Cache resolved JDK releases to remove the vendor API from warm jobs (#1208)

* Cache resolved JDK releases to remove the vendor API from warm jobs Only Temurin is preinstalled in the runner tool cache, so for every other distribution `findInToolcache()` misses on essentially every job. That forces a call to the distribution's metadata API before the JDK cache key can even be computed, which makes the vendor a hard per-job dependency even when the JDK bytes are already cached, and turns a vendor 403, 429, or outage into a job failure. Store the resolved release in a small companion cache entry keyed only on inputs known before any network call: runner OS, architecture, distribution, package type, requested version, and stability. A job that finds a current entry installs the JDK without contacting the metadata API at all. `@actions/cache` derives a cache version by hashing the requested paths, so save and restore paths must match. The entry therefore uses a path that excludes the date bucket while the key includes it, which lets restore keys fall back to an older bucket. An entry older than the current day is not used directly: the metadata API is still queried so floating requests such as `java-version: 21` keep picking up new releases, and the older entry is used only when that query fails. Because the entry also carries the download URL and checksum, that fallback works even when the JDK itself is not cached. Releases whose URL is not content-addressed are never stored. Oracle JDK and Oracle GraalVM build a `/latest/` URL for a major-only version, and its bytes change when a new build is published, so the URL and checksum are only consistent at the moment they are resolved. Mark those releases floating and skip recording them. Restored payloads are validated as untrusted input, and the post-job save rewrites the payload the key was computed for rather than uploading whatever is on disk, since a restore in a later step targets the same path. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: b76d8cb0-f629-46e1-bf9a-ffde06948644 * Widen the resolution freshness window from a day to a week A daily window gives no benefit to the repositories that need it most. A repository whose workflows run once a day would re-resolve on every job, and one running weekly would never see a current entry at all, yet those are exactly the repositories with nothing warm in the tool cache. Seven days is also the ceiling. GitHub removes cache entries that have not been accessed for seven days, so a longer window would leave the previous entry evicted by the time the window rolls over, removing the stale fallback at the moment it is most likely to be needed. It comfortably covers JDK release cadence, which is monthly at its fastest and usually quarterly. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: b76d8cb0-f629-46e1-bf9a-ffde06948644 * Potential fix for pull request finding Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Rebuild dist to match the linted source The pre-commit hook runs `eslint --fix` after `npm run check` has already built `dist/`, so the fix it applied to the resolution fallback warning in `base-installer.ts` never reached the bundle. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: b76d8cb0-f629-46e1-bf9a-ffde06948644 * Rebuild dist to match the linted source The autofix accepted on the pull request edited the resolution fallback warning in `base-installer.ts` through the GitHub UI, which does not run `npm run build`, so `dist/` still carried the pre-fix bundle. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: b76d8cb0-f629-46e1-bf9a-ffde06948644 --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Copilot-Session: b76d8cb0-f629-46e1-bf9a-ffde06948644
2026-08-05 17:02:57 +00:00 · 2026-08-04 23:58:03 -04:00
parent ef9440a2b8
commit ab597f914a
17 changed files with 1624 additions and 9 deletions
@@ -0,0 +1,271 @@
+export const id = 348;
+export const ids = [348];
+export const modules = {
+
+/***/ 967:
+/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {
+
+/* harmony export */ __webpack_require__.d(__webpack_exports__, {
+/* harmony export */   registerJdkResolution: () => (/* binding */ registerJdkResolution),
+/* harmony export */   restoreJdkResolution: () => (/* binding */ restoreJdkResolution)
+/* harmony export */ });
+/* unused harmony export saveJdkResolutionCaches */
+/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_0__ = __webpack_require__(6982);
+/* harmony import */ var crypto__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__webpack_require__.n(crypto__WEBPACK_IMPORTED_MODULE_0__);
+/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_1__ = __webpack_require__(9896);
+/* harmony import */ var fs__WEBPACK_IMPORTED_MODULE_1___default = /*#__PURE__*/__webpack_require__.n(fs__WEBPACK_IMPORTED_MODULE_1__);
+/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2__ = __webpack_require__(6928);
+/* harmony import */ var path__WEBPACK_IMPORTED_MODULE_2___default = /*#__PURE__*/__webpack_require__.n(path__WEBPACK_IMPORTED_MODULE_2__);
+/* harmony import */ var _actions_cache__WEBPACK_IMPORTED_MODULE_3__ = __webpack_require__(6971);
+/* harmony import */ var _actions_core__WEBPACK_IMPORTED_MODULE_4__ = __webpack_require__(3838);
+
+
+
+
+
+const STATE_JDK_RESOLUTIONS = 'jdk-resolutions';
+const JDK_RESOLUTION_KEY_VERSION = 1;
+const RESOLUTION_DIRECTORY = 'setup-java-jdk-resolution';
+const RESOLUTION_FILE_NAME = 'release.json';
+const pendingResolutions = [];
+/**
+ * Restores a previously resolved release so a distribution can skip its vendor
+ * metadata API.
