Repository navigation
Sync: actions/setup-java@b843ebf - #22
Open
forklebot[bot] wants to merge 14 commits into
Open
forklebot[bot] wants to merge 14 commits into
forklebot[bot] wants to merge 14 commits into
Conversation
* Initial plan * Install GnuPG in Alpine E2E job --------- Co-authored-by: copilot-swe-agent[bot] <[email protected]>
* Configure Temurin EA E2E signature verification Co-authored-by: brunoborges <[email protected]> * Disable signature verification for Temurin EA E2E Co-authored-by: brunoborges <[email protected]> * Fix Temurin EA signature verification scope Co-authored-by: Copilot App <[email protected]> Copilot-Session: 7ac2d888-2383-49c7-9178-da5455a10034 --------- Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: brunoborges <[email protected]> Co-authored-by: Bruno Borges <[email protected]> Copilot-Session: 7ac2d888-2383-49c7-9178-da5455a10034
…ation failures. To prevent build failures due to missing GPG or rotated vendor keys. (actions#1262) Also allow multiple GPG keys to be provided. Co-authored-by: John <[email protected]>
…actions#1265) * Fix import-safe checks when scripts are run from a path with symlinks In v6, setup-java was made "import-safe" to facilitate testing. This prevents setup-java & cleanup-java from doing anything when their sources get imported. This works fine in the general case, but actually invoking the script (`node setup-java/index.js`) when the path to the script contains symlinks led to the script incorrectly believing it was imported, and refuse to actually run. To fix this, we pass `process.argv[1]` through `fs.realpathSync`, which resolves symlinks in the path. Fixes actions#1264 * Preserve import safety when resolving symlink entrypoints Share entrypoint detection between setup and cleanup, handle non-file entrypoints safely, and normalize both paths for preserved symlinks. Add real-process regression coverage and rebuild action bundles. Co-authored-by: Copilot App <[email protected]> Copilot-Session: 831c32f2-a275-45bd-a92b-c387372a1554 * Update js-yaml to fix merge-source denial of service Bump the transitive development dependency from 3.15.1 to 3.15.2 to address GHSA-2883-xcg3-v3hh without changing dependency ranges or CI checks. Co-authored-by: Copilot App <[email protected]> Copilot-Session: 831c32f2-a275-45bd-a92b-c387372a1554 --------- Co-authored-by: Bruno Borges <[email protected]> Co-authored-by: Copilot App <[email protected]> Copilot-Session: 831c32f2-a275-45bd-a92b-c387372a1554
* Initial plan * Fix signature verification GPG homes on long runner paths * Keep macOS GPG verification homes within socket limits Use /tmp for signature verification on macOS while preserving runner temp behavior elsewhere. Cover long and canonical OS temp paths and regenerate action bundles. Co-authored-by: Copilot App <[email protected]> Copilot-Session: 32d31c8d-ddbc-4e57-a5c3-f70588fef3f3 --------- Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: Bruno Borges <[email protected]> Co-authored-by: Copilot App <[email protected]> Copilot-Session: 32d31c8d-ddbc-4e57-a5c3-f70588fef3f3
* Initial plan * Preserve compound Liberica build versions from release metadata Co-authored-by: brunoborges <[email protected]> --------- Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: brunoborges <[email protected]>
* Document Temurin RISC-V compatibility Co-Authored-By: multicode <[email protected]> * Expose RISC-V as a canonical architecture Co-Authored-By: multicode <[email protected]> * Support Temurin on Linux RISC-V Co-Authored-By: multicode <[email protected]> * Address RISC-V review feedback Co-Authored-By: multicode <[email protected]> * Fix casing for RISC-V architecture in tests Co-authored-by: Copilot Autofix powered by AI <[email protected]> * Update __tests__/java-platform-contract.test.ts --------- Co-authored-by: multicode <[email protected]> Co-authored-by: Copilot Autofix powered by AI <[email protected]>
) * Initial plan * Stop GPG agent before verification home cleanup Co-authored-by: brunoborges <[email protected]> --------- Co-authored-by: copilot-swe-agent[bot] <[email protected]> Co-authored-by: brunoborges <[email protected]>
…tions#1278) Azul reports hotfix releases like 25.0.4.1 as java_version=[25,0,4,1] with openjdk_build_number=1 (SDKMAN '25.0.4+1.1'). Sorting candidates via semver.compareBuild ranked 25.0.4+7 above 25.0.4+1.1, so ranges such as '25' resolved to the older build. Compare java_version, build number and distro_version numerically instead. Fixes: actions#1275 Co-authored-by: Copilot App <[email protected]>
…actions#1279) Accept 4-part versions with build metadata (X.Y.Z.P+B -> X.Y.Z+P.B) and match exact Temurin requests against OpenJDK-derived version keys, since the Adoptium API semver folds the patch into the build number (26.0.2+101) and adds LTS metadata (25.0.4+7.0.LTS). Co-authored-by: Copilot App <[email protected]>
