Reuse the tool cache for floating versions the resolution cache identified - #1219
Merged
brunoborges merged 2 commits intoAug 5, 2026
Merged
Conversation
…ified A floating Oracle JDK or Oracle GraalVM request now skips the tool-cache short-circuit entirely, so every job re-downloads and re-extracts the JDK even when the exact bytes the mutable URL currently serves are already installed locally. The JDK resolution cache is keyed on the artifact's checksum (or, failing that, its HTTP response fingerprint), so a hit proves which concrete version the URL is serving right now. Once it has vouched for that version, an existing tool-cache installation of exactly that version is the artifact the download would have produced, and can be reused. Reuse is therefore gated on the resolution cache hit, never on the requested major: an unidentified floating artifact still downloads, as does an explicit force-download. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: f2d9a891-a680-4b35-9644-cf2450f76f6d
Contributor
There was a problem hiding this comment.
Pull request overview
This PR refines setup-java’s handling of floating Oracle JDK / Oracle GraalVM “major-only” requests by allowing reuse of an already-installed tool-cache JDK only after the checksum/fingerprint-bound resolution cache has identified the concrete version, avoiding unnecessary downloads while preserving the safety constraints introduced in #1213.
Changes:
- Add an internal
floatingVersionVerifiedgate that is set only whenrestoreFloatingResolution()successfully restores and validates a concrete version from the resolution cache. - Reuse a tool-cache installation for floating releases by looking up the exact concrete version (with
.completemarker) once verified, otherwise continue downloading as before. - Add targeted unit tests covering reuse and the safety guardrails (no resolution identity, mismatched tool-cache version, and
force-download).
Show a summary per file
| File | Description |
|---|---|
| src/distributions/base-installer.ts | Gates floating tool-cache reuse on a verified concrete version from the resolution cache; adds exact-version tool-cache lookup. |
| dist/setup/242.index.js | Regenerated bundle reflecting the updated floating tool-cache reuse logic. |
| tests/distributors/base-installer.test.ts | Adds tests validating reuse behavior and safety constraints for floating releases. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
- Files reviewed: 2/3 changed files
- Comments generated: 0
- Review effort level: Lite
brunoborges
deleted the
brunoborges-reuse-toolcache-for-verified-floating-versions
branch
August 5, 2026 16:08
brunoborges
added a commit
to jdubois/setup-java
that referenced
this pull request
Aug 5, 2026
Merging main brought in actions#1219, which added getFloatingResolutionRequest as a second construction site for JdkResolutionRequest. It predates the required `platform` field, so the merged tree did not compile. The floating request already carries `source`, which pins the artifact bytes, so this changes no lookup behaviour on its own -- it keeps the two request builders consistent and the tree building. Also refreshes dist/, which the textual merge left stale. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 74248bb0-72af-41d8-b85d-b0f5836e68db
brunoborges
added a commit
that referenced
this pull request
Aug 5, 2026
* Fix JDK resolution cache platform identity Include the effective Linux libc platform in JDK resolution cache keys so Alpine/musl and glibc runners cannot restore each other's release metadata. Bump the cache namespace and share Alpine detection with affected distributors.\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>\nCopilot-Session: 4f95577c-567c-47a8-92f2-b4dced527866 * Update generated action bundles Regenerate setup and cleanup distributions for the platform-aware JDK resolution cache.\n\nCo-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>\nCopilot-Session: 4f95577c-567c-47a8-92f2-b4dced527866 * Cover the platform-identity fallback and Alpine short-circuit getJavaPlatformIdentity's `?? platform` fallback and the alias path for platforms other than linux/darwin/win32 had no coverage, and isAlpineLinux had no direct test at all. Verified by mutation: replacing the fallback with a constant, and dropping the `platform === 'linux'` short-circuit from isAlpineLinux, both left the existing suite fully green. The added cases fail on each. The short-circuit case matters beyond coverage bookkeeping: it is what keeps the /etc/alpine-release probe from running on non-Linux runners, so a stray file can never make Windows or macOS resolve as musl. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 74248bb0-72af-41d8-b85d-b0f5836e68db * Carry the platform identity into the floating resolution request Merging main brought in #1219, which added getFloatingResolutionRequest as a second construction site for JdkResolutionRequest. It predates the required `platform` field, so the merged tree did not compile. The floating request already carries `source`, which pins the artifact bytes, so this changes no lookup behaviour on its own -- it keeps the two request builders consistent and the tree building. Also refreshes dist/, which the textual merge left stale. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 74248bb0-72af-41d8-b85d-b0f5836e68db --------- Co-authored-by: Bruno Borges <brborges@microsoft.com> Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 74248bb0-72af-41d8-b85d-b0f5836e68db
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Follow-up enhancement on top of #1213.
Gap
#1213 correctly stopped trusting the requested major (
21) as the resolved version for floating Oracle JDK / Oracle GraalVM downloads. To do that it disables the tool-cache short-circuit for floating requests entirely —foundJavais forced tonull.That is the safe behaviour, but it is stricter than necessary: a job that has already installed the exact bytes the mutable
/latest/URL is serving right now still re-downloads and re-extracts the whole JDK on every run.Change
JdkResolutionRequest.sourceis the artifact's checksum, or (since #1213's follow-up commit) its HTTP response fingerprint. Either way it is bound to the bytes, not to the URL. So a resolution-cache hit is proof of which concrete version the floating URL is serving at this moment.Once the resolution cache has vouched for a concrete version, an existing tool-cache installation of exactly that version is by definition the artifact the download would have produced, and can be reused.
floatingVersionVerified, set only insiderestoreFloatingResolution's success path — never from the requested major.findConcreteVersionInToolcache(version), which requiressemver.valid(version)and an actually-present<version>/<arch>+.completemarker.null.Safety
Reuse is gated on the checksum/fingerprint-bound resolution hit, so:
force-downloadstill forces a download.Tests
Four new cases in
__tests__/distributors/base-installer.test.tscovering each of the above, using a real temp tool-cache directory. Verified load-bearing: reverting the source change fails the reuse test while the three safety tests keep passing.Full suite: 41 suites / 1344 tests pass;
format-check,lint, andbuildclean.