docs: update setup-java examples (#1131)

* docs: update setup-java examples

* docs: fix YAML example indentation

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 190c65c4-f5aa-4595-8e2e-26266fbcb37f

* docs: note v6 development status

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: 190c65c4-f5aa-4595-8e2e-26266fbcb37f

---------

Co-authored-by: Bruno Borges <brborges@microsoft.com>

.eslintignore

@@ -1,6 +0,0 @@
-# Ignore list
-/*
-
-# Do not ignore these folders:
-!__tests__/
-!src/

.eslintrc.js

@@ -1,51 +0,0 @@
-// This is a reusable configuration file copied from https://github.com/actions/reusable-workflows/tree/main/reusable-configurations. Please don't make changes to this file as it's the subject of an automatic update.
-module.exports = {
-  extends: [
-    'eslint:recommended',
-    'plugin:@typescript-eslint/recommended',
-    'plugin:eslint-plugin-jest/recommended',
-    'eslint-config-prettier'
-  ],
-  parser: '@typescript-eslint/parser',
-  plugins: ['@typescript-eslint', 'eslint-plugin-node', 'eslint-plugin-jest'],
-  rules: {
-    '@typescript-eslint/no-require-imports': 'error',
-    '@typescript-eslint/no-non-null-assertion': 'off',
-    '@typescript-eslint/no-explicit-any': 'off',
-    '@typescript-eslint/no-empty-function': 'off',
-    '@typescript-eslint/ban-ts-comment': [
-      'error',
-      {
-        'ts-ignore': 'allow-with-description'
-      }
-    ],
-    'no-console': 'error',
-    'yoda': 'error',
-    'prefer-const': [
-      'error',
-      {
-        destructuring: 'all'
-      }
-    ],
-    'no-control-regex': 'off',
-    'no-constant-condition': ['error', {checkLoops: false}],
-    'node/no-extraneous-import': 'error'
-  },
-  overrides: [
-    {
-      files: ['**/*{test,spec}.ts'],
-      rules: {
-        '@typescript-eslint/no-unused-vars': 'off',
-        'jest/no-standalone-expect': 'off',
-        'jest/no-conditional-expect': 'off',
-        'no-console': 'off',
-
-      }
-    }
-  ],
-  env: {
-    node: true,
-    es6: true,
-    'jest/globals': true
-  }
-};

.github/workflows/e2e-cache-dependency-path.yml

@@ -1,102 +0,0 @@
-name: Validate cache with cache-dependency-path option
-
-on:
-  push:
-    branches:
-      - main
-      - releases/*
-    paths-ignore:
-      - '**.md'
-  pull_request:
-    paths-ignore:
-      - '**.md'
-
-permissions:
-  contents: read
-
-defaults:
-  run:
-    shell: bash
-
-jobs:
-  gradle1-save:
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [macos-latest, windows-latest, ubuntu-latest]
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - name: Run setup-java with the cache for gradle
-        uses: ./
-        id: setup-java
-        with:
-          distribution: 'adopt'
-          java-version: '17'
-          cache: gradle
-          cache-dependency-path: __tests__/cache/gradle1/*.gradle*
-      - name: Create files to cache
-        # Need to avoid using Gradle daemon to stabilize the save process on Windows
-        # https://github.com/actions/cache/issues/454#issuecomment-840493935
-        run: |
-          gradle downloadDependencies --no-daemon -p __tests__/cache/gradle1
-          if [ ! -d ~/.gradle/caches ]; then
-            echo "::error::The ~/.gradle/caches directory does not exist unexpectedly"
-            exit 1
-          fi
-  gradle1-restore:
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [macos-latest, windows-latest, ubuntu-latest]
-    needs: gradle1-save
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - name: Run setup-java with the cache for gradle
-        uses: ./
-        id: setup-java
-        with:
-          distribution: 'adopt'
-          java-version: '11'
-          cache: gradle
-          cache-dependency-path: __tests__/cache/gradle1/*.gradle*
-      - name: Confirm that ~/.gradle/caches directory has been made
-        run: |
-          if [ ! -d ~/.gradle/caches ]; then
-            echo "::error::The ~/.gradle/caches directory does not exist unexpectedly"
-            exit 1
-          fi
-          ls ~/.gradle/caches/
-  gradle2-restore:
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [macos-latest, windows-latest, ubuntu-latest]
-    needs: gradle1-save
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - name: Run setup-java with the cache for gradle
-        uses: ./
-        id: setup-java
-        with:
-          distribution: 'adopt'
-          java-version: '11'
-          cache: gradle
-          cache-dependency-path: __tests__/cache/gradle2/*.gradle*
-      - name: Confirm that ~/.gradle/caches directory has not been made
-        run: |
-          if [ -d ~/.gradle/caches ]; then
-            echo "::error::The ~/.gradle/caches directory exists unexpectedly"
-            exit 1
-          fi

.github/workflows/e2e-cache.yml

@@ -42,10 +42,7 @@ jobs:
         # https://github.com/actions/cache/issues/454#issuecomment-840493935
         run: |
           gradle downloadDependencies --no-daemon -p __tests__/cache/gradle1
-          if [ ! -d ~/.gradle/caches ]; then
+          bash __tests__/check-dir.sh "$HOME/.gradle/caches"
-            echo "::error::The ~/.gradle/caches directory does not exist unexpectedly"
-            exit 1
-          fi
   gradle-restore:
     runs-on: ${{ matrix.os }}
     strategy:
@@ -66,12 +63,7 @@ jobs:
           java-version: '11'
           cache: gradle
       - name: Confirm that ~/.gradle/caches directory has been made
-        run: |
+        run: bash __tests__/check-dir.sh "$HOME/.gradle/caches"
-          if [ ! -d ~/.gradle/caches ]; then
-            echo "::error::The ~/.gradle/caches directory does not exist unexpectedly"
-            exit 1
-          fi
-          ls ~/.gradle/caches/
   maven-save:
     runs-on: ${{ matrix.os }}
     strategy:
@@ -93,10 +85,7 @@ jobs:
       - name: Create files to cache
         run: |
           mvn verify -f __tests__/cache/maven/pom.xml
-          if [ ! -d ~/.m2/repository ]; then
+          bash __tests__/check-dir.sh "$HOME/.m2/repository"
-            echo "::error::The ~/.m2/repository directory does not exist unexpectedly"
-            exit 1
-          fi
   maven-restore:
     runs-on: ${{ matrix.os }}
     strategy:
@@ -117,12 +106,7 @@ jobs:
           java-version: '11'
           cache: maven
       - name: Confirm that ~/.m2/repository directory has been made
-        run: |
+        run: bash __tests__/check-dir.sh "$HOME/.m2/repository"
-          if [ ! -d ~/.m2/repository ]; then
-            echo "::error::The ~/.m2/repository directory does not exist unexpectedly"
-            exit 1
-          fi
-          ls ~/.m2/repository
   sbt-save:
     runs-on: ${{ matrix.os }}
     defaults:
@@ -155,25 +139,13 @@ jobs:
 
       - name: Check files to cache on macos-latest
         if: matrix.os == 'macos-15-intel'
-        run: |
+        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/Library/Caches/Coursier"
-          if [ ! -d ~/Library/Caches/Coursier ]; then
-            echo "::error::The ~/Library/Caches/Coursier directory does not exist unexpectedly"
-            exit 1
-          fi
       - name: Check files to cache on windows-latest
         if: matrix.os == 'windows-latest'
-        run: |
+        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/AppData/Local/Coursier/Cache"
-          if [ ! -d ~/AppData/Local/Coursier/Cache ]; then
-            echo "::error::The ~/AppData/Local/Coursier/Cache directory does not exist unexpectedly"
-            exit 1
-          fi
       - name: Check files to cache on ubuntu-latest
-        if: matrix.os == 'ubuntu-latest'
+        if: matrix.os == 'ubuntu-22.04'
-        run: |
+        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/.cache/coursier"
-          if [ ! -d ~/.cache/coursier ]; then
-            echo "::error::The ~/.cache/coursier directory does not exist unexpectedly"
-            exit 1
-          fi
   sbt-restore:
     runs-on: ${{ matrix.os }}
     defaults:
@@ -200,25 +172,254 @@ jobs:
 
       - name: Confirm that ~/Library/Caches/Coursier directory has been made
         if: matrix.os == 'macos-15-intel'
-        run: |
+        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/Library/Caches/Coursier"
-          if [ ! -d ~/Library/Caches/Coursier ]; then
-            echo "::error::The ~/Library/Caches/Coursier directory does not exist unexpectedly"
-            exit 1
-          fi
-          ls ~/Library/Caches/Coursier
       - name: Confirm that ~/AppData/Local/Coursier/Cache directory has been made
         if: matrix.os == 'windows-latest'
-        run: |
+        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/AppData/Local/Coursier/Cache"
-          if [ ! -d ~/AppData/Local/Coursier/Cache ]; then
-            echo "::error::The ~/AppData/Local/Coursier/Cache directory does not exist unexpectedly"
-            exit 1
-          fi
-          ls ~/AppData/Local/Coursier/Cache
       - name: Confirm that ~/.cache/coursier directory has been made
-        if: matrix.os == 'ubuntu-latest'
+        if: matrix.os == 'ubuntu-22.04'
+        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/.cache/coursier"
+  gradle1-save:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, windows-latest, ubuntu-latest]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Run setup-java with the cache for gradle
+        uses: ./
+        id: setup-java
+        with:
+          distribution: 'adopt'
+          java-version: '17'
+          cache: gradle
+          cache-dependency-path: __tests__/cache/gradle1/*.gradle*
+      - name: Create files to cache
+        # Need to avoid using Gradle daemon to stabilize the save process on Windows
+        # https://github.com/actions/cache/issues/454#issuecomment-840493935
         run: |
-          if [ ! -d ~/.cache/coursier ]; then
+          gradle downloadDependencies --no-daemon -p __tests__/cache/gradle1
-            echo "::error::The ~/.cache/coursier directory does not exist unexpectedly"
+          bash __tests__/check-dir.sh "$HOME/.gradle/caches"
-            exit 1
+  gradle1-restore:
-          fi
+    runs-on: ${{ matrix.os }}
-          ls ~/.cache/coursier
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, windows-latest, ubuntu-latest]
+    needs: gradle1-save
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Run setup-java with the cache for gradle
+        uses: ./
+        id: setup-java
+        with:
+          distribution: 'adopt'
+          java-version: '11'
+          cache: gradle
+          cache-dependency-path: __tests__/cache/gradle1/*.gradle*
+      - name: Confirm that ~/.gradle/caches directory has been made
+        run: bash __tests__/check-dir.sh "$HOME/.gradle/caches"
+  gradle2-restore:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, windows-latest, ubuntu-latest]
+    needs: gradle1-save
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Run setup-java with the cache for gradle
+        uses: ./
+        id: setup-java
+        with:
+          distribution: 'adopt'
+          java-version: '11'
+          cache: gradle
+          cache-dependency-path: __tests__/cache/gradle2/*.gradle*
+      - name: Confirm that ~/.gradle/caches directory has not been made
+        run: bash __tests__/check-dir.sh "$HOME/.gradle/caches" absent
+  maven1-save:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-15-intel, windows-latest, ubuntu-latest]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Run setup-java with the cache for maven
+        uses: ./
+        id: setup-java
+        with:
+          distribution: 'adopt'
+          java-version: '11'
+          cache: maven
+          cache-dependency-path: __tests__/cache/maven/pom.xml
+      - name: Create files to cache
+        run: |
+          mvn verify -f __tests__/cache/maven/pom.xml
+          bash __tests__/check-dir.sh "$HOME/.m2/repository"
+  maven1-restore:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-15-intel, windows-latest, ubuntu-latest]
+    needs: maven1-save
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Run setup-java with the cache for maven
+        uses: ./
+        id: setup-java
+        with:
+          distribution: 'adopt'
+          java-version: '11'
+          cache: maven
+          cache-dependency-path: __tests__/cache/maven/pom.xml
+      - name: Confirm that ~/.m2/repository directory has been made
+        run: bash __tests__/check-dir.sh "$HOME/.m2/repository"
+  maven2-restore:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-15-intel, windows-latest, ubuntu-latest]
+    needs: maven1-save
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Run setup-java with the cache for maven
+        uses: ./
+        id: setup-java
+        with:
+          distribution: 'adopt'
+          java-version: '11'
+          cache: maven
+          cache-dependency-path: __tests__/cache/maven2/pom.xml
+      - name: Confirm that ~/.m2/repository directory has not been made
+        run: bash __tests__/check-dir.sh "$HOME/.m2/repository" absent
+  sbt1-save:
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: bash
+        working-directory: __tests__/cache/sbt
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-15-intel, windows-latest, ubuntu-22.04]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Run setup-java with the cache for sbt
+        uses: ./
+        id: setup-java
+        with:
+          distribution: 'adopt'
+          java-version: '11'
+          cache: sbt
+          cache-dependency-path: __tests__/cache/sbt/*.sbt
+      - name: Setup SBT
+        if: matrix.os == 'macos-15-intel'
+        run: |
+          echo ""Installing SBT...""
+          brew install sbt
+      - name: Create files to cache
+        run: sbt update
+
+      - name: Check files to cache on macos-latest
+        if: matrix.os == 'macos-15-intel'
+        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/Library/Caches/Coursier"
+      - name: Check files to cache on windows-latest
+        if: matrix.os == 'windows-latest'
+        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/AppData/Local/Coursier/Cache"
+      - name: Check files to cache on ubuntu-latest
+        if: matrix.os == 'ubuntu-22.04'
+        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/.cache/coursier"
+  sbt1-restore:
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: bash
+        working-directory: __tests__/cache/sbt
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-15-intel, windows-latest, ubuntu-22.04]
+    needs: sbt1-save
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Run setup-java with the cache for sbt
+        uses: ./
+        id: setup-java
+        with:
+          distribution: 'adopt'
+          java-version: '11'
+          cache: sbt
+          cache-dependency-path: __tests__/cache/sbt/*.sbt
+
+      - name: Confirm that ~/Library/Caches/Coursier directory has been made
+        if: matrix.os == 'macos-15-intel'
+        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/Library/Caches/Coursier"
+      - name: Confirm that ~/AppData/Local/Coursier/Cache directory has been made
+        if: matrix.os == 'windows-latest'
+        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/AppData/Local/Coursier/Cache"
+      - name: Confirm that ~/.cache/coursier directory has been made
+        if: matrix.os == 'ubuntu-22.04'
+        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/.cache/coursier"
+  sbt2-restore:
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: bash
+        working-directory: __tests__/cache/sbt2
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-15-intel, windows-latest, ubuntu-22.04]
+    needs: sbt1-save
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Run setup-java with the cache for sbt
+        uses: ./
+        id: setup-java
+        with:
+          distribution: 'adopt'
+          java-version: '11'
+          cache: sbt
+          cache-dependency-path: __tests__/cache/sbt2/*.sbt
+
+      - name: Confirm that ~/Library/Caches/Coursier directory has not been made
+        if: matrix.os == 'macos-15-intel'
+        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/Library/Caches/Coursier" absent
+      - name: Confirm that ~/AppData/Local/Coursier/Cache directory has not been made
+        if: matrix.os == 'windows-latest'
+        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/AppData/Local/Coursier/Cache" absent
+      - name: Confirm that ~/.cache/coursier directory has not been made
+        if: matrix.os == 'ubuntu-22.04'
+        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/.cache/coursier" absent