* chore(deps): bump undici from 6.28.0 to 6.29.0 Bumps [undici](https://github.com/nodejs/undici) from 6.28.0 to 6.29.0. - [Release notes](https://github.com/nodejs/undici/releases) - [Commits](nodejs/undici@v6.28.0...v6.29.0) --- updated-dependencies: - dependency-name: undici dependency-version: 6.29.0 dependency-type: indirect ... Signed-off-by: dependabot[bot] <[email protected]> * chore(deps): update generated undici artifacts Co-authored-by: Copilot App <[email protected]> * chore(deps): bump brace-expansion to 5.0.12 to fix high-severity audit Resolves GHSA-q2hr-2g5m-vwhr, GHSA-qhr7-859c-m2p7, GHSA-6j4f-fj2g-mc7p. Regenerates dist/ and updates licensed cache. Co-authored-by: Copilot App <[email protected]> --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Bruno Borges <[email protected]> Co-authored-by: Copilot App <[email protected]>
…ons#1276) * chore(deps): bump the monthly-npm-updates group with 13 updates Bumps the monthly-npm-updates group with 13 updates: | Package | From | To | | --- | --- | --- | | [fast-xml-parser](https://github.com/NaturalIntelligence/fast-xml-parser) | `5.11.0` | `5.11.1` | | [@jest/globals](https://github.com/jestjs/jest/tree/HEAD/packages/jest-globals) | `30.4.1` | `30.5.2` | | [@types/node](https://github.com/DefinitelyTyped/DefinitelyTyped/tree/HEAD/types/node) | `26.2.0` | `26.6.2` | | [@typescript-eslint/eslint-plugin](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/eslint-plugin) | `8.67.0` | `8.70.1` | | [@typescript-eslint/parser](https://github.com/typescript-eslint/typescript-eslint/tree/HEAD/packages/parser) | `8.67.0` | `8.70.1` | | [eslint](https://github.com/eslint/eslint) | `10.8.1` | `10.11.0` | | [eslint-plugin-jest](https://github.com/jest-community/eslint-plugin-jest) | `29.16.1` | `29.16.6` | | [globals](https://github.com/sindresorhus/globals) | `17.11.0` | `17.12.0` | | [jest](https://github.com/jestjs/jest/tree/HEAD/packages/jest) | `30.4.2` | `30.5.2` | | [lint-staged](https://github.com/lint-staged/lint-staged) | `17.3.0` | `17.5.1` | | [prettier](https://github.com/prettier/prettier) | `3.9.6` | `3.9.9` | | [ts-jest](https://github.com/kulshekhar/ts-jest) | `29.4.12` | `29.4.13` | | [typescript](https://github.com/microsoft/TypeScript) | `6.0.3` | `7.0.2` | Updates `fast-xml-parser` from 5.11.0 to 5.11.1 - [Release notes](https://github.com/NaturalIntelligence/fast-xml-parser/releases) - [Changelog](https://github.com/NaturalIntelligence/fast-xml-parser/blob/master/CHANGELOG.md) - [Commits](NaturalIntelligence/fast-xml-parser@v5.11.0...v5.11.1) Updates `@jest/globals` from 30.4.1 to 30.5.2 - [Release notes](https://github.com/jestjs/jest/releases) - [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/jestjs/jest/commits/v30.5.2/packages/jest-globals) Updates `@types/node` from 26.2.0 to 26.6.2 - [Release notes](https://github.com/DefinitelyTyped/DefinitelyTyped/releases) - [Commits](https://github.com/DefinitelyTyped/DefinitelyTyped/commits/HEAD/types/node) Updates `@typescript-eslint/eslint-plugin` from 8.67.0 to 8.70.1 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/eslint-plugin/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.70.1/packages/eslint-plugin) Updates `@typescript-eslint/parser` from 8.67.0 to 8.70.1 - [Release notes](https://github.com/typescript-eslint/typescript-eslint/releases) - [Changelog](https://github.com/typescript-eslint/typescript-eslint/blob/main/packages/parser/CHANGELOG.md) - [Commits](https://github.com/typescript-eslint/typescript-eslint/commits/v8.70.1/packages/parser) Updates `eslint` from 10.8.1 to 10.11.0 - [Release notes](https://github.com/eslint/eslint/releases) - [Commits](eslint/eslint@v10.8.1...v10.11.0) Updates `eslint-plugin-jest` from 29.16.1 to 29.16.6 - [Release notes](https://github.com/jest-community/eslint-plugin-jest/releases) - [Changelog](https://github.com/jest-community/eslint-plugin-jest/blob/main/CHANGELOG.md) - [Commits](jest-community/eslint-plugin-jest@v29.16.1...v29.16.6) Updates `globals` from 17.11.0 to 17.12.0 - [Release notes](https://github.com/sindresorhus/globals/releases) - [Commits](sindresorhus/globals@v17.11.0...v17.12.0) Updates `jest` from 30.4.2 to 30.5.2 - [Release notes](https://github.com/jestjs/jest/releases) - [Changelog](https://github.com/jestjs/jest/blob/main/CHANGELOG.md) - [Commits](https://github.com/jestjs/jest/commits/v30.5.2/packages/jest) Updates `lint-staged` from 17.3.0 to 17.5.1 - [Release notes](https://github.com/lint-staged/lint-staged/releases) - [Changelog](https://github.com/lint-staged/lint-staged/blob/main/CHANGELOG.md) - [Commits](lint-staged/lint-staged@v17.3.0...v17.5.1) Updates `prettier` from 3.9.6 to 3.9.9 - [Release notes](https://github.com/prettier/prettier/releases) - [Changelog](https://github.com/prettier/prettier/blob/main/CHANGELOG.md) - [Commits](prettier/prettier@3.9.6...3.9.9) Updates `ts-jest` from 29.4.12 to 29.4.13 - [Release notes](https://github.com/kulshekhar/ts-jest/releases) - [Changelog](https://github.com/kulshekhar/ts-jest/blob/main/CHANGELOG.md) - [Commits](kulshekhar/ts-jest@v29.4.12...v29.4.13) Updates `typescript` from 6.0.3 to 7.0.2 - [Release notes](https://github.com/microsoft/TypeScript/releases) - [Commits](microsoft/TypeScript@v6.0.3...v7.0.2) --- updated-dependencies: - dependency-name: fast-xml-parser dependency-version: 5.11.1 dependency-type: direct:production update-type: version-update:semver-patch dependency-group: monthly-npm-updates - dependency-name: "@jest/globals" dependency-version: 30.5.