Add force-download option for reproducible JDK builds - #1148
Merged
brunoborges merged 4 commits intoJul 28, 2026
Merged
Conversation
Copy link
Copy Markdown
Contributor
Sorry, something went wrong.
Copilot
AI
changed the title
[WIP] Add force-download option for reproducible builds
Add force-download option for reproducible JDK builds
Jul 28, 2026
brunoborges
marked this pull request as ready for review
July 28, 2026 04:38
Copy link
Copy Markdown
Contributor
There was a problem hiding this comment.
Pull request overview
Adds a new force-download input to actions/setup-java to bypass potentially system-modified runner tool-cache JDKs (e.g., modified cacerts) and ensure reproducible JDK artifacts by always downloading/unpacking and re-caching the requested version.
Changes:
- Introduces force-download input plumbing (constants, action.yml, README) and passes it through installer options.
- Updates the base installer and jdkfile (local) distribution to skip tool-cache resolution when force-download is enabled.
- Adds unit tests covering cache-bypass behavior and updates bundled dist/* artifacts.
| File | Description |
|---|---|
| src/setup-java.ts | Reads force-download input and forwards it into JavaInstallerOptions. |
| src/distributions/local/installer.ts | Skips tool-cache resolution for jdkfile installs when force-download is enabled. |
| src/distributions/base-models.ts | Extends installer options model with forceDownload. |
| src/distributions/base-installer.ts | Implements tool-cache bypass in the common installer flow and ensures latest-resolution doesn’t fall back to cache when forced. |
| src/constants.ts | Adds INPUT_FORCE_DOWNLOAD constant. |
| README.md | Documents the new force-download input and its reproducibility motivation. |
| action.yml | Declares force-download input for the action. |
| tests/distributors/local-installer.test.ts | Adds coverage for jdkfile extraction path when force-download is enabled. |
| tests/distributors/base-installer.test.ts | Adds coverage ensuring tool-cache lookup is skipped when force-download is enabled. |
| dist/setup/index.js | Updates bundled action output to include force-download behavior. |
| dist/cleanup/index.js | Updates bundled cleanup output to include the new constant. |
Review details
Tip
Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.
src/distributions/local/installer.ts:35
- When force-download is enabled, the tool-cache lookup is intentionally skipped, but the log message in the else branch still says the version "was not found in tool-cache". This is misleading for users trying to understand why a cached JDK wasn’t used.
let foundJava = this.forceDownload ? null : this.findInToolcache();
if (foundJava) {
core.info(`Resolved Java ${foundJava.version} from tool-cache`);
} else {
- Files reviewed: 9/11 changed files
- Comments generated: 0
- Review effort level: Low
Sorry, something went wrong.
brunoborges
approved these changes
Jul 28, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Reviewers
+1 more reviewerAssignees
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Description:
Runner-cached JDKs may contain system-modified certificate stores, producing non-reproducible runtime images.
Related issue:
Check list: