Report concrete versions for floating Oracle JDK downloads (#1213)

* Fix floating Oracle JDK version resolution Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Update generated distribution bundles Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Harden floating artifact cache identity Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Regenerate setup bundle after cache hardening Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Temporarily enable hosted full validation Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Export hosted formatting results Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Apply repository formatting Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Run hosted validation after formatting Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Correct floating version regression tests Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Remove temporary validation wiring Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Cache checksum-less floating artifacts by their response fingerprint Oracle and Oracle GraalVM do not always publish a `.sha256` sibling next to a `/latest/` artifact. Those floating releases were excluded from both the resolution cache and the JDK cache, so `cache-jdk` users lost caching entirely for them. A floating URL is a constant string, so it cannot serve as a cache identity on its own — a stale entry would be reused forever. Instead, derive a validator from the headers of the HEAD request that already resolves the artifact: the ETag when present, otherwise `Last-Modified` combined with `Content-Length`. Republishing changes the validator, which changes the cache key, so a new build is downloaded rather than masked. `getJdkReleaseIdentity` now falls back to that fingerprint before the URL, and the floating cache gates ask whether the release has a stable identity (checksum or fingerprint) rather than a checksum specifically. A floating release with neither is still left uncached. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>
2026-08-18 11:42:51 +00:00 · 2026-08-05 11:57:27 -04:00
parent ab597f914a
commit f4bfb3ddea
20 changed files with 1037 additions and 66 deletions
@@ -173,33 +173,34 @@ export abstract class JavaBase {
    }

    let foundJava = this.forceDownload ? null : this.findInToolcache();
-    if (foundJava && !this.checkLatest && !this.latest) {
+    if (
+      foundJava &&
+      !this.checkLatest &&
+      !this.latest &&
+      !this.requiresRemoteResolution()
+    ) {
      core.info(`Resolved Java ${foundJava.version} from tool-cache`);
    } else {
      core.info('Trying to resolve the latest version from remote');
      try {
-        const javaRelease = await this.resolveJavaRelease();
+        let javaRelease = await this.resolveJavaRelease();
        core.info(`Resolved latest version as ${javaRelease.version}`);
+        if (javaRelease.floating) {
+          // A tool-cache entry has no source identity. Even when its concrete
+          // version matches, only the checksum-bound JDK cache can prove that
+          // it contains the bytes currently served by the mutable URL.
+          foundJava = null;
+        }
        if (!this.forceDownload && foundJava?.version === javaRelease.version) {
          core.info(`Resolved Java ${foundJava.version} from tool-cache`);
        } else {
-          let jdkCache: JdkCache | undefined;
-          if (this.cacheJdk) {
-            const {getJdkVerificationIdentity} =
-              await import('../jdk-cache.js');
-            jdkCache = {
-              distribution: this.distribution,
-              packageType: this.packageType,
-              architecture: this.architecture,
-              version: javaRelease.version,
-              source: this.getJdkReleaseIdentity(javaRelease),
-              verification: getJdkVerificationIdentity(
-                this.verifySignature,
-                this.verifySignaturePublicKey
-              ),
-              path: this.getJdkCachePath(javaRelease.version)
-            };
-          }
+          let jdkCache =
+            this.cacheJdk &&
+            (!javaRelease.floating ||
+              (this.hasStableReleaseIdentity(javaRelease) &&
+                semver.valid(javaRelease.version)))
+              ? await this.createJdkCache(javaRelease)
+              : undefined;
          if (!this.forceDownload && jdkCache) {
            const {restoreJdk} = await import('../jdk-cache.js');
            const restored = await restoreJdk(jdkCache);
@@ -217,6 +218,22 @@ export abstract class JavaBase {
            core.info('Trying to download...');
            foundJava = await this.downloadTool(javaRelease);
            core.info(`Java ${foundJava.version} was downloaded`);
+            if (javaRelease.floating) {
+              if (
+                !semver.valid(foundJava.version) ||
+                !isVersionSatisfies(this.version, foundJava.version)
+              ) {
+                throw new Error(
+                  `The downloaded ${this.distribution} artifact reported Java ${foundJava.version}, which does not satisfy '${this.version}'.`
+                );
+              }
+              javaRelease = {...javaRelease, version: foundJava.version};
+              await this.registerFloatingResolution(javaRelease);
+              jdkCache =
+                this.cacheJdk && this.hasStableReleaseIdentity(javaRelease)
+                  ? await this.createJdkCache(javaRelease)
+                  : undefined;
+            }
            if (jdkCache) {
              // Register after the installation exists so its identity is
              // captured; the post-job save refuses to upload a path whose
@@ -272,9 +289,11 @@ export abstract class JavaBase {
      !this.cacheJdk ||
      this.checkLatest ||
      this.latest ||
-      this.forceDownload
+      this.forceDownload ||
+      this.requiresRemoteResolution()
    ) {
-      return this.findPackageForDownload(this.version);
+      const release = await this.findPackageForDownload(this.version);
+      return this.restoreFloatingResolution(release);
    }

