised the change. gh pr checks reports no checks on the branch. Of the three workflows touched, only java.yml runs on pull_request, and it targets a self-hosted runner, which normally needs maintainer approval before it will run for a first-time fork contributor. release.yml and release-short.yml are workflow_dispatch-only and gated to kroitor/frosty00/carlosmiei, so no automated run can validate them — a regression there would first surface during an actual release.

Approving on the diff's merits: minimal, complete, and safe against every breaking change v6 documents. Recommend approving the workflow run so java.yml goes green before this lands.

Merge gate: 🟢
Merge probability: 76%

node-version: '22'
- name: Set up JDK
uses: actions/setup-java@v5
uses: actions/setup-java@v6

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This is the only one of the three bumped call sites that PR CI can actually exercise: java.yml runs on pull_request, but on a self-hosted runner ([self-hosted, linux, x64, java]), which normally needs maintainer approval before it runs for a first-time fork contributor. gh pr checks currently reports no runs on this branch, so v6 is unproven here. Worth approving the workflow run before merge, since v6 changed JDK tool-cache handling (it now moves the extracted JDK into the tool-cache instead of copying it) and a self-hosted runner has a persistent tool-cache that hosted runners do not.

sudo mkdir -p /usr/share/dotnet
- name: Set up JDK
uses: actions/setup-java@v5
uses: actions/setup-java@v6

Copy link
Copy Markdown
Collaborator

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This call site cannot be validated by any automated run: release.yml is workflow_dispatch-only and gated to kroitor/frosty00/carlosmiei. The same applies to release-short.yml:62. The inputs used here (distribution: temurin, java-version: '21') are unaffected by every breaking change v6 documents, so the risk is low, but a manual workflow_dispatch dry run is the only way to confirm before a real release depends on it.

@brunoborges

Copy link
Copy Markdown
Author

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

dependencies Dependency updates java

Projects

None yet

Development

Successfully merging this pull request may close these issues.

2 participants