.github/workflows/e2e-publishing.yml

@@ -46,13 +46,25 @@ jobs:
           $xmlPath = Join-Path $HOME ".m2" "settings.xml"
           Get-Content $xmlPath | ForEach-Object { Write-Host $_ }
 
-          [xml]$xml = Get-Content $xmlPath
+          $content = [System.IO.File]::ReadAllText($xmlPath)
-          $servers = $xml.settings.servers.server
+          $expected = @(
-          if (($servers[0].id -ne 'maven') -or ($servers[0].username -ne '${env.MAVEN_USERNAME}') -or ($servers[0].password -ne '${env.MAVEN_CENTRAL_TOKEN}')) {
+            '<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"'
-            throw "Generated XML file is incorrect"
+            '  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"'
-          }
+            '  xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 https://maven.apache.org/xsd/settings-1.0.0.xsd">'
+            '  <interactiveMode>false</interactiveMode>'
+            '  <servers>'
+            '    <server>'
+            '      <id>maven</id>'
+            '      <username>${env.MAVEN_USERNAME}</username>'
+            '      <password>${env.MAVEN_CENTRAL_TOKEN}</password>'
+            '    </server>'
+            '  </servers>'
+            '</settings>'
+          ) -join "`n"
 
-          if (($servers[1].id -ne 'gpg.passphrase') -or ($servers[1].passphrase -ne '${env.MAVEN_GPG_PASSPHRASE}')) {
+          if ($content -ne $expected) {
+            Write-Host "Expected settings.xml:"
+            $expected -split "`n" | ForEach-Object { Write-Host $_ }
             throw "Generated XML file is incorrect"
           }
 

.github/workflows/e2e-versions.yml

@@ -37,7 +37,8 @@ jobs:
             'dragonwell',
             'sapmachine',
             'jetbrains',
-            'kona'
+            'kona',
+            'liberica-nik'
           ] # internally 'adopt-hotspot' is the same as 'adopt'
         version: ['21', '11', '17']
         exclude:
@@ -64,6 +65,15 @@ jobs:
           - distribution: kona
             os: macos-latest
             version: 25
+          - distribution: liberica-nik
+            os: windows-latest
+            version: 25
+          - distribution: liberica-nik
+            os: ubuntu-latest
+            version: 25
+          - distribution: liberica-nik
+            os: macos-latest
+            version: 25
           - distribution: oracle
             os: macos-15-intel
             version: 17
@@ -86,7 +96,8 @@ jobs:
             os: ubuntu-latest
             version: '24-ea'
     steps:
-      - name: Checkout
+      - &checkout_step
+        name: Checkout
         uses: actions/checkout@v7
         with:
           persist-credentials: false
@@ -117,10 +128,7 @@ jobs:
         distribution: ['temurin', 'sapmachine']
         version: ['21', '17']
     steps:
-      - name: Checkout
+      - *checkout_step
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
       - name: Install bash
         run: apk add --no-cache bash
       - name: setup-java
@@ -143,7 +151,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-latest, windows-latest, ubuntu-latest]
+        os: &default_os [macos-latest, windows-latest, ubuntu-latest]
         distribution: ['temurin', 'zulu', 'liberica']
         version:
           - '11.0'
@@ -172,10 +180,7 @@ jobs:
             os: ubuntu-latest
             version: '17.0.7'
     steps:
-      - name: Checkout
+      - *checkout_step
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
       - name: setup-java
         uses: ./
         id: setup-java
@@ -197,7 +202,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-latest, windows-latest, ubuntu-latest]
+        os: *default_os
         distribution:
           [
             'temurin',
@@ -211,10 +216,7 @@ jobs:
           - distribution: dragonwell
             os: macos-latest
     steps:
-      - name: Checkout
+      - *checkout_step
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
       - name: setup-java
         uses: ./
         id: setup-java
@@ -237,7 +239,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-latest, windows-latest, ubuntu-latest]
+        os: *default_os
         distribution:
           [
             'temurin',
@@ -251,10 +253,7 @@ jobs:
           - distribution: dragonwell
             os: macos-latest
     steps:
-      - name: Checkout
+      - *checkout_step
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
       - name: setup-java
         uses: ./
         id: setup-java
@@ -284,26 +283,37 @@ jobs:
         run: bash __tests__/verify-java.sh "17" "$JAVA_PATH"
         shell: bash
 
-  setup-java-ea-versions-zulu:
+  setup-java-ea-versions:
-    name: zulu ${{ matrix.version }} (jdk-${{ contains(matrix.os, 'macos') && !contains(matrix.os, 'intel') && 'arm64' || 'x64' }}) - ${{ matrix.os }}
+    name: ${{ matrix.distribution }} ${{ matrix.version }} (jdk-${{ contains(matrix.os, 'macos') && !contains(matrix.os, 'intel') && 'arm64' || 'x64' }}) - ${{ matrix.os }}
     needs: setup-java-major-minor-versions
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-15-intel, windows-latest, ubuntu-latest]
+        include:
-        version: ['17-ea', '15.0.0-ea.14']
+          - {os: macos-15-intel, version: '17-ea', distribution: zulu}
+          - {os: windows-latest, version: '17-ea', distribution: zulu}
+          - {os: ubuntu-latest, version: '17-ea', distribution: zulu}
+          - {os: macos-15-intel, version: '15.0.0-ea.14', distribution: zulu}
+          - {os: windows-latest, version: '15.0.0-ea.14', distribution: zulu}
+          - {os: ubuntu-latest, version: '15.0.0-ea.14', distribution: zulu}
+          - {os: macos-latest, version: '17-ea', distribution: temurin}
+          - {os: windows-latest, version: '17-ea', distribution: temurin}
+          - {os: ubuntu-latest, version: '17-ea', distribution: temurin}
+          - {os: macos-latest, version: '17-ea', distribution: sapmachine}
+          - {os: windows-latest, version: '17-ea', distribution: sapmachine}
+          - {os: ubuntu-latest, version: '17-ea', distribution: sapmachine}
+          - {os: macos-latest, version: '21-ea', distribution: sapmachine}
+          - {os: windows-latest, version: '21-ea', distribution: sapmachine}
+          - {os: ubuntu-latest, version: '21-ea', distribution: sapmachine}
     steps:
-      - name: Checkout
+      - *checkout_step
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
       - name: setup-java
         uses: ./
         id: setup-java
         with:
           java-version: ${{ matrix.version }}
-          distribution: zulu
+          distribution: ${{ matrix.distribution }}
       - name: Verify Java
         env:
           JAVA_VERSION: ${{ matrix.version }}
@@ -311,53 +321,24 @@ jobs:
         run: bash __tests__/verify-java.sh "$JAVA_VERSION" "$JAVA_PATH"
         shell: bash
 
-  setup-java-ea-versions-temurin:
+  setup-java-signature-verification:
-    name: temurin ${{ matrix.version }} (jdk-${{ contains(matrix.os, 'macos') && !contains(matrix.os, 'intel') && 'arm64' || 'x64' }}) - ${{ matrix.os }}
+    name: ${{ matrix.distribution }} ${{ matrix.version }} signature verification - ${{ matrix.os }}
     needs: setup-java-major-minor-versions
     runs-on: ${{ matrix.os }}
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-latest, windows-latest, ubuntu-latest]
+        os: *default_os
-        version: ['17-ea']
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - name: setup-java
-        uses: ./
-        id: setup-java
-        with:
-          java-version: ${{ matrix.version }}
-          distribution: temurin
-      - name: Verify Java
-        env:
-          JAVA_VERSION: ${{ matrix.version }}
-          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
-        run: bash __tests__/verify-java.sh "$JAVA_VERSION" "$JAVA_PATH"
-        shell: bash
-
-  setup-java-temurin-signature-verification:
-    name: temurin ${{ matrix.version }} signature verification - ${{ matrix.os }}
-    needs: setup-java-major-minor-versions
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [macos-latest, windows-latest, ubuntu-latest]
         version: ['21', '17']
+        distribution: [temurin, microsoft]
     steps:
-      - name: Checkout
+      - *checkout_step
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
       - name: setup-java with signature verification
         uses: ./
         id: setup-java
         with:
           java-version: ${{ matrix.version }}
-          distribution: temurin
+          distribution: ${{ matrix.distribution }}
           verify-signature: true
       - name: Verify Java
         env:
@@ -366,61 +347,6 @@ jobs:
         run: bash __tests__/verify-java.sh "$JAVA_VERSION" "$JAVA_PATH"
         shell: bash
 
-  setup-java-microsoft-signature-verification:
-    name: microsoft ${{ matrix.version }} signature verification - ${{ matrix.os }}
-    needs: setup-java-major-minor-versions
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [macos-latest, windows-latest, ubuntu-latest]
-        version: ['21', '17']
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - name: setup-java with signature verification
-        uses: ./
-        id: setup-java
-        with:
-          java-version: ${{ matrix.version }}
-          distribution: microsoft
-          verify-signature: true
-      - name: Verify Java
-        env:
-          JAVA_VERSION: ${{ matrix.version }}
-          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
-        run: bash __tests__/verify-java.sh "$JAVA_VERSION" "$JAVA_PATH"
-        shell: bash
-
-  setup-java-ea-versions-sapmachine:
-    name: sapmachine ${{ matrix.version }} (jdk-${{ contains(matrix.os, 'macos') && !contains(matrix.os, 'intel') && 'arm64' || 'x64' }}) - ${{ matrix.os }}
-    needs: setup-java-major-minor-versions
-    runs-on: ${{ matrix.os }}
-    strategy:
-      fail-fast: false
-      matrix:
-        os: [macos-latest, windows-latest, ubuntu-latest]
-        version: ['17-ea', '21-ea']
-    steps:
-      - name: Checkout
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
-      - name: setup-java
-        uses: ./
-        id: setup-java
-        with:
-          java-version: ${{ matrix.version }}
-          distribution: sapmachine
-      - name: Verify Java
-        env:
-          JAVA_VERSION: ${{ matrix.version }}
-          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
-        run: bash __tests__/verify-java.sh "$JAVA_VERSION" "$JAVA_PATH"
-        shell: bash
-
   setup-java-custom-package-type:
     name: ${{ matrix.distribution }} ${{ matrix.version }} (${{ matrix.java-package }}-x64) - ${{ matrix.os }}
     needs: setup-java-major-minor-versions
@@ -450,6 +376,10 @@ jobs:
             java-package: jre+fx
             version: '11'
             os: ubuntu-latest
+          - distribution: 'liberica-nik'
+            java-package: jdk+fx
+            version: '21'
+            os: ubuntu-latest
           - distribution: 'corretto'
             java-package: jre
             version: '8'
@@ -496,10 +426,7 @@ jobs:
             os: ubuntu-latest
 
     steps:
-      - name: Checkout
+      - *checkout_step
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
       - name: setup-java
         uses: ./
         id: setup-java
@@ -529,10 +456,7 @@ jobs:
         distribution: ['liberica', 'zulu', 'corretto']
         version: ['11']
     steps:
-      - name: Checkout
+      - *checkout_step
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
       - name: setup-java
         uses: ./
         id: setup-java
@@ -553,14 +477,11 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-latest, windows-latest, ubuntu-latest]
+        os: *default_os
         distribution: ['temurin', 'microsoft', 'corretto']
         java-version-file: ['.java-version', '.tool-versions']
     steps:
-      - name: Checkout
+      - *checkout_step
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
       - name: Create .java-version file
         shell: bash
         run: echo "17" > .java-version
@@ -586,14 +507,11 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-latest, windows-latest, ubuntu-latest]
+        os: *default_os
         distribution: ['temurin', 'zulu', 'liberica', 'microsoft', 'corretto']
         java-version-file: ['.java-version', '.tool-versions']
     steps:
-      - name: Checkout
+      - *checkout_step
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
       - name: Create .java-version file
         shell: bash
         run: echo "11" > .java-version
@@ -618,14 +536,11 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-latest, windows-latest, ubuntu-latest]
+        os: *default_os
         distribution: ['adopt', 'adopt-openj9', 'zulu']
         java-version-file: ['.java-version', '.tool-versions']
     steps:
-      - name: Checkout
+      - *checkout_step
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
       - name: Create .java-version file
         shell: bash
         run: echo "17.0.10" > .java-version
@@ -650,14 +565,11 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-latest, windows-latest, ubuntu-latest]
+        os: *default_os
         distribution: ['adopt', 'zulu', 'liberica']
         java-version-file: ['.java-version', '.tool-versions', '.sdkmanrc']
     steps:
-      - name: Checkout
+      - *checkout_step
-        uses: actions/checkout@v7
-        with:
-          persist-credentials: false
       - name: Create .java-version file
         shell: bash
         run: echo "openjdk64-17.0.10" > .java-version
@@ -686,10 +598,9 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-latest, windows-latest, ubuntu-latest]
+        os: *default_os
     steps:
-      - name: Checkout
+      - *checkout_step
-        uses: actions/checkout@v6
       - name: Setup Java 17 as default
         uses: ./
         id: setup-java-17
@@ -708,10 +619,12 @@ jobs:
         env:
           GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
       - name: Verify JAVA_HOME still points to Java 17
+        env:
+          JAVA_17_PATH: ${{ steps.setup-java-17.outputs.path }}
         run: |
           echo "JAVA_HOME=$JAVA_HOME"
-          echo "Java 17 path=${{ steps.setup-java-17.outputs.path }}"
+          echo "Java 17 path=$JAVA_17_PATH"
-          if [ "$JAVA_HOME" != "${{ steps.setup-java-17.outputs.path }}" ]; then
+          if [ "$JAVA_HOME" != "$JAVA_17_PATH" ]; then
             echo "JAVA_HOME should still point to Java 17"
             exit 1
           fi
@@ -740,14 +653,17 @@ jobs:
           Write-Host "$envName=$JavaVersionPath"
         shell: pwsh
       - name: Verify Java 21 outputs are set
+        env:
+          JAVA_21_PATH: ${{ steps.setup-java-21.outputs.path }}
+          JAVA_21_VERSION: ${{ steps.setup-java-21.outputs.version }}
         run: |
-          echo "Java 21 path=${{ steps.setup-java-21.outputs.path }}"
+          echo "Java 21 path=$JAVA_21_PATH"
-          echo "Java 21 version=${{ steps.setup-java-21.outputs.version }}"
+          echo "Java 21 version=$JAVA_21_VERSION"
-          if [ -z "${{ steps.setup-java-21.outputs.path }}" ]; then
+          if [ -z "$JAVA_21_PATH" ]; then
             echo "Java 21 path output should be set"
             exit 1
           fi
-          if [ -z "${{ steps.setup-java-21.outputs.version }}" ]; then
+          if [ -z "$JAVA_21_VERSION" ]; then
             echo "Java 21 version output should be set"
             exit 1
           fi

.licensed.yml

@@ -10,8 +10,11 @@ allowed:
   - mit
   - cc0-1.0
   - unlicense
+  - blueoak-1.0.0
 
 reviewed:
   npm:
     - "@actions/http-client" # MIT (license text present), but detected as "other"
     - "argparse" # Python Software Foundation License (PSF), but detected as "other"
+    - "balanced-match"
+    - "brace-expansion"