    const {restoreJdkResolution, registerJdkResolution} =
@@ -300,7 +319,7 @@ export abstract class JavaBase {
      if (!javaRelease.floating) {
        registerJdkResolution(request, javaRelease);
      }
-      return javaRelease;
+      return this.restoreFloatingResolution(javaRelease);
    } catch (error) {
      if (!restored) {
        throw error;
@@ -317,6 +336,92 @@ export abstract class JavaBase {
    }
  }

+  protected requiresRemoteResolution(): boolean {
+    return false;
+  }
+
+  private async createJdkCache(
+    javaRelease: JavaDownloadRelease
+  ): Promise<JdkCache> {
+    const {getJdkVerificationIdentity} = await import('../jdk-cache.js');
+    return {
+      distribution: this.distribution,
+      packageType: this.packageType,
+      architecture: this.architecture,
+      version: javaRelease.version,
+      source: this.getJdkReleaseIdentity(javaRelease),
+      verification: getJdkVerificationIdentity(
+        this.verifySignature,
+        this.verifySignaturePublicKey
+      ),
+      path: this.getJdkCachePath(javaRelease.version)
+    };
+  }
+
+  private async restoreFloatingResolution(
+    javaRelease: JavaDownloadRelease
+  ): Promise<JavaDownloadRelease> {
+    if (
+      !javaRelease.floating ||
+      !this.hasStableReleaseIdentity(javaRelease) ||
+      !this.cacheJdk ||
+      this.forceDownload
+    ) {
+      return javaRelease;
+    }
+
+    const {restoreJdkResolution} = await import('../jdk-resolution-cache.js');
+    const restored = await restoreJdkResolution(
+      this.getFloatingResolutionRequest(javaRelease)
+    );
+    if (!restored) {
+      return javaRelease;
+    }
+    if (
+      !semver.valid(restored.release.version) ||
+      !isVersionSatisfies(this.version, restored.release.version)
+    ) {
+      core.debug(
+        `Ignoring the cached concrete version '${restored.release.version}' for ${this.distribution} ${this.version}.`
+      );
+      return javaRelease;
+    }
+
+    core.info(
+      `Resolved ${this.distribution} ${restored.release.version} for the current floating artifact`
+    );
+    return {...javaRelease, version: restored.release.version};
+  }
+
+  private async registerFloatingResolution(
+    javaRelease: JavaDownloadRelease
+  ): Promise<void> {
+    if (
+      !this.hasStableReleaseIdentity(javaRelease) ||
+      !this.cacheJdk ||
+      this.forceDownload
+    ) {
+      return;
+    }
+
+    const {registerJdkResolution} = await import('../jdk-resolution-cache.js');
+    registerJdkResolution(
+      this.getFloatingResolutionRequest(javaRelease),
+      javaRelease
+    );
+  }
+
+  private getFloatingResolutionRequest(javaRelease: JavaDownloadRelease) {
+    return {
+      distribution: this.distribution,
+      packageType: this.packageType,
+      architecture: this.architecture,
+      versionSpec: this.version,
+      stable: this.stable,
+      source: this.getJdkReleaseIdentity(javaRelease)
+    };
+  }
+
  private logSetupError(error: any): void {
    const httpStatusCode =
      error instanceof tc.HTTPError
@@ -430,6 +535,9 @@ export abstract class JavaBase {
    if (javaRelease.checksum) {
      return `${javaRelease.checksum.algorithm}:${javaRelease.checksum.value}`;
    }
+    if (javaRelease.fingerprint) {
+      return javaRelease.fingerprint;
+    }
    try {
      const url = new URL(javaRelease.url);
      return `${url.origin}${url.pathname}`;
@@ -438,6 +546,16 @@ export abstract class JavaBase {
    }
  }