+ *
+ * The cache path deliberately excludes the freshness window: `@actions/cache`
+ * derives
+ * a cache version by hashing the requested paths, so a bucket-independent path
+ * is what allows the restore keys to fall back to an older bucket.
+ */
+async function restoreJdkResolution(request) {
+    // Deliberately not `isCacheFeatureAvailable()`: this is an optional
+    // optimization, and the JDK cache already warns once when the service is
+    // unreachable.
+    if (!_actions_cache__WEBPACK_IMPORTED_MODULE_3__/* .isFeatureAvailable */ .w3()) {
+        return undefined;
+    }
+    const cachePath = getResolutionCachePath(request);
+    if (!cachePath) {
+        return undefined;
+    }
+    const keyPrefix = getResolutionKeyPrefix(request);
+    const primaryKey = `${keyPrefix}${getFreshnessBucket()}`;
+    let matchedKey;
+    try {
+        matchedKey = await _actions_cache__WEBPACK_IMPORTED_MODULE_3__/* .restoreCache */ .P3([cachePath], primaryKey, [keyPrefix]);
+    }
+    catch (error) {
+        _actions_core__WEBPACK_IMPORTED_MODULE_4__/* .debug */ .Yz(`Failed to restore the JDK resolution cache: ${getErrorMessage(error)}`);
+        return undefined;
+    }
+    if (!matchedKey) {
+        return undefined;
+    }
+    let release;
+    try {
+        const contents = fs__WEBPACK_IMPORTED_MODULE_1___default().readFileSync(path__WEBPACK_IMPORTED_MODULE_2___default().join(cachePath, RESOLUTION_FILE_NAME), 'utf8');
+        release = parseResolvedRelease(contents);
+    }
+    catch (error) {
+        _actions_core__WEBPACK_IMPORTED_MODULE_4__/* .debug */ .Yz(`Ignoring the JDK resolution cache entry ${matchedKey}: ${getErrorMessage(error)}`);
+        return undefined;
+    }
+    return { release, fresh: matchedKey === primaryKey };
+}
+/**
+ * Persists a freshly resolved release for later jobs. The entry is written to
+ * disk immediately and uploaded by the post-job step.
+ */
+function registerJdkResolution(request, release) {
+    if (!_actions_cache__WEBPACK_IMPORTED_MODULE_3__/* .isFeatureAvailable */ .w3()) {
+        return;
+    }
+    const cachePath = getResolutionCachePath(request);
+    if (!cachePath) {
+        return;
+    }
+    const payload = JSON.stringify(release);
+    try {
+        fs__WEBPACK_IMPORTED_MODULE_1___default().mkdirSync(cachePath, { recursive: true });
+        fs__WEBPACK_IMPORTED_MODULE_1___default().writeFileSync(path__WEBPACK_IMPORTED_MODULE_2___default().join(cachePath, RESOLUTION_FILE_NAME), payload);
+    }
+    catch (error) {
+        _actions_core__WEBPACK_IMPORTED_MODULE_4__/* .debug */ .Yz(`Failed to record the JDK resolution cache entry: ${getErrorMessage(error)}`);
+        return;
+    }
+    const key = `${getResolutionKeyPrefix(request)}${getFreshnessBucket()}`;
+    if (!pendingResolutions.some(item => item.key === key)) {
+        pendingResolutions.push({ key, path: cachePath, release: payload });
+    }
+    _actions_core__WEBPACK_IMPORTED_MODULE_4__/* .saveState */ .LZ(STATE_JDK_RESOLUTIONS, JSON.stringify(pendingResolutions));
+}
+async function saveJdkResolutionCaches() {
+    const state = core.getState(STATE_JDK_RESOLUTIONS);
+    if (!state) {
+        return;
+    }
+    let resolutions;
+    try {
+        resolutions = parseJdkResolutionState(state);
+    }
+    catch (error) {
+        core.debug(`Invalid JDK resolution cache state, not saving: ${getErrorMessage(error)}`);
+        return;
+    }
+    for (const resolution of resolutions) {
+        // A restore performed by a later step overwrites this path, so the payload
+        // the key was computed for is written again rather than trusted to still be
+        // on disk.
+        try {
+            fs.mkdirSync(resolution.path, { recursive: true });
+            fs.writeFileSync(path.join(resolution.path, RESOLUTION_FILE_NAME), resolution.release);
+        }
+        catch (error) {
+            core.debug(`Failed to write the JDK resolution cache entry for the key ${resolution.key}: ${getErrorMessage(error)}`);
+            continue;
+        }
+        try {
+            await cache.saveCache([resolution.path], resolution.key);
+        }
+        catch (error) {
+            // A matrix of jobs resolving the same JDK races on the same daily key, so
+            // an already-reserved key is the expected outcome rather than a problem.