.licenses/npm/@actions/cache.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/cache"
-version: 5.1.0
+version: 6.2.0
 type: npm
 summary: Actions cache lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/cache

.licenses/npm/@actions/core.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/core"
-version: 2.0.3
+version: 3.0.1
 type: npm
 summary: Actions core lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/core

.licenses/npm/@actions/exec.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/exec"
-version: 2.0.0
+version: 3.0.0
 type: npm
 summary: Actions exec lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/exec

.licenses/npm/@actions/glob-0.6.1.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/glob"
-version: 0.5.1
+version: 0.6.1
 type: npm
 summary: Actions glob lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/glob

.licenses/npm/@actions/glob-0.7.0.dep.yml

@@ -0,0 +1,20 @@
+---
+name: "@actions/glob"
+version: 0.7.0
+type: npm
+summary: Actions glob lib
+homepage: https://github.com/actions/toolkit/tree/main/packages/glob
+license: mit
+licenses:
+- sources: LICENSE.md
+  text: |-
+    The MIT License (MIT)
+
+    Copyright 2019 GitHub
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy of this software and associated documentation files (the "Software"), to deal in the Software without restriction, including without limitation the rights to use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies of the Software, and to permit persons to whom the Software is furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY, FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM, OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE SOFTWARE.
+notices: []

.licenses/npm/@actions/http-client.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/http-client"
-version: 3.0.2
+version: 4.0.1
 type: npm
 summary: Actions Http Client
 homepage: https://github.com/actions/toolkit/tree/main/packages/http-client

.licenses/npm/@actions/io.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/io"
-version: 2.0.0
+version: 3.0.2
 type: npm
 summary: Actions io lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/io

.licenses/npm/@actions/tool-cache.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@actions/tool-cache"
-version: 3.0.1
+version: 4.0.0
 type: npm
 summary: Actions tool-cache lib
 homepage: https://github.com/actions/toolkit/tree/main/packages/tool-cache

.licenses/npm/@azure/core-client.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@azure/core-client"
-version: 1.10.1
+version: 1.10.2
 type: npm
 summary: Core library for interfacing with AutoRest generated code
 homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/core/core-client/

.licenses/npm/@azure/core-http-compat.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@azure/core-http-compat"
-version: 2.3.1
+version: 2.4.0
 type: npm
 summary: Core HTTP Compatibility Library to bridge the gap between Core V1 & V2 packages.
 homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/core/core-compat/

.licenses/npm/@azure/core-rest-pipeline.dep.yml

@@ -1,9 +1,9 @@
 ---
 name: "@azure/core-rest-pipeline"
-version: 1.22.2
+version: 1.24.0
 type: npm
 summary: Isomorphic client library for making HTTP requests in node.js and browser.
-homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/core/core-rest-pipeline/
+homepage: https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/core/core-rest-pipeline/README.md
 license: mit
 licenses:
 - sources: LICENSE

.licenses/npm/@azure/core-xml.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: "@azure/core-xml"
-version: 1.5.0
+version: 1.5.1
 type: npm
 summary: Core library for interacting with XML payloads
 homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/core/core-xml/

.licenses/npm/@azure/storage-blob.dep.yml

@@ -1,9 +1,9 @@
 ---
 name: "@azure/storage-blob"
-version: 12.29.1
+version: 12.33.0
 type: npm
 summary: Microsoft Azure Storage SDK for JavaScript - Blob
-homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/storage/storage-blob/
+homepage: https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/storage/storage-blob/README.md
 license: mit
 licenses:
 - sources: LICENSE

.licenses/npm/@azure/storage-common.dep.yml

@@ -1,9 +1,9 @@
 ---
 name: "@azure/storage-common"
-version: 12.1.1
+version: 12.4.1
 type: npm
 summary: Azure Storage Common Client Library for JavaScript
-homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/storage/storage-internal-avro/
+homepage: https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/storage/storage-common/README.md
 license: mit
 licenses:
 - sources: LICENSE

.licenses/npm/@typespec/ts-http-runtime.dep.yml

@@ -1,9 +1,9 @@
 ---
 name: "@typespec/ts-http-runtime"
-version: 0.3.2
+version: 0.3.6
 type: npm
 summary: Isomorphic client library for making HTTP requests in node.js and browser.
-homepage: https://github.com/Azure/azure-sdk-for-js/blob/main/sdk/core/ts-http-runtime/
+homepage: https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/core/ts-http-runtime/README.md
 license: mit
 licenses:
 - sources: LICENSE

.licenses/npm/anynum.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: anynum
-version: 1.0.0
+version: 1.0.1
 type: npm
 summary: Normalize all Unicode decimal digits (Devanagari, Arabic, Thai, etc.) to
   ASCII numerals. Zero dependencies, performance-first.
@@ -30,4 +30,6 @@ licenses:
     LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
     OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
     SOFTWARE.
+- sources: README.md
+  text: MIT
 notices: []

.licenses/npm/balanced-match-4.0.4.dep.yml

@@ -0,0 +1,34 @@
+---
+name: balanced-match
+version: 4.0.4
+type: npm
+summary: Match balanced character pairs, like "{" and "}"
+homepage:
+license: other
+licenses:
+- sources: LICENSE.md
+  text: |
+    (MIT)
+
+    Original code Copyright Julian Gruber <julian@juliangruber.com>
+
+    Port to TypeScript Copyright Isaac Z. Schlueter <i@izs.me>
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy of
+    this software and associated documentation files (the "Software"), to deal in
+    the Software without restriction, including without limitation the rights to
+    use, copy, modify, merge, publish, distribute, sublicense, and/or sell copies
+    of the Software, and to permit persons to whom the Software is furnished to do
+    so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+notices: []

.licenses/npm/brace-expansion-1.1.15.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: brace-expansion
-version: 1.1.13
+version: 1.1.15
 type: npm
 summary: Brace expansion as known from sh/bash
 homepage: https://github.com/juliangruber/brace-expansion

.licenses/npm/brace-expansion-5.0.7.dep.yml

@@ -0,0 +1,34 @@
+---
+name: brace-expansion
+version: 5.0.7
+type: npm
+summary: Brace expansion as known from sh/bash
+homepage:
+license: other
+licenses:
+- sources: LICENSE
+  text: |
+    MIT License
+
+    Copyright Julian Gruber <julian@juliangruber.com>
+
+    TypeScript port Copyright Isaac Z. Schlueter <i@izs.me>
+
+    Permission is hereby granted, free of charge, to any person obtaining a copy
+    of this software and associated documentation files (the "Software"), to deal
+    in the Software without restriction, including without limitation the rights
+    to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+    copies of the Software, and to permit persons to whom the Software is
+    furnished to do so, subject to the following conditions:
+
+    The above copyright notice and this permission notice shall be included in all
+    copies or substantial portions of the Software.
+
+    THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+    IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+    FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+    AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+    LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+    OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+    SOFTWARE.
+notices: []

.licenses/npm/fast-xml-builder.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: fast-xml-builder
-version: 1.2.0
+version: 1.2.1
 type: npm
 summary: Build XML from JSON without C/C++ based libraries
 homepage:

.licenses/npm/fast-xml-parser.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: fast-xml-parser
-version: 5.8.0
+version: 5.9.3
 type: npm
 summary: Validate XML, Parse XML, Build XML without C/C++ based libraries
 homepage:

.licenses/npm/is-unsafe.dep.yml

@@ -1,16 +1,17 @@
 ---
-name: "@azure/abort-controller"
+name: is-unsafe
-version: 1.1.0
+version: 1.0.1
 type: npm
-summary: Microsoft Azure SDK for JavaScript - Aborter
+summary: Zero-dependency, DOM-free, pure predicate for detecting unsafe strings across
-homepage: https://github.com/Azure/azure-sdk-for-js/tree/main/sdk/core/abort-controller/README.md
+  HTML, XML, SVG, SQL, SHELL, and REGEX contexts
+homepage:
 license: mit
 licenses:
 - sources: LICENSE
   text: |
-    The MIT License (MIT)
+    MIT License
 
-    Copyright (c) 2020 Microsoft
+    Copyright (c) 2026 Natural Intelligence
 
     Permission is hereby granted, free of charge, to any person obtaining a copy
     of this software and associated documentation files (the "Software"), to deal
@@ -29,4 +30,6 @@ licenses:
     LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
     OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
     SOFTWARE.
+- sources: README.md
+  text: MIT
 notices: []

.licenses/npm/js-yaml.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: js-yaml
-version: 4.1.1
+version: 4.3.0
 type: npm
 summary: YAML 1.2 parser and serializer
 homepage:

.licenses/npm/minimatch-10.2.5.dep.yml

@@ -0,0 +1,66 @@
+---
+name: minimatch
+version: 10.2.5
+type: npm
+summary: a glob matcher in javascript
+homepage:
+license: blueoak-1.0.0
+licenses:
+- sources: LICENSE.md
+  text: |
+    # Blue Oak Model License
+
+    Version 1.0.0
+
+    ## Purpose
+
+    This license gives everyone as much permission to work with
+    this software as possible, while protecting contributors
+    from liability.
+
+    ## Acceptance
+
+    In order to receive this license, you must agree to its
+    rules. The rules of this license are both obligations
+    under that agreement and conditions to your license.
+    You must not do anything with this software that triggers
+    a rule that you cannot or will not follow.
+
+    ## Copyright
+
+    Each contributor licenses you to do everything with this
+    software that would otherwise infringe that contributor's
+    copyright in it.
+
+    ## Notices
+
+    You must ensure that everyone who gets a copy of
+    any part of this software from you, with or without
+    changes, also gets the text of this license or a link to
+    <https://blueoakcouncil.org/license/1.0.0>.
+
+    ## Excuse
+
+    If anyone notifies you in writing that you have not
+    complied with [Notices](#notices), you can keep your
+    license by taking all practical steps to comply within 30
+    days after the notice. If you do not do so, your license
+    ends immediately.
+
+    ## Patent
+
+    Each contributor licenses you to do everything with this
+    software that would otherwise infringe any patent claims
+    they can license or become able to license.
+
+    ## Reliability
+
+    No contributor can revoke this license.
+
+    ## No Liability
+
+    **_As far as the law allows, this software comes as is,
+    without any warranty or condition, and no contributor
+    will be liable to anyone for any damages related to this
+    software or this license, under any kind of legal claim._**
+notices: []

.licenses/npm/path-expression-matcher.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: path-expression-matcher
-version: 1.5.0
+version: 1.6.1
 type: npm
 summary: Efficient path tracking and pattern matching for XML/JSON parsers
 homepage: https://github.com/NaturalIntelligence/path-expression-matcher#readme

.licenses/npm/semver-6.3.1.dep.yml

@@ -1,26 +0,0 @@
----
-name: semver
-version: 6.3.1
-type: npm
-summary: The semantic version parser used by npm.
-homepage: 
-license: isc
-licenses:
-- sources: LICENSE
-  text: |
-    The ISC License
-
-    Copyright (c) Isaac Z. Schlueter and Contributors
-
-    Permission to use, copy, modify, and/or distribute this software for any
-    purpose with or without fee is hereby granted, provided that the above
-    copyright notice and this permission notice appear in all copies.
-
-    THE SOFTWARE IS PROVIDED "AS IS" AND THE AUTHOR DISCLAIMS ALL WARRANTIES
-    WITH REGARD TO THIS SOFTWARE INCLUDING ALL IMPLIED WARRANTIES OF
-    MERCHANTABILITY AND FITNESS. IN NO EVENT SHALL THE AUTHOR BE LIABLE FOR
-    ANY SPECIAL, DIRECT, INDIRECT, OR CONSEQUENTIAL DAMAGES OR ANY DAMAGES
-    WHATSOEVER RESULTING FROM LOSS OF USE, DATA OR PROFITS, WHETHER IN AN
-    ACTION OF CONTRACT, NEGLIGENCE OR OTHER TORTIOUS ACTION, ARISING OUT OF OR
-    IN CONNECTION WITH THE USE OR PERFORMANCE OF THIS SOFTWARE.
-notices: []

.licenses/npm/semver.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: semver
-version: 7.8.4
+version: 7.8.5
 type: npm
 summary: The semantic version parser used by npm.
 homepage:

.licenses/npm/strnum.dep.yml

@@ -1,6 +1,6 @@
 ---
 name: strnum
-version: 2.4.0
+version: 2.4.1
 type: npm
 summary: Parse String to Number based on configuration
 homepage:

.prettierrc.js

@@ -1,11 +0,0 @@
-// This is a reusable configuration file copied from https://github.com/actions/reusable-workflows/tree/main/reusable-configurations. Please don't make changes to this file as it's the subject of an automatic update.
-module.exports = {
-  printWidth: 80,
-  tabWidth: 2,
-  useTabs: false,
-  semi: true,
-  singleQuote: true,
-  trailingComma: 'none',
-  bracketSpacing: false,
-  arrowParens: 'avoid'
-};

.prettierrc.json

@@ -0,0 +1,10 @@
+{
+  "printWidth": 80,
+  "tabWidth": 2,
+  "useTabs": false,
+  "semi": true,
+  "singleQuote": true,
+  "trailingComma": "none",
+  "bracketSpacing": false,
+  "arrowParens": "avoid"
+}

README.md

@@ -18,6 +18,19 @@ The `setup-java` action provides the following functionality for GitHub Actions
 
 This action allows you to work with Java and Scala projects.
 
+## What's new in V6
+
+> [!NOTE]
+> V6 is still in development (`main` branch) and is not yet recommended for production workflows.
+
+- **Migrated to ESM** to enable support for the latest `@actions/*` package versions. This is an internal implementation change only. No changes are required to your workflow configuration, and the action's behavior is unchanged. Existing workflows continue to work as before.
+
+## Breaking changes in V6
+
+- **The GPG passphrase is now passed to the Maven GPG Plugin through an environment variable (`gpg.passphraseEnvName`) instead of the deprecated `gpg.passphrase` server in `settings.xml`.** The `gpg-passphrase` input and its default (`GPG_PASSPHRASE`) are unchanged, so if you already set that environment variable in your build step your workflow keeps working. However, this now requires `maven-gpg-plugin` **3.2.0 or newer**; older versions do not honor `gpg.passphraseEnvName` and, because the `gpg.passphrase` server is no longer written, will not pick up the passphrase. Upgrade the plugin to 3.2.0+.
+
+  See [GPG](docs/advanced-usage.md#gpg) for details.
+
 ## Breaking changes in V5
 
 - Upgraded action from node20 to node24
@@ -43,10 +56,14 @@ For more details,  see the full release notes on the [releases page](https://git
 
     - `set-default`: Set to `false` to install a JDK without making it the default. When `false`, `JAVA_HOME` and `PATH` are not updated, but `JAVA_HOME_<major>_<arch>` is still set so the JDK remains discoverable. Default value: `true`. See [Installing JDK without setting as default](docs/advanced-usage.md#Installing-JDK-without-setting-as-default) for more details.
 
+    - `problem-matcher`: Set to `false` to disable Java problem matcher annotations (compiler diagnostics and uncaught exceptions). Default value: `true`. See [Java problem matcher](docs/advanced-usage.md#java-problem-matcher-compiler-annotations) for details and annotation limits.
+
     - `verify-signature`: Verifies downloaded Java package signatures when supported by the selected distribution. Currently supported for `temurin` and `microsoft`. If set to `true` for unsupported distributions, the action fails.
 