+  /**
+   * Whether the release identity pins the exact bytes behind `url`. A floating
+   * URL is a constant string, so it only becomes a safe cache identity once a
+   * checksum or a response validator distinguishes one published build from the
+   * next.
+   */
+  private hasStableReleaseIdentity(javaRelease: JavaDownloadRelease): boolean {
+    return Boolean(javaRelease.checksum ?? javaRelease.fingerprint);
+  }
+
  protected findInToolcache(): JavaInstallerResults | null {
    // we can't use tc.find directly because firstly, we need to filter versions by stability flag
    // if *-ea is provided, take only ea versions from toolcache, otherwise - only stable versions
@@ -35,4 +35,12 @@ export interface JavaDownloadRelease {
   * be reused by a later job.
   */
  floating?: boolean;
+  /**
+   * Validator identifying the exact bytes a mutable `url` currently serves,
+   * derived from the response headers of the HEAD request that resolved it.
+   * Used as the cache identity for a floating release when the vendor
+   * publishes no checksum, so that a republished artifact produces a different
+   * identity instead of being masked by the constant URL.
+   */
+  fingerprint?: string;
 }
@@ -14,8 +14,10 @@ import {
  cacheJdkDir,
  convertVersionToSemver,
  extractJdkFile,
+  getArtifactFingerprint,
  getDownloadArchiveExtension,
  getGitHubHttpHeaders,
+  getJavaVersionFromReleaseFile,
  getLatestMajorVersion,
  getNextPageUrlFromLinkHeader,
  isVersionSatisfies,
@@ -95,7 +97,10 @@ export class GraalVMDistribution extends JavaBase {
      }

      const archivePath = path.join(extractedJavaPath, dirContents[0]);
-      const version = this.getToolcacheVersionName(javaRelease.version);
+      const installedVersion = javaRelease.floating
+        ? getJavaVersionFromReleaseFile(archivePath)
+        : javaRelease.version;
+      const version = this.getToolcacheVersionName(installedVersion);

      const javaPath = await cacheJdkDir(
        archivePath,
@@ -104,13 +109,21 @@ export class GraalVMDistribution extends JavaBase {
        this.architecture
      );

-      return {version: javaRelease.version, path: javaPath};
+      return {version: installedVersion, path: javaPath};
    } catch (error) {
      core.error(`Failed to download and extract GraalVM: ${error}`);
      throw error;
    }
  }

+  protected requiresRemoteResolution(): boolean {
+    return (
+      this.distribution === 'GraalVM' &&
+      this.stable &&
+      !this.version.includes('.')
+    );
+  }
+
  protected setJavaDefault(version: string, toolPath: string): void {
    super.setJavaDefault(version, toolPath);
    core.exportVariable('GRAALVM_HOME', toolPath);
@@ -146,13 +159,18 @@ export class GraalVMDistribution extends JavaBase {
    const response = await this.http.head(fileUrl);
    this.handleHttpResponse(response, range);

+    // A major-only range resolves to the vendor's `/latest/` path, whose
+    // contents change when a new build is published.
+    const floating = !range.includes('.');
+
    return {
      url: fileUrl,
      version: range,
      checksum: await this.fetchChecksum(`${fileUrl}.sha256`, 'sha256'),
-      // A major-only range resolves to the vendor's `/latest/` path, whose
-      // contents change when a new build is published.
-      floating: !range.includes('.')
+      floating,
+      fingerprint: floating
+        ? getArtifactFingerprint(response.message.headers)
+        : undefined
    };
  }

