Report concrete versions for floating Oracle JDK downloads (#1213)

* Fix floating Oracle JDK version resolution

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Update generated distribution bundles

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Harden floating artifact cache identity

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Regenerate setup bundle after cache hardening

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Temporarily enable hosted full validation

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Export hosted formatting results

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Apply repository formatting

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Run hosted validation after formatting

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Correct floating version regression tests

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Remove temporary validation wiring

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

* Cache checksum-less floating artifacts by their response fingerprint

Oracle and Oracle GraalVM do not always publish a `.sha256` sibling next
to a `/latest/` artifact. Those floating releases were excluded from both
the resolution cache and the JDK cache, so `cache-jdk` users lost caching
entirely for them.

A floating URL is a constant string, so it cannot serve as a cache
identity on its own — a stale entry would be reused forever. Instead,
derive a validator from the headers of the HEAD request that already
resolves the artifact: the ETag when present, otherwise `Last-Modified`
combined with `Content-Length`. Republishing changes the validator, which
changes the cache key, so a new build is downloaded rather than masked.

`getJdkReleaseIdentity` now falls back to that fingerprint before the
URL, and the floating cache gates ask whether the release has a stable
identity (checksum or fingerprint) rather than a checksum specifically. A
floating release with neither is still left uncached.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

---------

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Bruno Borges <brborges@microsoft.com>

src/distributions/graalvm/installer.ts

@@ -14,8 +14,10 @@ import {
   cacheJdkDir,
   convertVersionToSemver,
   extractJdkFile,
+  getArtifactFingerprint,
   getDownloadArchiveExtension,
   getGitHubHttpHeaders,
+  getJavaVersionFromReleaseFile,
   getLatestMajorVersion,
   getNextPageUrlFromLinkHeader,
   isVersionSatisfies,
@@ -95,7 +97,10 @@ export class GraalVMDistribution extends JavaBase {
       }
 
       const archivePath = path.join(extractedJavaPath, dirContents[0]);
-      const version = this.getToolcacheVersionName(javaRelease.version);
+      const installedVersion = javaRelease.floating
+        ? getJavaVersionFromReleaseFile(archivePath)
+        : javaRelease.version;
+      const version = this.getToolcacheVersionName(installedVersion);
 
       const javaPath = await cacheJdkDir(
         archivePath,
@@ -104,13 +109,21 @@ export class GraalVMDistribution extends JavaBase {
         this.architecture
       );
 
-      return {version: javaRelease.version, path: javaPath};
+      return {version: installedVersion, path: javaPath};
     } catch (error) {
       core.error(`Failed to download and extract GraalVM: ${error}`);
       throw error;
     }
   }
 
+  protected requiresRemoteResolution(): boolean {
+    return (
+      this.distribution === 'GraalVM' &&
+      this.stable &&
+      !this.version.includes('.')
+    );
+  }
+
   protected setJavaDefault(version: string, toolPath: string): void {
     super.setJavaDefault(version, toolPath);
     core.exportVariable('GRAALVM_HOME', toolPath);
@@ -146,13 +159,18 @@ export class GraalVMDistribution extends JavaBase {
     const response = await this.http.head(fileUrl);
     this.handleHttpResponse(response, range);
 
+    // A major-only range resolves to the vendor's `/latest/` path, whose
+    // contents change when a new build is published.
+    const floating = !range.includes('.');
+
     return {
       url: fileUrl,
       version: range,
       checksum: await this.fetchChecksum(`${fileUrl}.sha256`, 'sha256'),
-      // A major-only range resolves to the vendor's `/latest/` path, whose
-      // contents change when a new build is published.
-      floating: !range.includes('.')
+      floating,
+      fingerprint: floating
+        ? getArtifactFingerprint(response.message.headers)
+        : undefined
     };
   }