     - `verify-signature-public-key`: ASCII-armored GPG public key used to verify the downloaded package signature. Overrides the default bundled key for the selected distribution.
 
+    - `token`: The token used to authenticate when fetching version manifests hosted on GitHub.com. Defaults to `${{ github.token }}` when running on GitHub.com; defaults to an empty string on GitHub Enterprise Server. On GHES, provide a GitHub.com personal access token if manifest requests are rate-limited. See [Using Microsoft distribution on GHES](docs/advanced-usage.md#using-microsoft-distribution-on-ghes) for more details.
+
     - `cache`: Quick [setup caching](#caching-packages-dependencies) for the dependencies managed through one of the predefined package managers. It can be one of "maven", "gradle" or "sbt".
 
     - `cache-dependency-path`: The path to a dependency file: pom.xml, build.gradle, build.sbt, etc. This option can be used with the `cache` option. If this option is omitted, the action searches for the dependency file in the entire repository. This option supports wildcards and a list of file names for caching multiple dependencies.
@@ -58,49 +75,60 @@ For more details,  see the full release notes on the [releases page](https://git
 
     - `server-id`: ID of the distributionManagement repository in the pom.xml file. Default is `github`.
 
-  - `server-username`: Environment variable name for the username for authentication to the Apache Maven repository. Default is GITHUB_ACTOR.
+    - `server-username`: Environment variable name for the username for authentication to the Apache Maven repository. Default is GITHUB\_ACTOR.
 
-  - `server-password`: Environment variable name for password or token for authentication to the Apache Maven repository. Default is GITHUB_TOKEN.
+    - `server-password`: Environment variable name for password or token for authentication to the Apache Maven repository. Default is GITHUB\_TOKEN.
 
-  - `settings-path`: Maven related setting to point to the directory where the settings.xml file will be written. Default is ~/.m2.
+    - `settings-path`: Maven related setting to point to the directory where the settings.xml file will be written. Default is \~/.m2.
 
     - `gpg-private-key`: GPG private key to import. Default is empty string.
 
-  - `gpg-passphrase`: Environment variable name for the GPG private key passphrase. Default is GPG_PASSPHRASE.
+    - `gpg-passphrase`: Environment variable name for the GPG private key passphrase. Default is GPG\_PASSPHRASE.
 
     - `mvn-toolchain-id`: Name of Maven Toolchain ID if the default name of `${distribution}_${java-version}` is not wanted.
 
     - `mvn-toolchain-vendor`: Name of Maven Toolchain Vendor if the default name of `${distribution}` is not wanted.
 
+    - `show-download-progress`: Set to `true` to keep Maven artifact download and transfer progress in build logs. Default value: `false`. By default, the action adds `-ntp` (`--no-transfer-progress`) to `MAVEN_ARGS`. This input has no effect on non-Maven builds. See [Maven transfer progress](docs/advanced-usage.md#maven-transfer-progress-download-logs) for more details.
+
 ### Basic Configuration
 
 #### Eclipse Temurin
 ```yaml
 steps:
-- uses: actions/checkout@v6
+  - uses: actions/checkout@v7
-- uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: 'temurin' # See 'Supported distributions' for available options
       java-version: '25'
-- run: java --version
+  - run: java --version
 ```
 
 #### Azul Zulu OpenJDK
 ```yaml
 steps:
-- uses: actions/checkout@v6
+  - uses: actions/checkout@v7
-- uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: 'zulu' # See 'Supported distributions' for available options
       java-version: '25'
-- run: java --version
+  - run: java --version
 ```
 
 #### Supported version syntax
 The `java-version` input supports an exact version or a version range using [SemVer](https://semver.org/) notation. The values below are examples, not an exhaustive list:
 - major versions, such as: `8`, `11`, `16`, `17`, `21`, `25`
 - more specific versions: `8.0.282+8`, `8.0.232`, `11.0`, `11.0.4`, `17.0`
+- multi-field Java versions (JEP 322), such as: `11.0.9.1`, `18.0.1.1`
 - early access (EA) versions: `15-ea`, `15.0.0-ea`
+- the `latest` alias, which floats to the newest available stable (GA) release
+
+> [!NOTE]
+> - `latest` always resolves the newest version from the distribution's remote metadata (it behaves like `check-latest: true`), so it ignores any older version already present in the runner tool cache. This has the same performance trade-off described in [Check latest](#check-latest).
+> - `latest` is only supported through the `java-version` input, not through `java-version-file`, and it resolves stable (GA) releases only — it cannot be combined with `-ea`.
+> - The `jdkfile` distribution does not support `latest`, as it installs from a local file.
+> - For `oracle` and `graalvm` (Oracle GraalVM), `latest` uses the Adoptium API only to determine the newest GA **major version number** — the JDK binary itself is still downloaded from the Oracle / GraalVM servers for that major. Because these distributions have no endpoint to list their own releases, if their servers haven't published the resolved major yet, the action fails and asks you to specify a concrete version. Note the Oracle JDK license caveat below still applies to a floating `latest`.
+> - For `graalvm-community`, `latest` floats to the newest GA release published on GitHub, so it never depends on the Adoptium API and always resolves to the newest major that GraalVM Community actually ships.
 
 #### Supported distributions
 Currently, the following distributions are supported:
@@ -111,6 +139,7 @@ Currently, the following distributions are supported:
 | `adopt` or `adopt-hotspot` | [AdoptOpenJDK Hotspot](https://adoptopenjdk.net/) | [`adopt-hotspot` license](https://adoptopenjdk.net/about.html) |
 | `adopt-openj9` | [AdoptOpenJDK OpenJ9](https://adoptopenjdk.net/) | [`adopt-openj9` license](https://adoptopenjdk.net/about.html) |
 | `liberica` | [Liberica JDK](https://bell-sw.com/) | [`liberica` license](https://bell-sw.com/liberica_eula/) |
+| `liberica-nik` | [Liberica Native Image Kit](https://bell-sw.com/pages/downloads/native-image-kit/) | [`liberica-nik` license](https://bell-sw.com/liberica_nik_eula/) |
 | `microsoft` | [Microsoft Build of OpenJDK](https://www.microsoft.com/openjdk) | [`microsoft` license](https://docs.microsoft.com/java/openjdk/faq)
 | `corretto` | [Amazon Corretto Build of OpenJDK](https://aws.amazon.com/corretto/) | [`corretto` license](https://aws.amazon.com/corretto/faqs/)
 | `semeru` | [IBM Semeru Runtime Open Edition](https://developer.ibm.com/languages/java/semeru-runtimes/downloads/) | [`semeru` license](https://openjdk.java.net/legal/gplv2+ce.html) |
@@ -154,8 +183,8 @@ The cache input is optional, and caching is turned off by default.
 #### Caching gradle dependencies
 ```yaml
 steps:
-- uses: actions/checkout@v6
+  - uses: actions/checkout@v7
-- uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: 'temurin'
       java-version: '25'
@@ -163,7 +192,7 @@ steps:
       cache-dependency-path: | # optional
         sub-project/*.gradle*
         sub-project/**/gradle-wrapper.properties
-- run: ./gradlew build --no-daemon
+  - run: ./gradlew build --no-daemon
 ```
 Using the `cache: gradle` provides a simple and effective way to cache Gradle dependencies with minimal configuration.
 
@@ -176,22 +205,29 @@ For setup details and a comprehensive overview of all available features, visit
 #### Caching maven dependencies
 ```yaml
 steps:
-- uses: actions/checkout@v6
+  - uses: actions/checkout@v7
-- uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: 'temurin'
       java-version: '25'
       cache: 'maven'
       cache-dependency-path: 'sub-project/pom.xml' # optional
-- name: Build with Maven
+  - name: Build with Maven
-  run: mvn -B package --file pom.xml
+    run: mvn package --file pom.xml
 ```
 
+> [!NOTE]
+> Maven resolves plugin dependencies lazily, so a cache created by a "thin" goal
+> (e.g. `mvn compile`) can be missing plugin dependencies that later
+> `test`/`verify`/`package` jobs then re-download on every run. See
+> [Ensuring the Maven cache is complete](docs/advanced-usage.md#ensuring-the-maven-cache-is-complete-plugin-dependencies)
+> for how to seed a complete cache.
+
 #### Caching sbt dependencies
 ```yaml
 steps:
-- uses: actions/checkout@v6
+  - uses: actions/checkout@v7
-- uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: 'temurin'
       java-version: '25'
@@ -199,7 +235,7 @@ steps:
       cache-dependency-path: | # optional
         sub-project/build.sbt
         sub-project/project/build.properties
-- name: Build with SBT
+  - name: Build with SBT
     run: sbt package
 ```
 
@@ -210,13 +246,13 @@ Usually, cache gets downloaded in multiple segments of fixed sizes. Sometimes, a
 env:
   SEGMENT_DOWNLOAD_TIMEOUT_MINS: '5'
 steps:
-- uses: actions/checkout@v6
+  - uses: actions/checkout@v7
-- uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: 'temurin'
       java-version: '25'
       cache: 'gradle'
-- run: ./gradlew build --no-daemon
+  - run: ./gradlew build --no-daemon
 ```
 
 ### Check latest
@@ -230,13 +266,13 @@ For Java distributions that are not cached on Hosted images, `check-latest` alwa
 
 ```yaml
 steps:
-- uses: actions/checkout@v6
+  - uses: actions/checkout@v7
-- uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: 'temurin'
       java-version: '25'
       check-latest: true
-- run: java --version
+  - run: java --version
 ```
 
 ### Testing against different Java versions
@@ -249,9 +285,9 @@ jobs:
         java: [ '8', '11', '17', '21', '25' ]
     name: Java ${{ matrix.Java }} sample
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Setup java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v6
         with:
           distribution: '<distribution>'
           java-version: ${{ matrix.java }}
@@ -260,11 +296,11 @@ jobs:
 
 ### Install multiple JDKs
 
-All configured Java versions are added to the PATH. The last one added to the PATH (i.e., the last JDK set up by this action) will be used as the default and available globally. Other Java versions can be accessed through environment variables such as 'JAVA_HOME_{{ MAJOR_VERSION }}_{{ ARCHITECTURE }}'. To use a specific Java version, set the JAVA_HOME environment variable accordingly and prepend its bin directory to the PATH to ensure it takes priority during execution.
+All configured Java versions are added to the PATH. The last one added to the PATH (i.e., the last JDK set up by this action) will be used as the default and available globally. Other Java versions can be accessed through environment variables such as 'JAVA\_HOME\_{{ MAJOR\_VERSION }}\_{{ ARCHITECTURE }}'. To use a specific Java version, set the JAVA\_HOME environment variable accordingly and prepend its bin directory to the PATH to ensure it takes priority during execution.
 
 ```yaml
    steps:
-      - uses: actions/setup-java@v5
+      - uses: actions/setup-java@v6
         with:
           distribution: '<distribution>'
           java-version: |
@@ -283,6 +319,7 @@ In the example above multiple JDKs are installed for the same job. The result af
     - [Adopt](docs/advanced-usage.md#Adopt)
     - [Zulu](docs/advanced-usage.md#Zulu)
     - [Liberica](docs/advanced-usage.md#Liberica)
+    - [Liberica Native Image Kit](docs/advanced-usage.md#Liberica-Native-Image-Kit)
     - [Microsoft](docs/advanced-usage.md#Microsoft)
     - [Amazon Corretto](docs/advanced-usage.md#Amazon-Corretto)
     - [Oracle](docs/advanced-usage.md#Oracle)
@@ -297,20 +334,12 @@ In the example above multiple JDKs are installed for the same job. The result af
 - [Testing against different Java distributions](docs/advanced-usage.md#Testing-against-different-Java-distributions)
 - [Testing against different platforms](docs/advanced-usage.md#Testing-against-different-platforms)
 - [Publishing using Apache Maven](docs/advanced-usage.md#Publishing-using-Apache-Maven)
+- [Maven transfer progress (download logs)](docs/advanced-usage.md#maven-transfer-progress-download-logs)
 - [Publishing using Gradle](docs/advanced-usage.md#Publishing-using-Gradle)
 - [Hosted Tool Cache](docs/advanced-usage.md#Hosted-Tool-Cache)
 - [Modifying Maven Toolchains](docs/advanced-usage.md#Modifying-Maven-Toolchains)
 - [Java Version File](docs/advanced-usage.md#Java-version-file)
 
-## V2 vs V1
-
-Examples in this README use `actions/setup-java@v5`, but the main migration note from V1 still applies to all later major versions (`v2`, `v3`, `v4`, and `v5`):
-
-- Starting with V2, the action supports custom distributions. V1 supports only Azul Zulu OpenJDK.
-- Starting with V2, you must specify distribution along with the version. V1 defaults to Azul Zulu OpenJDK, so only version input is required. Follow [the migration guide](docs/switching-to-v2.md) to switch from V1 to V2.
-
-For information about the latest releases, recent updates, and newly supported distributions, please refer to the `setup-java` [Releases](https://github.com/actions/setup-java/releases).
-
 ## Recommended permissions
 
 When using the `setup-java` action in your GitHub Actions workflow, it is recommended to set the following permissions to ensure proper functionality:

__tests__/auth.test.ts

@@ -1,24 +1,63 @@
+import {
+  jest,
+  describe,
+  it,
+  expect,
+  beforeEach,
+  afterEach,
+  beforeAll,
+  afterAll
+} from '@jest/globals';
+import {fileURLToPath} from 'url';
 import * as io from '@actions/io';
-import * as core from '@actions/core';
 import * as fs from 'fs';
 import * as path from 'path';
 import os from 'os';
 
-import * as auth from '../src/auth';
+// Mock @actions/core before importing source modules that depend on it
-import {M2_DIR, MVN_SETTINGS_FILE} from '../src/constants';
+jest.unstable_mockModule('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
 
+// Dynamic imports after mocking
+const core = await import('@actions/core');
+const auth = await import('../src/auth.js');
+const {M2_DIR, MVN_SETTINGS_FILE} = await import('../src/constants.js');
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const m2Dir = path.join(__dirname, M2_DIR);
 const settingsFile = path.join(m2Dir, MVN_SETTINGS_FILE);
 
 describe('auth tests', () => {
-  let spyOSHomedir: jest.SpyInstance;
+  let spyOSHomedir: any;
-  let spyInfo: jest.SpyInstance;
+  let spyInfo: any;
 
   beforeEach(async () => {
     await io.rmRF(m2Dir);
     spyOSHomedir = jest.spyOn(os, 'homedir');
     spyOSHomedir.mockReturnValue(__dirname);
-    spyInfo = jest.spyOn(core, 'info');
+    spyInfo = core.info as jest.Mock;
     spyInfo.mockImplementation(() => null);
   }, 300000);
 