@@ -12,7 +12,9 @@ import {
 import {
  cacheJdkDir,
  extractJdkFile,
+  getArtifactFingerprint,
  getDownloadArchiveExtension,
+  getJavaVersionFromReleaseFile,
  getLatestMajorVersion,
  renameWinArchive
 } from '../../util.js';
@@ -43,7 +45,10 @@ export class OracleDistribution extends JavaBase {

    const archiveName = fs.readdirSync(extractedJavaPath)[0];
    const archivePath = path.join(extractedJavaPath, archiveName);
-    const version = this.getToolcacheVersionName(javaRelease.version);
+    const installedVersion = javaRelease.floating
+      ? getJavaVersionFromReleaseFile(archivePath)
+      : javaRelease.version;
+    const version = this.getToolcacheVersionName(installedVersion);

    const javaPath = await cacheJdkDir(
      archivePath,
@@ -52,7 +57,11 @@ export class OracleDistribution extends JavaBase {
      this.architecture
    );

-    return {version: javaRelease.version, path: javaPath};
+    return {version: installedVersion, path: javaPath};
+  }
+
+  protected requiresRemoteResolution(): boolean {
+    return this.stable && !this.version.includes('.');
  }

  protected async findPackageForDownload(
@@ -113,11 +122,15 @@ export class OracleDistribution extends JavaBase {
      const response = await this.http.head(url);

      if (response.message.statusCode === HttpCodes.OK) {
+        const floating = url === floatingUrl;
        return {
          url,
          version: range,
          checksum: await this.fetchChecksum(`${url}.sha256`, 'sha256'),
-          floating: url === floatingUrl
+          floating,
+          fingerprint: floating
+            ? getArtifactFingerprint(response.message.headers)
+            : undefined
        };
      }

@@ -25,6 +25,12 @@ export interface JdkResolutionRequest {
  architecture: string;
  versionSpec: string;
  stable: boolean;
+  /**
+   * Immutable identity of a remotely resolved artifact. When present, even an
+   * older cache bucket is safe to reuse because changed bytes produce a
+   * different request identity.
+   */
+  source?: string;
 }

 export interface RestoredJdkResolution {
@@ -210,7 +216,8 @@ function getResolutionIdentity(request: JdkResolutionRequest): string {
    packageType: request.packageType.toLowerCase(),
    architecture: request.architecture.toLowerCase(),
    versionSpec: request.versionSpec,
-    stable: request.stable
+    stable: request.stable,
+    source: request.source
  });
  return createHash('sha256').update(identity).digest('hex');
 }
@@ -257,6 +264,7 @@ function parseResolvedRelease(contents: string): JavaDownloadRelease {
  const version = candidate['version'];
  const url = candidate['url'];
  const signatureUrl = candidate['signatureUrl'];
+  const floating = candidate['floating'];

  if (typeof version !== 'string' || !version) {
    throw new Error('The cached resolution has no version.');
@@ -265,6 +273,9 @@ function parseResolvedRelease(contents: string): JavaDownloadRelease {
  if (signatureUrl !== undefined) {
    assertHttpsUrl(signatureUrl, 'signatureUrl');
  }
+  if (floating !== undefined && typeof floating !== 'boolean') {
+    throw new Error('The cached resolution has an invalid floating flag.');
+  }

  const release: JavaDownloadRelease = {
    version,
@@ -273,6 +284,9 @@ function parseResolvedRelease(contents: string): JavaDownloadRelease {
  if (signatureUrl !== undefined) {
    release.signatureUrl = signatureUrl as string;
  }
+  if (floating !== undefined) {
+    release.floating = floating as boolean;
+  }

  const checksum = candidate['checksum'];
  if (checksum !== undefined) {
@@ -14,7 +14,7 @@ import {
  DISTRIBUTIONS_ONLY_MAJOR_VERSION,
  INPUT_CACHE_JDK
 } from './constants.js';
-import {OutgoingHttpHeaders} from 'http';
+import {IncomingHttpHeaders, OutgoingHttpHeaders} from 'http';

 export function getTempDir() {
  const tempDirectory = process.env['RUNNER_TEMP'] || os.tmpdir();
@@ -192,6 +192,59 @@ export async function cacheJdkDir(
  return await tc.cacheDir(sourceDir, toolName, version, architecture);
 }

