* Isolate Maven signing keys
Import signing keys into an action-owned temporary GPG home, export GNUPGHOME, and remove the owned directory in the post action. Cover import failure, multiple keys and invocations, unrelated keyrings, missing state, and Windows path conversion.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Fix cleanup state assertion
Account for isolated GPG-home cleanup when cache saving is disabled.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Update generated action bundles
Apply repository formatting and commit the setup and cleanup bundles produced by the validated Node 24 build.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address isolated GPG home review feedback
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Bruno Borges <brborges@microsoft.com>
* Fix floating Oracle JDK version resolution
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Update generated distribution bundles
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Harden floating artifact cache identity
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Regenerate setup bundle after cache hardening
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Temporarily enable hosted full validation
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Export hosted formatting results
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Apply repository formatting
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Run hosted validation after formatting
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Correct floating version regression tests
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Remove temporary validation wiring
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Cache checksum-less floating artifacts by their response fingerprint
Oracle and Oracle GraalVM do not always publish a `.sha256` sibling next
to a `/latest/` artifact. Those floating releases were excluded from both
the resolution cache and the JDK cache, so `cache-jdk` users lost caching
entirely for them.
A floating URL is a constant string, so it cannot serve as a cache
identity on its own — a stale entry would be reused forever. Instead,
derive a validator from the headers of the HEAD request that already
resolves the artifact: the ETag when present, otherwise `Last-Modified`
combined with `Content-Length`. Republishing changes the validator, which
changes the cache key, so a new build is downloaded rather than masked.
`getJdkReleaseIdentity` now falls back to that fingerprint before the
URL, and the floating cache gates ask whether the release has a stable
identity (checksum or fingerprint) rather than a checksum specifically. A
floating release with neither is still left uncached.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Bruno Borges <brborges@microsoft.com>