@@ -189,9 +228,40 @@ describe('auth tests', () => {
       <username>\${env.${username}}</username>
       <password>\${env.&amp;&lt;&gt;"''"&gt;&lt;&amp;}</password>
     </server>
+  </servers>
+  <profiles>
+    <profile>
+      <id>setup-java-gpg</id>
+      <properties>
+        <gpg.passphraseEnvName>${gpgPassphrase}</gpg.passphraseEnvName>
+      </properties>
+    </profile>
+  </profiles>
+  <activeProfiles>
+    <activeProfile>setup-java-gpg</activeProfile>
+  </activeProfiles>
+</settings>`;
+
+    expect(auth.generate(id, username, password, gpgPassphrase)).toEqual(
+      expectedSettings
+    );
+  });
+
+  it('does not add a gpg profile when the passphrase env var is the maven-gpg-plugin default', () => {
+    const id = 'packages';
+    const username = 'USER';
+    const password = '&<>"\'\'"><&';
+    const gpgPassphrase = 'MAVEN_GPG_PASSPHRASE';
+
+    const expectedSettings = `<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 https://maven.apache.org/xsd/settings-1.0.0.xsd">
+  <interactiveMode>false</interactiveMode>
+  <servers>
     <server>
-      <id>gpg.passphrase</id>
+      <id>${id}</id>
-      <passphrase>\${env.${gpgPassphrase}}</passphrase>
+      <username>\${env.${username}}</username>
+      <password>\${env.&amp;&lt;&gt;"''"&gt;&lt;&amp;}</password>
     </server>
   </servers>
 </settings>`;

__tests__/cache.test.ts

@@ -1,23 +1,84 @@
+import {
+  jest,
+  describe,
+  it,
+  expect,
+  beforeEach,
+  afterEach,
+  beforeAll,
+  afterAll
+} from '@jest/globals';
 import {mkdtempSync} from 'fs';
 import {tmpdir} from 'os';
 import {join} from 'path';
-import {restore, save} from '../src/cache';
 import * as fs from 'fs';
 import * as os from 'os';
-import * as core from '@actions/core';
+
-import * as cache from '@actions/cache';
+// Mock @actions/core before importing source modules that depend on it
-import * as glob from '@actions/glob';
+jest.unstable_mockModule('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
+
+jest.unstable_mockModule('@actions/cache', () => ({
+  restoreCache: jest.fn(),
+  saveCache: jest.fn(),
+  isFeatureAvailable: jest.fn(),
+  ValidationError: class ValidationError extends Error {
+    constructor(message: string) {
+      super(message);
+      this.name = 'ValidationError';
+    }
+  },
+  ReserveCacheError: class ReserveCacheError extends Error {
+    constructor(message: string) {
+      super(message);
+      this.name = 'ReserveCacheError';
+    }
+  }
+}));
+
+jest.unstable_mockModule('@actions/glob', () => ({
+  hashFiles: jest.fn(),
+  create: jest.fn()
+}));
+
+// Dynamic imports after mocking
+const core = await import('@actions/core');
+const cache = await import('@actions/cache');
+const glob = await import('@actions/glob');
+const {restore, save} = await import('../src/cache.js');
 
 describe('dependency cache', () => {
   const ORIGINAL_RUNNER_OS = process.env['RUNNER_OS'];
   const ORIGINAL_GITHUB_WORKSPACE = process.env['GITHUB_WORKSPACE'];
   const ORIGINAL_CWD = process.cwd();
   let workspace: string;
-  let spyInfo: jest.SpyInstance<void, Parameters<typeof core.info>>;
+  let spyInfo: any;
-  let spyWarning: jest.SpyInstance<void, Parameters<typeof core.warning>>;
+  let spyWarning: any;
-  let spyDebug: jest.SpyInstance<void, Parameters<typeof core.debug>>;
+  let spyDebug: any;
-  let spySaveState: jest.SpyInstance<void, Parameters<typeof core.saveState>>;
+  let spySaveState: any;
-  let spyCoreError: jest.SpyInstance;
+  let spyCoreError: any;
 
   beforeEach(() => {
     workspace = mkdtempSync(join(tmpdir(), 'setup-java-cache-'));
@@ -41,20 +102,20 @@ describe('dependency cache', () => {
   });
 
   beforeEach(() => {
-    spyInfo = jest.spyOn(core, 'info');
+    spyInfo = core.info as jest.Mock;
     spyInfo.mockImplementation(() => null);
 
-    spyWarning = jest.spyOn(core, 'warning');
+    spyWarning = core.warning as jest.Mock;
     spyWarning.mockImplementation(() => null);
 
-    spyDebug = jest.spyOn(core, 'debug');
+    spyDebug = core.debug as jest.Mock;
     spyDebug.mockImplementation(() => null);
 
-    spySaveState = jest.spyOn(core, 'saveState');
+    spySaveState = core.saveState as jest.Mock;
     spySaveState.mockImplementation(() => null);
 
     // Mock core.error to suppress error logs
-    spyCoreError = jest.spyOn(core, 'error');
+    spyCoreError = core.error as jest.Mock;
     spyCoreError.mockImplementation(() => {});
   });
 
@@ -70,27 +131,18 @@ describe('dependency cache', () => {
   });
 
   describe('restore', () => {
-    let spyCacheRestore: jest.SpyInstance<
+    let spyCacheRestore: any;
-      ReturnType<typeof cache.restoreCache>,
+    let spyGlobHashFiles: any;
-      Parameters<typeof cache.restoreCache>
+    let spySetOutput: any;
-    >;
-    let spyGlobHashFiles: jest.SpyInstance<
-      ReturnType<typeof glob.hashFiles>,
-      Parameters<typeof glob.hashFiles>
-    >;
-    let spySetOutput: jest.SpyInstance<
-      ReturnType<typeof core.setOutput>,
-      Parameters<typeof core.setOutput>
-    >;
 
     beforeEach(() => {
-      spyCacheRestore = jest
+      spyCacheRestore = (cache.restoreCache as any).mockImplementation(
-        .spyOn(cache, 'restoreCache')
+        (paths: string[], primaryKey: string) => Promise.resolve(undefined)
-        .mockImplementation((paths: string[], primaryKey: string) =>
-          Promise.resolve(undefined)
       );
-      spyGlobHashFiles = jest.spyOn(glob, 'hashFiles');
+      spyGlobHashFiles = glob.hashFiles as jest.Mock;
-      spySetOutput = jest.spyOn(core, 'setOutput').mockImplementation(() => {});
+      spyGlobHashFiles.mockResolvedValue('hash-stub');
+      spySetOutput = core.setOutput as jest.Mock;
+      spySetOutput.mockImplementation(() => null);
       spyWarning.mockImplementation(() => null);
     });
 
@@ -102,6 +154,7 @@ describe('dependency cache', () => {
 
     describe('for maven', () => {
       it('throws error if no pom.xml, maven-wrapper.properties, or extensions.xml found', async () => {
+        spyGlobHashFiles.mockResolvedValue('');
         await expect(restore('maven', '')).rejects.toThrow(
           `No file in ${projectRoot(
             workspace
@@ -165,7 +218,6 @@ describe('dependency cache', () => {
         expect(spyInfo).toHaveBeenCalledWith('maven cache is not found');
       });
       it('restores the maven wrapper distribution cache independently of the main cache', async () => {
-        createFile(join(workspace, 'pom.xml'));
         createDirectory(join(workspace, '.mvn'));
         createDirectory(join(workspace, '.mvn', 'wrapper'));
         createFile(
@@ -173,33 +225,43 @@ describe('dependency cache', () => {
         );
 
         await restore('maven', '');
-        // Main cache no longer includes the wrapper distribution.
+        // Main dependency cache no longer carries the wrapper dists path.
         expect(spyCacheRestore).toHaveBeenCalledWith(
           [join(os.homedir(), '.m2', 'repository')],
           expect.any(String)
         );
-        // Wrapper distribution is restored on its own, keyed only on the
-        // maven-wrapper.properties hash.
         expect(spyCacheRestore).toHaveBeenCalledWith(
           [join(os.homedir(), '.m2', 'wrapper', 'dists')],
-          expect.any(String)
+          expect.stringContaining('maven-wrapper')
         );
         expect(spyGlobHashFiles).toHaveBeenCalledWith(
           '**/.mvn/wrapper/maven-wrapper.properties'
         );
       });
-      it('skips the maven wrapper cache when no maven-wrapper.properties exists', async () => {
+      it('skips the maven wrapper cache when no wrapper properties exist', async () => {
         createFile(join(workspace, 'pom.xml'));
+        spyGlobHashFiles.mockImplementation((pattern: string) =>
+          Promise.resolve(
+            pattern === '**/.mvn/wrapper/maven-wrapper.properties'
+              ? ''
+              : 'hash-stub'
+          )
+        );
 
         await restore('maven', '');
-        expect(spyCacheRestore).not.toHaveBeenCalledWith(
+        // Only the main dependency cache is restored; the wrapper cache path is
-          [join(os.homedir(), '.m2', 'wrapper', 'dists')],
+        // never touched because the project does not use mvnw.
+        expect(spyCacheRestore).toHaveBeenCalledTimes(1);
+        expect(spyCacheRestore).toHaveBeenCalledWith(
+          [join(os.homedir(), '.m2', 'repository')],
           expect.any(String)
         );
+        expect(spyWarning).not.toHaveBeenCalled();
       });
     });
     describe('for gradle', () => {
       it('throws error if no build.gradle found', async () => {
+        spyGlobHashFiles.mockResolvedValue('');
         await expect(restore('gradle', '')).rejects.toThrow(
           `No file in ${projectRoot(
             workspace
@@ -254,31 +316,45 @@ describe('dependency cache', () => {
       });
       it('restores the gradle wrapper distribution cache independently of the main cache', async () => {
         createFile(join(workspace, 'build.gradle'));
-        createDirectory(join(workspace, 'gradle'));
-        createDirectory(join(workspace, 'gradle', 'wrapper'));
-        createFile(
-          join(workspace, 'gradle', 'wrapper', 'gradle-wrapper.properties')
-        );
 
         await restore('gradle', '');
-        // Main cache no longer includes the wrapper distribution.
+        // Main dependency cache no longer carries the wrapper path.
         expect(spyCacheRestore).toHaveBeenCalledWith(
           [join(os.homedir(), '.gradle', 'caches')],
           expect.any(String)
         );
         // Wrapper distribution is restored on its own, keyed only on the
-        // gradle-wrapper.properties hash.
+        // wrapper properties file.
         expect(spyCacheRestore).toHaveBeenCalledWith(
           [join(os.homedir(), '.gradle', 'wrapper')],
-          expect.any(String)
+          expect.stringContaining('setup-java-')
         );
         expect(spyGlobHashFiles).toHaveBeenCalledWith(
           '**/gradle-wrapper.properties'
         );
       });
+      it('skips the gradle wrapper cache when no wrapper properties exist', async () => {
+        createFile(join(workspace, 'build.gradle'));
+        spyGlobHashFiles.mockImplementation((pattern: string) =>
+          Promise.resolve(
+            pattern === '**/gradle-wrapper.properties' ? '' : 'hash-stub'
+          )
+        );
+
+        await restore('gradle', '');
+        // Only the main dependency cache is restored; the wrapper cache path is
+        // never touched because the project does not use the gradle wrapper.
+        expect(spyCacheRestore).toHaveBeenCalledTimes(1);
+        expect(spyCacheRestore).toHaveBeenCalledWith(
+          [join(os.homedir(), '.gradle', 'caches')],
+          expect.any(String)
+        );
+        expect(spyWarning).not.toHaveBeenCalled();
+      });
     });
     describe('for sbt', () => {
       it('throws error if no build.sbt found', async () => {
+        spyGlobHashFiles.mockResolvedValue('');
         await expect(restore('sbt', '')).rejects.toThrow(
           `No file in ${projectRoot(
             workspace
@@ -297,6 +373,13 @@ describe('dependency cache', () => {
         expect(spyInfo).toHaveBeenCalledWith('sbt cache is not found');
       });
       it('detects scala and sbt changes under **/project/ folder', async () => {
+        let callCount = 0;
+        spyGlobHashFiles.mockImplementation(async () => {
+          callCount++;
+          // Return same hash for first two calls, different for third
+          return callCount <= 2 ? 'hash-v1' : 'hash-v2';
+        });
+
         createFile(join(workspace, 'build.sbt'));
         createDirectory(join(workspace, 'project'));
         createFile(join(workspace, 'project/DependenciesV1.scala'));
@@ -332,6 +415,7 @@ describe('dependency cache', () => {
     });
     describe('cache-dependency-path', () => {
       it('throws error if no matching dependency file found', async () => {
+        spyGlobHashFiles.mockResolvedValue('');
         createFile(join(workspace, 'build.gradle.kts'));
         await expect(
           restore('gradle', 'sub-project/**/build.gradle.kts')
@@ -373,16 +457,11 @@ describe('dependency cache', () => {
     });
   });
   describe('save', () => {
-    let spyCacheSave: jest.SpyInstance<
+    let spyCacheSave: any;
-      ReturnType<typeof cache.saveCache>,
-      Parameters<typeof cache.saveCache>
-    >;
 
     beforeEach(() => {
-      spyCacheSave = jest
+      spyCacheSave = (cache.saveCache as any).mockImplementation(
-        .spyOn(cache, 'saveCache')
+        (paths: string[], key: string) => Promise.resolve(0)
-        .mockImplementation((paths: string[], key: string) =>
-          Promise.resolve(0)
       );
       spyWarning.mockImplementation(() => null);
     });
@@ -449,17 +528,41 @@ describe('dependency cache', () => {
       });
       it('saves the maven wrapper distribution cache under its own key', async () => {
         createFile(join(workspace, 'pom.xml'));
-        createStateForWrapperRestore('maven-wrapper', false);
+        (core.getState as jest.Mock<any>).mockImplementation((name: any) => {
+          switch (name) {
+            case 'cache-primary-key':
+              return 'setup-java-cache-primary-key';
+            case 'cache-matched-key':
+              return 'setup-java-cache-matched-key';
+            case 'cache-primary-key-maven-wrapper':
+              return 'setup-java-maven-wrapper-key';
+            default:
+              return '';
+          }
+        });
 
         await save('maven');
         expect(spyCacheSave).toHaveBeenCalledWith(
           [join(os.homedir(), '.m2', 'wrapper', 'dists')],
-          'setup-java-maven-wrapper-primary-key'
+          'setup-java-maven-wrapper-key'
         );
+        expect(spyWarning).not.toHaveBeenCalled();
       });
       it('does not save the maven wrapper cache on an exact wrapper hit', async () => {
         createFile(join(workspace, 'pom.xml'));
-        createStateForWrapperRestore('maven-wrapper', true);
+        (core.getState as jest.Mock<any>).mockImplementation((name: any) => {
+          switch (name) {
+            case 'cache-primary-key':
+              return 'setup-java-cache-primary-key';
+            case 'cache-matched-key':
+              return 'setup-java-cache-matched-key';
+            case 'cache-primary-key-maven-wrapper':
+            case 'cache-matched-key-maven-wrapper':
+              return 'setup-java-maven-wrapper-key';
+            default:
+              return '';
+          }
+        });
 
         await save('maven');
         expect(spyCacheSave).not.toHaveBeenCalledWith(
@@ -469,17 +572,30 @@ describe('dependency cache', () => {
       });
       it('does not fail the post step when the wrapper distribution path is missing', async () => {
         createFile(join(workspace, 'pom.xml'));
-        createStateForWrapperRestore('maven-wrapper', false);
+        (core.getState as jest.Mock<any>).mockImplementation((name: any) => {
-        spyCacheSave.mockImplementation((paths: string[], key: string) => {
+          switch (name) {
-          if (paths.includes(join(os.homedir(), '.m2', 'wrapper', 'dists'))) {
+            case 'cache-primary-key':
-            return Promise.reject(
+              return 'setup-java-cache-primary-key';
-              new cache.ValidationError('Path Validation Error')
+            case 'cache-matched-key':
-            );
+              return 'setup-java-cache-matched-key';
+            case 'cache-primary-key-maven-wrapper':
+              return 'setup-java-maven-wrapper-key';
+            default:
+              return '';
           }
-          return Promise.resolve(0);
         });
+        spyCacheSave.mockImplementation((paths: string[]) =>
+          paths.includes(join(os.homedir(), '.m2', 'wrapper', 'dists'))
+            ? Promise.reject(
+                new cache.ValidationError(
+                  'Path Validation Error: Path(s) specified in the action for caching do(es) not exist'
+                )
+              )
+            : Promise.resolve(0)
+        );
 