+            core.debug(`Failed to save the JDK resolution cache with the key ${resolution.key}: ${getErrorMessage(error)}`);
+        }
+    }
+}
+function getResolutionCachePath(request) {
+    const runnerTemp = process.env['RUNNER_TEMP'];
+    if (!runnerTemp) {
+        return undefined;
+    }
+    return path__WEBPACK_IMPORTED_MODULE_2___default().join(runnerTemp, RESOLUTION_DIRECTORY, getResolutionIdentity(request));
+}
+function getResolutionIdentity(request) {
+    const identity = JSON.stringify({
+        keyVersion: JDK_RESOLUTION_KEY_VERSION,
+        runnerOs: getRunnerOs(),
+        distribution: request.distribution.toLowerCase(),
+        packageType: request.packageType.toLowerCase(),
+        architecture: request.architecture.toLowerCase(),
+        versionSpec: request.versionSpec,
+        stable: request.stable
+    });
+    return (0,crypto__WEBPACK_IMPORTED_MODULE_0__.createHash)('sha256').update(identity).digest('hex');
+}
+function getResolutionKeyPrefix(request) {
+    const architecture = request.architecture.toLowerCase();
+    const digest = getResolutionIdentity(request);
+    return `setup-java-jdkres-v${JDK_RESOLUTION_KEY_VERSION}-${getRunnerOs()}-${architecture}-${digest}-`;
+}
+function getRunnerOs() {
+    return process.env['RUNNER_OS'] ?? process.platform;
+}
+/**
+ * Start of the seven-day window the entry was resolved in, which bounds how long
+ * a floating version spec such as `21` can keep resolving to an already known
+ * release.
+ *
+ * Seven days is the longest usable window: GitHub evicts cache entries that have
+ * not been accessed for seven days, so a longer one would mean the previous
+ * entry is already gone when the window rolls over, taking the stale-fallback
+ * path with it. It also comfortably covers the real release cadence, which is
+ * monthly at its fastest and usually quarterly.
+ */
+function getFreshnessBucket() {
+    const week = 7 * 24 * 60 * 60 * 1000;
+    return new Date(Math.floor(Date.now() / week) * week)
+        .toISOString()
+        .slice(0, 10);
+}
+/**
+ * The restored payload drives a download, so it is validated as untrusted input
+ * rather than trusted because it came back from the cache service.
+ */
+function parseResolvedRelease(contents) {
+    const value = JSON.parse(contents);
+    if (typeof value !== 'object' || value === null) {
+        throw new Error('The cached resolution is not an object.');
+    }
+    const candidate = value;
+    const version = candidate['version'];
+    const url = candidate['url'];
+    const signatureUrl = candidate['signatureUrl'];
+    if (typeof version !== 'string' || !version) {
+        throw new Error('The cached resolution has no version.');
+    }
+    assertHttpsUrl(url, 'url');
+    if (signatureUrl !== undefined) {
+        assertHttpsUrl(signatureUrl, 'signatureUrl');
+    }
+    const release = {
+        version,
+        url: url
+    };
+    if (signatureUrl !== undefined) {
+        release.signatureUrl = signatureUrl;
+    }
+    const checksum = candidate['checksum'];
+    if (checksum !== undefined) {
+        release.checksum = parseChecksum(checksum);
+    }
+    return release;
+}
+function parseChecksum(value) {
+    if (typeof value !== 'object' || value === null) {
+        throw new Error('The cached checksum is not an object.');
+    }
+    const candidate = value;
+    const algorithm = candidate['algorithm'];
+    const checksumValue = candidate['value'];
+    const source = candidate['source'];
+    if (algorithm !== 'sha256' && algorithm !== 'sha512') {
+        throw new Error(`Unsupported cached checksum algorithm: ${algorithm}`);
+    }
+    if (typeof checksumValue !== 'string' || !checksumValue) {
+        throw new Error('The cached checksum has no value.');
+    }
+    if (source !== undefined && typeof source !== 'string') {
+        throw new Error('The cached checksum source is not a string.');
+    }
+    const checksum = { algorithm, value: checksumValue };
+    if (source !== undefined) {
+        checksum.source = source;
+    }
+    return checksum;
+}
+function assertHttpsUrl(value, field) {
+    if (typeof value !== 'string' || !value) {
+        throw new Error(`The cached resolution has no ${field}.`);
+    }
+    let parsed;
+    try {
+        parsed = new URL(value);
+    }
+    catch {
+        throw new Error(`The cached resolution has a malformed ${field}.`);
+    }
+    if (parsed.protocol !== 'https:') {
+        throw new Error(`The cached resolution ${field} does not use HTTPS: ${parsed.protocol}`);
+    }
+}
+function parseJdkResolutionState(state) {
+    const value = JSON.parse(state);
+    if (!Array.isArray(value) ||
+        !value.every(item => typeof item === 'object' &&
+            item !== null &&
+            typeof item.key === 'string' &&
+            typeof item.path === 'string' &&
+            typeof item.release === 'string')) {
+        throw new Error('Invalid JDK resolution information retrieved from state.');
+    }
+    return value;
+}
+function getErrorMessage(error) {
+    return error instanceof Error ? error.message : String(error);
+}
+
+
+/***/ })
+
+};