+export function getJavaVersionFromReleaseFile(javaHome: string): string {
+  const releasePaths = [
+    path.join(javaHome, 'release'),
+    path.join(javaHome, 'Contents', 'Home', 'release')
+  ];
+  const releasePath = releasePaths.find(candidate => fs.existsSync(candidate));
+  if (!releasePath) {
+    throw new Error(
+      `Unable to determine the installed Java version: no release file found under '${javaHome}'.`
+    );
+  }
+
+  const properties = new Map<string, string>();
+  for (const line of fs.readFileSync(releasePath, 'utf8').split(/\r?\n/)) {
+    const match = line.match(/^([A-Z0-9_]+)="(.*)"$/);
+    if (match) {
+      properties.set(match[1], match[2]);
+    }
+  }
+
+  const runtimeVersion = properties.get('JAVA_RUNTIME_VERSION');
+  const runtimeMatch = runtimeVersion?.match(
+    /^(\d+(?:\.\d+)*(?:\+\d+(?:\.\d+)*)?)/
+  );
+  if (runtimeMatch) {
+    return normalizeJavaReleaseVersion(runtimeMatch[1]);
+  }
+
+  const javaVersion = properties.get('JAVA_VERSION');
+  if (javaVersion && /^\d+(?:\.\d+)*$/.test(javaVersion)) {
+    return normalizeJavaReleaseVersion(javaVersion);
+  }
+
+  throw new Error(
+    `Unable to determine the installed Java version from '${releasePath}'.`
+  );
+}
+
+function normalizeJavaReleaseVersion(version: string): string {
+  const [numericVersion, buildVersion] = version.split('+', 2);
+  const components = numericVersion.split('.');
+  while (components.length < 3) {
+    components.push('0');
+  }
+
+  const mainVersion = components.slice(0, 3).join('.');
+  const build = [
+    ...components.slice(3),
+    ...(buildVersion ? [buildVersion] : [])
+  ];
+  return build.length > 0 ? `${mainVersion}+${build.join('.')}` : mainVersion;
+}
+
 function getToolcacheDestination(
  toolName: string,
  version: string,
@@ -453,6 +506,44 @@ export function convertVersionToSemver(version: number[] | string) {
  return mainVersion;
 }

+/**
+ * Builds a validator for the bytes currently served by a URL from the response
+ * headers of a HEAD request. A vendor's `/latest/` URL never changes, so this
+ * is what lets a republished artifact be told apart from the previous one when
+ * no checksum is published alongside it.
+ *
+ * Returns `undefined` when the response carries no usable validator, in which
+ * case the caller must not treat the URL as a stable identity.
+ */
+export function getArtifactFingerprint(
+  headers: IncomingHttpHeaders | undefined
+): string | undefined {
+  const readHeader = (name: string): string | undefined => {
+    const value = headers?.[name];
+    const resolved = Array.isArray(value) ? value[0] : value;
+    return typeof resolved === 'string' && resolved.trim()
+      ? resolved.trim()
+      : undefined;
+  };
+
+  // A strong or weak ETag already identifies a specific representation.
+  const etag = readHeader('etag');
+  if (etag) {
+    return `etag:${etag}`;
+  }
+
+  // Otherwise combine the two validators a static file server reliably sends.
+  // Neither alone is sufficient: `last-modified` has one-second granularity and
+  // `content-length` is unchanged by a same-size rebuild.
+  const lastModified = readHeader('last-modified');
+  const contentLength = readHeader('content-length');
+  if (lastModified && contentLength) {
+    return `mtime:${lastModified};length:${contentLength}`;
+  }
+
+  return undefined;
+}
+
 export function getGitHubHttpHeaders(): OutgoingHttpHeaders {
  const resolvedToken = core.getInput('token') || process.env.GITHUB_TOKEN;
  const auth = !resolvedToken ? undefined : `token ${resolvedToken}`;