-        await expect(save('maven')).resolves.not.toThrow();
+        await expect(save('maven')).resolves.toBeUndefined();
+        expect(spyWarning).not.toHaveBeenCalled();
       });
     });
     describe('for gradle', () => {
@@ -535,17 +651,41 @@ describe('dependency cache', () => {
       });
       it('saves the gradle wrapper distribution cache under its own key', async () => {
         createFile(join(workspace, 'build.gradle'));
-        createStateForWrapperRestore('gradle-wrapper', false);
+        (core.getState as jest.Mock<any>).mockImplementation((name: any) => {
+          switch (name) {
+            case 'cache-primary-key':
+              return 'setup-java-cache-primary-key';
+            case 'cache-matched-key':
+              return 'setup-java-cache-matched-key';
+            case 'cache-primary-key-gradle-wrapper':
+              return 'setup-java-gradle-wrapper-key';
+            default:
+              return '';
+          }
+        });
 
         await save('gradle');
         expect(spyCacheSave).toHaveBeenCalledWith(
           [join(os.homedir(), '.gradle', 'wrapper')],
-          'setup-java-gradle-wrapper-primary-key'
+          'setup-java-gradle-wrapper-key'
         );
+        expect(spyWarning).not.toHaveBeenCalled();
       });
       it('does not save the gradle wrapper cache on an exact wrapper hit', async () => {
         createFile(join(workspace, 'build.gradle'));
-        createStateForWrapperRestore('gradle-wrapper', true);
+        (core.getState as jest.Mock<any>).mockImplementation((name: any) => {
+          switch (name) {
+            case 'cache-primary-key':
+              return 'setup-java-cache-primary-key';
+            case 'cache-matched-key':
+              return 'setup-java-cache-matched-key';
+            case 'cache-primary-key-gradle-wrapper':
+            case 'cache-matched-key-gradle-wrapper':
+              return 'setup-java-gradle-wrapper-key';
+            default:
+              return '';
+          }
+        });
 
         await save('gradle');
         expect(spyCacheSave).not.toHaveBeenCalledWith(
@@ -597,14 +737,14 @@ describe('dependency cache', () => {
 });
 
 function resetState() {
-  jest.spyOn(core, 'getState').mockReset();
+  (core.getState as jest.Mock).mockReset();
 }
 
 /**
  * Create states to emulate a restore process without build file.
  */
 function createStateForMissingBuildFile() {
-  jest.spyOn(core, 'getState').mockImplementation(name => {
+  (core.getState as jest.Mock<any>).mockImplementation((name: any) => {
     switch (name) {
       case 'cache-primary-key':
         return 'setup-java-cache-';
@@ -618,7 +758,7 @@ function createStateForMissingBuildFile() {
  * Create states to emulate a successful restore process.
  */
 function createStateForSuccessfulRestore() {
-  jest.spyOn(core, 'getState').mockImplementation(name => {
+  (core.getState as jest.Mock<any>).mockImplementation((name: any) => {
     switch (name) {
       case 'cache-primary-key':
         return 'setup-java-cache-primary-key';
@@ -630,29 +770,6 @@ function createStateForSuccessfulRestore() {
   });
 }
 
-/**
- * Create states to emulate a restore process where an additional (wrapper)
- * cache was restored. When `hit` is true the matched key equals the primary
- * key, emulating an exact wrapper cache hit.
- */
-function createStateForWrapperRestore(wrapperName: string, hit: boolean) {
-  const primaryKey = `setup-java-${wrapperName}-primary-key`;
-  jest.spyOn(core, 'getState').mockImplementation(name => {
-    switch (name) {
-      case 'cache-primary-key':
-        return 'setup-java-cache-primary-key';
-      case 'cache-matched-key':
-        return 'setup-java-cache-matched-key';
-      case `cache-primary-key-${wrapperName}`:
-        return primaryKey;
-      case `cache-matched-key-${wrapperName}`:
-        return hit ? primaryKey : '';
-      default:
-        return '';
-    }
-  });
-}
-
 function createFile(path: string) {
   core.info(`created a file at ${path}`);
   fs.writeFileSync(path, '');

__tests__/cache/maven2/.gitignore

@@ -0,0 +1,11 @@
+target/
+pom.xml.tag
+pom.xml.releaseBackup
+pom.xml.versionsBackup
+pom.xml.next
+release.properties
+dependency-reduced-pom.xml
+buildNumber.properties
+.mvn/timing.properties
+# https://github.com/takari/maven-wrapper#usage-without-binary-jar
+.mvn/wrapper/maven-wrapper.jar

__tests__/cache/maven2/pom.xml

@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <groupId>io.github.actions</groupId>
+    <artifactId>setup-java-maven2-example</artifactId>
+    <version>1.0.0-SNAPSHOT</version>
+    <packaging>jar</packaging>
+    <dependencies>
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-lang3</artifactId>
+            <version>3.12.0</version>
+        </dependency>
+    </dependencies>
+</project>

__tests__/cache/sbt2/.gitignore

@@ -0,0 +1 @@
+target/

__tests__/cache/sbt2/build.sbt

@@ -0,0 +1,3 @@
+ThisBuild / scalaVersion := "2.12.15"
+
+libraryDependencies += "org.scala-lang.modules" %% "scala-parser-combinators" % "2.1.1"

__tests__/check-dir.sh

@@ -0,0 +1,39 @@
+#!/bin/sh
+# Assert whether a directory exists, for use in the e2e cache workflows.
+#
+# Usage: check-dir.sh <dir> [present|absent]
+#
+#   present (default): fail if <dir> does NOT exist, otherwise list its contents.
+#   absent:            fail if <dir> DOES exist.
+#
+# Call with already-expanded paths (e.g. "$HOME/.gradle/caches") to avoid
+# tilde-expansion pitfalls.
+set -eu
+
+if [ "$#" -lt 1 ]; then
+  echo "Usage: check-dir.sh <dir> [present|absent]" >&2
+  exit 2
+fi
+
+dir=$1
+mode=${2:-present}
+
+case "$mode" in
+  present)
+    if [ ! -d "$dir" ]; then
+      echo "::error::The $dir directory does not exist unexpectedly"
+      exit 1
+    fi
+    ls "$dir"
+    ;;
+  absent)
+    if [ -d "$dir" ]; then
+      echo "::error::The $dir directory exists unexpectedly"
+      exit 1
+    fi
+    ;;
+  *)
+    echo "::error::Unknown mode '$mode' (expected 'present' or 'absent')"
+    exit 1
+    ;;
+esac

__tests__/cleanup-java.test.ts

@@ -1,32 +1,87 @@
-import {run as cleanup} from '../src/cleanup-java';
+import {
-import * as core from '@actions/core';
+  jest,
-import * as cache from '@actions/cache';
+  describe,
-import * as util from '../src/util';
+  it,
+  expect,
+  beforeEach,
+  afterEach,
+  beforeAll,
+  afterAll
+} from '@jest/globals';
+
+// Mock @actions/cache before importing source modules
+const real_cache_module = await import('@actions/cache');
+jest.unstable_mockModule('@actions/cache', () => ({
+  ...real_cache_module,
+  saveCache: jest.fn(),
+  restoreCache: jest.fn()
+}));
+
+// Mock @actions/core before importing source modules that depend on it
+jest.unstable_mockModule('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
+
+const real_util_module = await import('../src/util.js');
+jest.unstable_mockModule('../src/util.js', () => ({
+  ...real_util_module,
+  extractJdkFile: jest.fn(),
+  getDownloadArchiveExtension: jest.fn(),
+  getToolcachePath: jest.fn(),
+  isJobStatusSuccess: jest.fn(),
+  renameWinArchive: jest.fn(),
+  isVersionSatisfies: real_util_module.isVersionSatisfies,
+  getTempDir: real_util_module.getTempDir
+}));
+
+// Dynamic imports after mocking
+const core = await import('@actions/core');
+const cache = await import('@actions/cache');
+const {run: cleanup} = await import('../src/cleanup-java.js');
+const util = await import('../src/util.js');
 
 describe('cleanup', () => {
-  let spyWarning: jest.SpyInstance<void, Parameters<typeof core.warning>>;
+  let spyWarning: any;
-  let spyInfo: jest.SpyInstance<void, Parameters<typeof core.info>>;
+  let spyInfo: any;
-  let spyCacheSave: jest.SpyInstance<
+  let spyCacheSave: any;
-    ReturnType<typeof cache.saveCache>,
+  let spyJobStatusSuccess: any;
-    Parameters<typeof cache.saveCache>
+  let spyCoreError: any;
-  >;
-  let spyJobStatusSuccess: jest.SpyInstance;
-  let spyCoreError: jest.SpyInstance;
 
   beforeEach(() => {
-    spyWarning = jest.spyOn(core, 'warning');
+    spyWarning = core.warning as jest.Mock;
     spyWarning.mockImplementation(() => null);
 
-    spyInfo = jest.spyOn(core, 'info');
+    spyInfo = core.info as jest.Mock;
     spyInfo.mockImplementation(() => null);
 
-    spyCacheSave = jest.spyOn(cache, 'saveCache');
+    spyCacheSave = cache.saveCache as jest.Mock;
 
-    spyJobStatusSuccess = jest.spyOn(util, 'isJobStatusSuccess');
+    spyJobStatusSuccess = util.isJobStatusSuccess as jest.Mock;
     spyJobStatusSuccess.mockReturnValue(true);
 
     // Mock core.error to suppress error logs
-    spyCoreError = jest.spyOn(core, 'error');
+    spyCoreError = core.error as jest.Mock;
     spyCoreError.mockImplementation(() => {});
 
     createStateForSuccessfulRestore();
@@ -47,7 +102,7 @@ describe('cleanup', () => {
         )
       )
     );
-    jest.spyOn(core, 'getInput').mockImplementation((name: string) => {
+    (core.getInput as jest.Mock<any>).mockImplementation((name: string) => {
       return name === 'cache' ? 'gradle' : '';
     });
     await cleanup();
@@ -59,7 +114,7 @@ describe('cleanup', () => {
     spyCacheSave.mockImplementation((paths: string[], key: string) =>
       Promise.reject(new Error('Unexpected error'))
     );
-    jest.spyOn(core, 'getInput').mockImplementation((name: string) => {
+    (core.getInput as jest.Mock<any>).mockImplementation((name: string) => {
       return name === 'cache' ? 'gradle' : '';
     });
     await cleanup();
@@ -68,14 +123,14 @@ describe('cleanup', () => {
 });
 
 function resetState() {
-  jest.spyOn(core, 'getState').mockReset();
+  (core.getState as jest.Mock).mockReset();
 }
 
 /**
  * Create states to emulate a successful restore process.
  */
 function createStateForSuccessfulRestore() {
-  jest.spyOn(core, 'getState').mockImplementation(name => {
+  (core.getState as jest.Mock<any>).mockImplementation((name: any) => {
     switch (name) {
       case 'cache-primary-key':
         return 'setup-java-cache-primary-key';