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: monthly-npm-updates - dependency-name: "@types/node" dependency-version: 26.6.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: monthly-npm-updates - dependency-name: "@typescript-eslint/eslint-plugin" dependency-version: 8.70.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: monthly-npm-updates - dependency-name: "@typescript-eslint/parser" dependency-version: 8.70.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: monthly-npm-updates - dependency-name: eslint dependency-version: 10.11.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: monthly-npm-updates - dependency-name: eslint-plugin-jest dependency-version: 29.16.6 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: monthly-npm-updates - dependency-name: globals dependency-version: 17.12.0 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: monthly-npm-updates - dependency-name: jest dependency-version: 30.5.2 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: monthly-npm-updates - dependency-name: lint-staged dependency-version: 17.5.1 dependency-type: direct:development update-type: version-update:semver-minor dependency-group: monthly-npm-updates - dependency-name: prettier dependency-version: 3.9.9 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: monthly-npm-updates - dependency-name: ts-jest dependency-version: 29.4.13 dependency-type: direct:development update-type: version-update:semver-patch dependency-group: monthly-npm-updates - dependency-name: typescript dependency-version: 7.0.2 dependency-type: direct:development update-type: version-update:semver-major dependency-group: monthly-npm-updates ... Signed-off-by: dependabot[bot] <[email protected]> * Fix monthly npm update checks Keep TypeScript on the compatible 6.x line for the current @typescript-eslint peer range, rebuild dist, and refresh the fast-xml-parser license cache. Co-authored-by: Copilot App <[email protected]> * Fix monthly npm validation failures Update vulnerable transitive packages in the lockfile, rebuild dist, and correct the JetBrains test expectation for mocked Windows availability. Co-authored-by: Copilot App <[email protected]> * chore: update licensed cache for npm updates Co-authored-by: Copilot App <[email protected]> --------- Signed-off-by: dependabot[bot] <[email protected]> Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com> Co-authored-by: Bruno Borges <[email protected]> Co-authored-by: Copilot App <[email protected]>
* feat: support Maven server credential origins * Refactor origin construction to include port if necessary Co-authored-by: Copilot Autofix powered by AI <[email protected]> * fix: validate Maven server credential origins * docs: note mvn-server-repository-origins requires Maven 3.10+ Co-authored-by: Copilot App <[email protected]> --------- Co-authored-by: Bruno Borges <[email protected]> Co-authored-by: Copilot Autofix powered by AI <[email protected]> Co-authored-by: Bruno Borges <[email protected]> Co-authored-by: Copilot App <[email protected]>
…1286) * Add Maven plugin repository support Generate plugin repositories alongside dependency repositories and share Central inclusion and ordering controls. Cover repository parsing, credentials, explicit Central overrides, plugin ordering, and effective Maven models; document the compatibility change and rebuild runtime bundles. Co-authored-by: Copilot App <[email protected]> Copilot-Session: 52a8a8e2-7965-42d3-88d9-d66f64d0d60d * Fix CI audit by updating Handlebars to 4.7.10 Update the transitive test dependency to the patched release without changing runtime dependencies or suppressing audit checks. Co-authored-by: Copilot <[email protected]> Copilot-Session: 282b173f-7b1d-4fcd-bca4-9c8e2fa72a37 --------- Co-authored-by: Copilot App <[email protected]> Copilot-Session: 52a8a8e2-7965-42d3-88d9-d66f64d0d60d Copilot-Session: 282b173f-7b1d-4fcd-bca4-9c8e2fa72a37
Wiz Scan Summary
To detect these findings earlier in the dev lifecycle, try the Wiz Code extension for VS Code, JetBrains, or Visual Studio. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Sync Upstream Changes
This pull request applies all changes from the upstream repository
actions/setup-javaup to and including commitb843ebf.This ensures that
rmd-actions/setup-javais up to date with the latest changes from upstream.🤖 This pull request was managed through automation. Please do not modify or close this PR manually.