__tests__/data/liberica-nik.json

@@ -0,0 +1,739 @@
+[
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/25.0.1+3-25.0.1+16/bellsoft-liberica-vm-openjdk25.0.1+16-25.0.1+3-linux-amd64.tar.gz",
+    "version": "25.0.1+3",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "25.0.1+16",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/24.1.0+1-23+38/bellsoft-liberica-vm-openjdk23+38-24.1.0+1-linux-amd64.tar.gz",
+    "version": "24.1.0+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "23+38",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://download.bell-sw.com/vm/21.3.2/bellsoft-liberica-vm-openjdk11.0.15.1+2-21.3.2+2-linux-amd64.tar.gz",
+    "version": "21.3.2+2",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "11.0.15.1+2",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://download.bell-sw.com/vm/22.3.0/bellsoft-liberica-vm-openjdk17.0.5+8-22.3.0+2-linux-amd64.tar.gz",
+    "version": "22.3.0+2",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "17.0.5+8",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/23.0.9+1-17.0.16+13/bellsoft-liberica-vm-openjdk17.0.16+13-23.0.9+1-linux-amd64.tar.gz",
+    "version": "23.0.9+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "17.0.16+13",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://download.bell-sw.com/vm/23.0.0/bellsoft-liberica-vm-openjdk17.0.7+7-23.0.0+1-src.tar.gz",
+    "version": "23.0.0+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "17.0.7+7",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/25.0.2+1-25.0.2+13/bellsoft-liberica-vm-openjdk25.0.2+13-25.0.2+1-linux-amd64.tar.gz",
+    "version": "25.0.2+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "25.0.2+13",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/24.1.1+1-23.0.1+13/bellsoft-liberica-vm-openjdk23.0.1+13-24.1.1+1-linux-amd64.tar.gz",
+    "version": "24.1.1+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "23.0.1+13",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/23.0.12+1-17.0.19+12/bellsoft-liberica-vm-openjdk17.0.19+12-23.0.12+1-linux-amd64.tar.gz",
+    "version": "23.0.12+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "17.0.19+12",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/23.0.3+1-17.0.10+13/bellsoft-liberica-vm-openjdk17.0.10+13-23.0.3+1-linux-amd64.tar.gz",
+    "version": "23.0.3+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "17.0.10+13",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://download.bell-sw.com/vm/21.3.2/bellsoft-liberica-vm-openjdk11-21.3.2-src.tar.gz",
+    "version": "21.3.2+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "11.0.15+10",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://download.bell-sw.com/vm/22.3.3/bellsoft-liberica-vm-openjdk11.0.20+8-22.3.3+1-src.tar.gz",
+    "version": "22.3.3+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "11.0.20+8",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/23.0.8+1-17.0.15+10/bellsoft-liberica-vm-openjdk17.0.15+10-23.0.8+1-linux-amd64.tar.gz",
+    "version": "23.0.8+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "17.0.15+10",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://download.bell-sw.com/vm/21.3.3/bellsoft-liberica-vm-openjdk17.0.4-21.3.3-src.tar.gz",
+    "version": "21.3.3+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "17.0.4+8",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/23.1.7+1-21.0.7+9/bellsoft-liberica-vm-openjdk21.0.7+9-23.1.7+1-linux-amd64.tar.gz",
+    "version": "23.1.7+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "21.0.7+9",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/23.1.8+1-21.0.8+13/bellsoft-liberica-vm-openjdk21.0.8+13-23.1.8+1-linux-amd64.tar.gz",
+    "version": "23.1.8+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "21.0.8+13",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://download.bell-sw.com/vm/21.0.0.2/bellsoft-liberica-vm-openjdk11-21.0.0.2-src.tar.gz",
+    "version": "21.0.0.2",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "11.0.10+9",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://download.bell-sw.com/vm/23.0.1/bellsoft-liberica-vm-openjdk17.0.8+7-23.0.1+1-linux-amd64.tar.gz",
+    "version": "23.0.1+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "17.0.8+7",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/24.0.0+1-22+37/bellsoft-liberica-vm-openjdk22+37-24.0.0+1-linux-amd64.tar.gz",
+    "version": "24.0.0+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "22+37",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://download.bell-sw.com/vm/22.1.0/bellsoft-liberica-vm-openjdk17-22.1.0-src.tar.gz",
+    "version": "22.1.0+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "17.0.3+7",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/24.0.2+1-22.0.2+11/bellsoft-liberica-vm-openjdk22.0.2+11-24.0.2+1-linux-amd64.tar.gz",
+    "version": "24.0.2+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "22.0.2+11",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://download.bell-sw.com/vm/23.0.1/bellsoft-liberica-vm-openjdk20.0.2+10-23.0.1+1-src.tar.gz",
+    "version": "23.0.1+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "20.0.2+10",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://download.bell-sw.com/vm/23.1.0/bellsoft-liberica-vm-openjdk21+37-23.1.0+1-linux-amd64.tar.gz",
+    "version": "23.1.0+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "21+37",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/23.1.4+3-21.0.4+9/bellsoft-liberica-vm-openjdk21.0.4+9-23.1.4+3-linux-amd64.tar.gz",
+    "version": "23.1.4+3",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "21.0.4+9",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://download.bell-sw.com/vm/22.3.3/bellsoft-liberica-vm-openjdk11.0.20.1+1-22.3.3+2-linux-amd64.tar.gz",
+    "version": "22.3.3+2",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "11.0.20.1+1",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/23.0.4+1-17.0.11+10/bellsoft-liberica-vm-openjdk17.0.11+10-23.0.4+1-linux-amd64.tar.gz",
+    "version": "23.0.4+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "17.0.11+10",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/24.1.2+1-23.0.2+9/bellsoft-liberica-vm-openjdk23.0.2+9-24.1.2+1-linux-amd64.tar.gz",
+    "version": "24.1.2+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "23.0.2+9",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/23.0.10+1-17.0.17+12/bellsoft-liberica-vm-openjdk17.0.17+12-23.0.10+1-linux-amd64.tar.gz",
+    "version": "23.0.10+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "17.0.17+12",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://download.bell-sw.com/vm/22.3.1/bellsoft-liberica-vm-openjdk11.0.18+10-22.3.1+1-src.tar.gz",
+    "version": "22.3.1+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "11.0.18+10",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://download.bell-sw.com/vm/22.0.0.2/bellsoft-liberica-vm-openjdk17-22.0.0.2-src.tar.gz",
+    "version": "22.0.0.2",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "17.0.2+9",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://download.bell-sw.com/vm/22.0.0.2/bellsoft-liberica-vm-openjdk11-22.0.0.2-linux-amd64.tar.gz",
+    "version": "22.0.0.2",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "11.0.14.1+1",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/25.0.1+2-25.0.1+14/bellsoft-liberica-vm-openjdk25.0.1+14-25.0.1+2-linux-amd64.tar.gz",
+    "version": "25.0.1+2",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "25.0.1+14",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://download.bell-sw.com/vm/21.3.3/bellsoft-liberica-vm-openjdk11.0.16-21.3.3-src.tar.gz",
+    "version": "21.3.3+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "11.0.16+8",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/23.1.5+1-21.0.5+11/bellsoft-liberica-vm-openjdk21.0.5+11-23.1.5+1-linux-amd64.tar.gz",
+    "version": "23.1.5+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "21.0.5+11",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://download.bell-sw.com/vm/22.3.4/bellsoft-liberica-vm-openjdk17.0.9+11-22.3.4+1-linux-amd64.tar.gz",
+    "version": "22.3.4+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "17.0.9+11",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/25.0.0+1-25+37/bellsoft-liberica-vm-openjdk25+37-25.0.0+1-linux-amd64.tar.gz",
+    "version": "25.0.0+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "25+37",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://download.bell-sw.com/vm/22.3.3/bellsoft-liberica-vm-openjdk17.0.8.1+1-22.3.3+2-linux-amd64.tar.gz",
+    "version": "22.3.3+2",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "17.0.8.1+1",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/23.1.3+1-21.0.3+10/bellsoft-liberica-vm-openjdk21.0.3+10-23.1.3+1-linux-amd64.tar.gz",
+    "version": "23.1.3+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "21.0.3+10",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/24.2.0+1-24+37/bellsoft-liberica-vm-openjdk24+37-24.2.0+1-linux-amd64.tar.gz",
+    "version": "24.2.0+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "24+37",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://download.bell-sw.com/vm/23.1.1/bellsoft-liberica-vm-openjdk21.0.1+12-23.1.1+1-linux-amd64.tar.gz",
+    "version": "23.1.1+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "21.0.1+12",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://download.bell-sw.com/vm/21.3.3/bellsoft-liberica-vm-openjdk17.0.4.1-21.3.3-src.tar.gz",
+    "version": "21.3.3+2",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "17.0.4.1+1",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/23.1.11+2-21.0.11+12/bellsoft-liberica-vm-openjdk21.0.11+12-23.1.11+2-linux-amd64.tar.gz",
+    "version": "23.1.11+2",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "21.0.11+12",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://download.bell-sw.com/vm/22.3.2/bellsoft-liberica-vm-openjdk11.0.19+7-22.3.2+1-src.tar.gz",
+    "version": "22.3.2+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "11.0.19+7",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://download.bell-sw.com/vm/22.3.4/bellsoft-liberica-vm-openjdk11.0.21+10-22.3.4+1-src.tar.gz",
+    "version": "22.3.4+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "11.0.21+10",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/25.0.3+2-25.0.3+12/bellsoft-liberica-vm-openjdk25.0.3+12-25.0.3+2-linux-amd64.tar.gz",
+    "version": "25.0.3+2",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "25.0.3+12",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://download.bell-sw.com/vm/21.3.2/bellsoft-liberica-vm-openjdk17.0.3.1+2-21.3.2+2-linux-amd64.tar.gz",
+    "version": "21.3.2+2",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "17.0.3.1+2",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/24.2.1+1-24.0.1+11/bellsoft-liberica-vm-openjdk24.0.1+11-24.2.1+1-linux-amd64.tar.gz",
+    "version": "24.2.1+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "24.0.1+11",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://download.bell-sw.com/vm/22.2.0/bellsoft-liberica-vm-openjdk11.0.16.1+1-22.2.0+3-linux-amd64.tar.gz",
+    "version": "22.2.0+3",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "11.0.16.1+1",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/23.0.6+1-17.0.13+12/bellsoft-liberica-vm-openjdk17.0.13+12-23.0.6+1-linux-amd64.tar.gz",
+    "version": "23.0.6+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "17.0.13+12",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://download.bell-sw.com/vm/23.0.0/bellsoft-liberica-vm-openjdk20.0.1+10-23.0.0+1-linux-amd64.tar.gz",
+    "version": "23.0.0+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "20.0.1+10",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/23.1.10+1-21.0.10+11/bellsoft-liberica-vm-openjdk21.0.10+11-23.1.10+1-linux-amd64.tar.gz",
+    "version": "23.1.10+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "21.0.10+11",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://download.bell-sw.com/vm/22.3.1/bellsoft-liberica-vm-openjdk17.0.6+10-22.3.1+1-src.tar.gz",
+    "version": "22.3.1+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "17.0.6+10",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://download.bell-sw.com/vm/21.3.0/bellsoft-liberica-vm-openjdk17-21.3.0-src.tar.gz",
+    "version": "21.3.0",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "17.0.1+12",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://download.bell-sw.com/vm/21.3.0/bellsoft-liberica-vm-openjdk11-21.3.0-src.tar.gz",
+    "version": "21.3.0",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "11.0.13+8",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/24.0.1+1-22.0.1+10/bellsoft-liberica-vm-openjdk22.0.1+10-24.0.1+1-linux-amd64.tar.gz",
+    "version": "24.0.1+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "22.0.1+10",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/23.0.7+1-17.0.14+10/bellsoft-liberica-vm-openjdk17.0.14+10-23.0.7+1-linux-amd64.tar.gz",
+    "version": "23.0.7+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "17.0.14+10",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://download.bell-sw.com/vm/21.1.0/bellsoft-liberica-vm-openjdk11-21.1.0-src.tar.gz",
+    "version": "21.1.0",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "11.0.11+9",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/23.1.6+1-21.0.6+10/bellsoft-liberica-vm-openjdk21.0.6+10-23.1.6+1-linux-amd64.tar.gz",
+    "version": "23.1.6+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "21.0.6+10",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/25.0.1+1-25.0.1+12/bellsoft-liberica-vm-openjdk25.0.1+12-25.0.1+1-linux-amd64.tar.gz",
+    "version": "25.0.1+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "25.0.1+12",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/23.1.9+1-21.0.9+12/bellsoft-liberica-vm-openjdk21.0.9+12-23.1.9+1-linux-amd64.tar.gz",
+    "version": "23.1.9+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "21.0.9+12",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/22.3.5+1-11.0.22+12/bellsoft-liberica-vm-openjdk11.0.22+12-22.3.5+1-linux-amd64.tar.gz",
+    "version": "22.3.5+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "11.0.22+12",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/23.0.5+1-17.0.12+10/bellsoft-liberica-vm-openjdk17.0.12+10-23.0.5+1-linux-amd64.tar.gz",
+    "version": "23.0.5+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "17.0.12+10",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://download.bell-sw.com/vm/21.3.3.1/bellsoft-liberica-vm-openjdk11.0.17+7-21.3.3.1+1-linux-amd64.tar.gz",
+    "version": "21.3.3.1+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "11.0.17+7",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://download.bell-sw.com/vm/21.2.0/bellsoft-liberica-vm-openjdk11-21.2.0-linux-amd64.tar.gz",
+    "version": "21.2.0",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "11.0.12+7",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/23.0.11+1-17.0.18+11/bellsoft-liberica-vm-openjdk17.0.18+11-23.0.11+1-linux-amd64.tar.gz",
+    "version": "23.0.11+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "17.0.18+11",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/23.1.2+1-21.0.2+14/bellsoft-liberica-vm-openjdk21.0.2+14-23.1.2+1-linux-amd64.tar.gz",
+    "version": "23.1.2+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "21.0.2+14",
+        "embedded": true
+      }
+    ]
+  },
+  {
+    "downloadUrl": "https://github.com/bell-sw/LibericaNIK/releases/download/24.2.2+1-24.0.2+13/bellsoft-liberica-vm-openjdk24.0.2+13-24.2.2+1-linux-amd64.tar.gz",
+    "version": "24.2.2+1",
+    "components": [
+      {
+        "component": "liberica",
+        "version": "24.0.2+13",
+        "embedded": true
+      }
+    ]
+  }
+]

__tests__/distributors/adopt-installer.test.ts

@@ -1,21 +1,59 @@
-import {HttpClient} from '@actions/http-client';
-import {IAdoptAvailableVersions} from '../../src/distributions/adopt/models';
 import {
-  AdoptDistribution,
+  jest,
-  AdoptImplementation
+  describe,
-} from '../../src/distributions/adopt/installer';
+  it,
-import {TemurinDistribution} from '../../src/distributions/temurin/installer';
+  expect,
-import {JavaInstallerOptions} from '../../src/distributions/base-models';
+  beforeEach,
-
+  afterEach,
+  beforeAll,
+  afterAll
+} from '@jest/globals';
+import {HttpClient} from '@actions/http-client';
 import os from 'os';
 
-import manifestData from '../data/adopt.json';
+import manifestData from '../data/adopt.json' with {type: 'json'};
-import * as core from '@actions/core';
+
+// Mock @actions/core before importing source modules that depend on it
+jest.unstable_mockModule('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
+
+// Dynamic imports after mocking
+const core = await import('@actions/core');
+const {AdoptDistribution, AdoptImplementation} =
+  await import('../../src/distributions/adopt/installer.js');
+const {TemurinDistribution} =
+  await import('../../src/distributions/temurin/installer.js');
+
+import type {IAdoptAvailableVersions} from '../../src/distributions/adopt/models.js';
+import type {AdoptImplementation as AdoptImplementationType} from '../../src/distributions/adopt/installer.js';
+import type {JavaInstallerOptions} from '../../src/distributions/base-models.js';
 
 describe('getAvailableVersions', () => {
-  let spyHttpClient: jest.SpyInstance;
+  let spyHttpClient: any;
-  let spyCoreError: jest.SpyInstance;
+  let spyCoreError: any;
-  let spyCoreWarning: jest.SpyInstance;
+  let spyCoreWarning: any;
 
   beforeEach(() => {
     spyHttpClient = jest.spyOn(HttpClient.prototype, 'getJson');
@@ -26,9 +64,9 @@ describe('getAvailableVersions', () => {
     });
 
     // Mock core.error to suppress error logs
-    spyCoreError = jest.spyOn(core, 'error');
+    spyCoreError = core.error as jest.Mock;
     spyCoreError.mockImplementation(() => {});
-    spyCoreWarning = jest.spyOn(core, 'warning');
+    spyCoreWarning = core.warning as jest.Mock;
     spyCoreWarning.mockImplementation(() => {});
   });
 
@@ -123,7 +161,7 @@ describe('getAvailableVersions', () => {
     'build correct url for %s',
     async (
       installerOptions: JavaInstallerOptions,
-      impl: AdoptImplementation,
+      impl: AdoptImplementationType,
       expectedParameters
     ) => {
       const distribution = new AdoptDistribution(installerOptions, impl);
@@ -204,7 +242,7 @@ describe('getAvailableVersions', () => {
     [AdoptImplementation.OpenJ9, 'jre', 'Java_Adopt-OpenJ9_jre']
   ])(
     'find right toolchain folder',
-    (impl: AdoptImplementation, packageType: string, expected: string) => {
+    (impl: AdoptImplementationType, packageType: string, expected: string) => {
       const distribution = new AdoptDistribution(
         {
           version: '11',
@@ -263,11 +301,11 @@ describe('findPackageForDownload', () => {
       url: 'https://example.test/temurin-11.tar.gz'
     };
     const temurinFindPackageForDownload = jest
-      .fn()
+      .fn<any>()
       .mockResolvedValue(temurinRelease);
     const temurinDistribution = {
       findPackageForDownload: temurinFindPackageForDownload
-    } as unknown as TemurinDistribution;
+    } as any;
 
     const distribution = new AdoptDistribution(
       {
@@ -279,7 +317,7 @@ describe('findPackageForDownload', () => {
       AdoptImplementation.Hotspot,
       temurinDistribution
     );
-    const adoptLookupSpy = jest.fn();
+    const adoptLookupSpy = jest.fn<any>();
     distribution['getAvailableVersions'] = adoptLookupSpy;
 
     const resolvedVersion = await distribution['findPackageForDownload']('11');

__tests__/distributors/base-installer.test.ts

@@ -1,19 +1,90 @@
-import * as tc from '@actions/tool-cache';
+import {
-import * as core from '@actions/core';
+  jest,
-import * as util from '../../src/util';
+  describe,
+  it,
+  expect,
+  beforeEach,
+  afterEach,
+  beforeAll,
+  afterAll
+} from '@jest/globals';
+import type {
+  JavaDownloadRelease,
+  JavaInstallerOptions,
+  JavaInstallerResults
+} from '../../src/distributions/base-models.js';
 
 import path from 'path';
 import * as semver from 'semver';
 
-import {JavaBase} from '../../src/distributions/base-installer';
-import {
-  JavaDownloadRelease,
-  JavaInstallerOptions,
-  JavaInstallerResults
-} from '../../src/distributions/base-models';
-
 import os from 'os';
 
+// Mock @actions/core before importing source modules that depend on it
+jest.unstable_mockModule('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
+
+jest.unstable_mockModule('@actions/tool-cache', () => ({
+  find: jest.fn(),
+  findAllVersions: jest.fn(),
+  downloadTool: jest.fn(),
+  extractZip: jest.fn(),
+  extractTar: jest.fn(),
+  extract7z: jest.fn(),
+  extractXar: jest.fn(),
+  cacheDir: jest.fn(),
+  cacheFile: jest.fn(),
+  getManifestFromRepo: jest.fn(),
+  findFromManifest: jest.fn(),
+  evaluateVersions: jest.fn(),
+  HTTPError: class HTTPError extends Error {
+    httpStatusCode: number;
+    constructor(statusCode: number) {
+      super(`HTTP Error: ${statusCode}`);
+      this.httpStatusCode = statusCode;
+    }
+  }
+}));
+
+const real_util_module = await import('../../src/util.js');
+jest.unstable_mockModule('../../src/util.js', () => ({
+  ...real_util_module,
+  extractJdkFile: jest.fn(),
+  getDownloadArchiveExtension: jest.fn(),
+  getToolcachePath: jest.fn(),
+  isJobStatusSuccess: jest.fn(),
+  renameWinArchive: jest.fn(),
+  isVersionSatisfies: real_util_module.isVersionSatisfies,
+  getTempDir: real_util_module.getTempDir
+}));
+
+// Dynamic imports after mocking
+const core = await import('@actions/core');
+const tc = await import('@actions/tool-cache');
+const util = await import('../../src/util.js');
+const {JavaBase} = await import('../../src/distributions/base-installer.js');
+
 class EmptyJavaBase extends JavaBase {
   constructor(installerOptions: JavaInstallerOptions) {
     super('Empty', installerOptions);
@@ -53,12 +124,12 @@ describe('findInToolcache', () => {
   const javaPath = path.join('Java_Empty_jdk', actualJavaVersion, 'x64');
 
   let mockJavaBase: EmptyJavaBase;
-  let spyGetToolcachePath: jest.SpyInstance;
+  let spyGetToolcachePath: any;
-  let spyTcFindAllVersions: jest.SpyInstance;
+  let spyTcFindAllVersions: any;
 
   beforeEach(() => {
-    spyGetToolcachePath = jest.spyOn(util, 'getToolcachePath');
+    spyGetToolcachePath = util.getToolcachePath as jest.Mock;
-    spyTcFindAllVersions = jest.spyOn(tc, 'findAllVersions');
+    spyTcFindAllVersions = tc.findAllVersions as jest.Mock;
   });
 
   afterEach(() => {
@@ -241,17 +312,17 @@ describe('setupJava', () => {
 
   let mockJavaBase: EmptyJavaBase;
 
-  let spyGetToolcachePath: jest.SpyInstance;
+  let spyGetToolcachePath: any;
-  let spyTcFindAllVersions: jest.SpyInstance;
+  let spyTcFindAllVersions: any;
-  let spyCoreDebug: jest.SpyInstance;
+  let spyCoreDebug: any;
-  let spyCoreInfo: jest.SpyInstance;
+  let spyCoreInfo: any;
-  let spyCoreExportVariable: jest.SpyInstance;
+  let spyCoreExportVariable: any;
-  let spyCoreAddPath: jest.SpyInstance;
+  let spyCoreAddPath: any;
-  let spyCoreSetOutput: jest.SpyInstance;
+  let spyCoreSetOutput: any;
-  let spyCoreError: jest.SpyInstance;
+  let spyCoreError: any;
 
   beforeEach(() => {
-    spyGetToolcachePath = jest.spyOn(util, 'getToolcachePath');
+    spyGetToolcachePath = util.getToolcachePath as jest.Mock;
     spyGetToolcachePath.mockImplementation(
       (toolname: string, javaVersion: string, architecture: string) => {
         const semverVersion = new semver.Range(javaVersion);
@@ -269,27 +340,27 @@ describe('setupJava', () => {
       }
     );
 
-    spyTcFindAllVersions = jest.spyOn(tc, 'findAllVersions');
+    spyTcFindAllVersions = tc.findAllVersions as jest.Mock;
     spyTcFindAllVersions.mockReturnValue([installedJavaVersion]);
 
     // Spy on core methods
-    spyCoreDebug = jest.spyOn(core, 'debug');
+    spyCoreDebug = core.debug as jest.Mock;
     spyCoreDebug.mockImplementation(() => undefined);
 
-    spyCoreInfo = jest.spyOn(core, 'info');
+    spyCoreInfo = core.info as jest.Mock;
     spyCoreInfo.mockImplementation(() => undefined);
 
-    spyCoreAddPath = jest.spyOn(core, 'addPath');
+    spyCoreAddPath = core.addPath as jest.Mock;
     spyCoreAddPath.mockImplementation(() => undefined);
 
-    spyCoreExportVariable = jest.spyOn(core, 'exportVariable');
+    spyCoreExportVariable = core.exportVariable as jest.Mock;
     spyCoreExportVariable.mockImplementation(() => undefined);
 
-    spyCoreSetOutput = jest.spyOn(core, 'setOutput');
+    spyCoreSetOutput = core.setOutput as jest.Mock;
     spyCoreSetOutput.mockImplementation(() => undefined);
 
     // Mock core.error to suppress error logs
-    spyCoreError = jest.spyOn(core, 'error');
+    spyCoreError = core.error as jest.Mock;
     spyCoreError.mockImplementation(() => undefined);
 
     jest.spyOn(os, 'arch').mockReturnValue('x86' as ReturnType<typeof os.arch>);
@@ -349,6 +420,29 @@ describe('setupJava', () => {
     expect(spyCoreInfo).not.toHaveBeenCalledWith('Trying to download...');
   });
 
+  it('should resolve the latest version from remote when java-version is "latest", even if a version is cached', async () => {
+    mockJavaBase = new EmptyJavaBase({
+      version: 'latest',
+      architecture: 'x86',
+      packageType: 'jdk',
+      checkLatest: false
+    });
+
+    await expect(mockJavaBase.setupJava()).resolves.toEqual({
+      version: actualJavaVersion,
+      path: javaPathInstalled
+    });
+
+    // `latest` must bypass the tool-cache short-circuit and always resolve remotely
+    expect(spyCoreInfo).toHaveBeenCalledWith(
+      'Trying to resolve the latest version from remote'
+    );
+    expect(spyCoreInfo).toHaveBeenCalledWith('Trying to download...');
+    expect(spyCoreInfo).not.toHaveBeenCalledWith(
+      `Resolved Java ${installedJavaVersion} from tool-cache`
+    );
+  });
+
   it.each([
     [
       {
@@ -673,11 +767,18 @@ describe('normalizeVersion', () => {
   const DummyJavaBase = JavaBase as any;
 
   it.each([
-    ['11', {version: '11', stable: true}],
+    ['11', {version: '11', stable: true, latest: false}],
-    ['11.0', {version: '11.0', stable: true}],
+    ['11.0', {version: '11.0', stable: true, latest: false}],
-    ['11.0.10', {version: '11.0.10', stable: true}],
+    ['11.0.10', {version: '11.0.10', stable: true, latest: false}],
-    ['11-ea', {version: '11', stable: false}],
+    ['11-ea', {version: '11', stable: false, latest: false}],
-    ['11.0.2-ea', {version: '11.0.2', stable: false}]
+    ['11.0.2-ea', {version: '11.0.2', stable: false, latest: false}],
+    ['18.0.1.1', {version: '18.0.1+1', stable: true, latest: false}],
+    ['11.0.9.1', {version: '11.0.9+1', stable: true, latest: false}],
+    ['12.0.2.1.0', {version: '12.0.2+1.0', stable: true, latest: false}],
+    ['18.0.1.1-ea', {version: '18.0.1+1', stable: false, latest: false}],
+    ['latest', {version: 'x', stable: true, latest: true}],
+    ['LATEST', {version: 'x', stable: true, latest: true}],
+    ['  Latest  ', {version: 'x', stable: true, latest: true}]
   ])('normalizeVersion from %s to %s', (input, expected) => {
     expect(DummyJavaBase.prototype.normalizeVersion.call(null, input)).toEqual(
       expected
@@ -692,6 +793,17 @@ describe('normalizeVersion', () => {
       `The string '${version}' is not valid SemVer notation for a Java version. Please check README file for code snippets and more detailed information`
     );
   });
+
+  it.each(['latest-ea', 'latest.1', 'LATEST-EA', '  latest-ea  '])(
+    'normalizeVersion should throw a targeted error for latest combined with a qualifier (%s)',
+    version => {
+      expect(
+        DummyJavaBase.prototype.normalizeVersion.bind(null, version)
+      ).toThrow(
+        `The 'latest' alias resolves stable (GA) releases only and cannot be combined with '-ea' or other qualifiers (received '${version}'). Use 'latest' on its own, or specify a concrete version.`
+      );
+    }
+  );
 });
 
 describe('createVersionNotFoundError', () => {

__tests__/distributors/corretto-installer.test.ts

@@ -1,17 +1,62 @@
+import {
+  jest,
+  describe,
+  it,
+  expect,
+  beforeEach,
+  afterEach,
+  beforeAll,
+  afterAll
+} from '@jest/globals';
+import type {JavaInstallerOptions} from '../../src/distributions/base-models.js';
 import {HttpClient} from '@actions/http-client';
-import {JavaInstallerOptions} from '../../src/distributions/base-models';
 
-import {CorrettoDistribution} from '../../src/distributions/corretto/installer';
-import * as util from '../../src/util';
 import os from 'os';
-import * as core from '@actions/core';
 
-import manifestData from '../data/corretto.json';
+import manifestData from '../data/corretto.json' with {type: 'json'};
+
+// Mock @actions/core before importing source modules that depend on it
+jest.unstable_mockModule('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
+
+const real_util_module = await import('../../src/util.js');
+jest.unstable_mockModule('../../src/util.js', () => ({
+  ...real_util_module,
+  getDownloadArchiveExtension: jest.fn()
+}));
+
+// Dynamic imports after mocking
+const core = await import('@actions/core');
+const {CorrettoDistribution} =
+  await import('../../src/distributions/corretto/installer.js');
+const util = await import('../../src/util.js');
 
 describe('getAvailableVersions', () => {
-  let spyHttpClient: jest.SpyInstance;
+  let spyHttpClient: ReturnType<typeof jest.spyOn>;
-  let spyGetDownloadArchiveExtension: jest.SpyInstance;
+  let spyGetDownloadArchiveExtension: any;
-  let spyCoreError: jest.SpyInstance;
+  let spyCoreError: any;
 
   beforeEach(() => {
     spyHttpClient = jest.spyOn(HttpClient.prototype, 'getJson');
@@ -20,13 +65,11 @@ describe('getAvailableVersions', () => {
       headers: {},
       result: manifestData
     });
-    spyGetDownloadArchiveExtension = jest.spyOn(
+    spyGetDownloadArchiveExtension =
-      util,
+      util.getDownloadArchiveExtension as jest.Mock;
-      'getDownloadArchiveExtension'
-    );
 
     // Mock core.error to suppress error logs
-    spyCoreError = jest.spyOn(core, 'error');
+    spyCoreError = core.error as jest.Mock;
     spyCoreError.mockImplementation(() => {});
   });
 
@@ -161,6 +204,24 @@ describe('getAvailableVersions', () => {
       expect(availableVersion.url).toBe(expectedLink);
     });
 
+    it('with latest resolves to the newest available major version', async () => {
+      const distribution = new CorrettoDistribution({
+        version: 'latest',
+        architecture: 'x64',
+        packageType: 'jdk',
+        checkLatest: false
+      });
+      mockPlatform(distribution, 'linux');
+
+      const availableVersion =
+        await distribution['findPackageForDownload']('x');
+      expect(availableVersion).not.toBeNull();
+      // 18 is the newest major present in the mocked Corretto index
+      expect(availableVersion.url).toBe(
+        'https://corretto.aws/downloads/resources/18.0.0.37.1/amazon-corretto-18.0.0.37.1-linux-x64.tar.gz'
+      );
+    });
+
     it('with unstable version expect to throw not supported error', async () => {
       const version = '18.0.1-ea';
       const distribution = new CorrettoDistribution({
@@ -235,7 +296,7 @@ describe('getAvailableVersions', () => {
   });
 
   const mockPlatform = (
-    distribution: CorrettoDistribution,
+    distribution: InstanceType<typeof CorrettoDistribution>,
     platform: string
   ) => {
     distribution['getPlatformOption'] = () => platform;

__tests__/distributors/dragonwell-installer.test.ts

@@ -1,14 +1,59 @@
+import {
+  jest,
+  describe,
+  it,
+  expect,
+  beforeEach,
+  afterEach,
+  beforeAll,
+  afterAll
+} from '@jest/globals';
 import {HttpClient} from '@actions/http-client';
-import {DragonwellDistribution} from '../../src/distributions/dragonwell/installer';
-import * as utils from '../../src/util';
-import * as core from '@actions/core';
 
-import manifestData from '../data/dragonwell.json';
+import manifestData from '../data/dragonwell.json' with {type: 'json'};
+
+// Mock @actions/core before importing source modules that depend on it
+jest.unstable_mockModule('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
+
+const real_util_module = await import('../../src/util.js');
+jest.unstable_mockModule('../../src/util.js', () => ({
+  ...real_util_module,
+  getDownloadArchiveExtension: jest.fn()
+}));
+
+// Dynamic imports after mocking
+const core = await import('@actions/core');
+const {DragonwellDistribution} =
+  await import('../../src/distributions/dragonwell/installer.js');
+const utils = await import('../../src/util.js');
 
 describe('getAvailableVersions', () => {
-  let spyHttpClient: jest.SpyInstance;
+  let spyHttpClient: any;
-  let spyUtilGetDownloadArchiveExtension: jest.SpyInstance;
+  let spyUtilGetDownloadArchiveExtension: any;
-  let spyCoreError: jest.SpyInstance;
+  let spyCoreError: any;
 
   beforeEach(() => {
     spyHttpClient = jest.spyOn(HttpClient.prototype, 'getJson');
@@ -18,14 +63,12 @@ describe('getAvailableVersions', () => {
       result: manifestData
     });
 
-    spyUtilGetDownloadArchiveExtension = jest.spyOn(
+    spyUtilGetDownloadArchiveExtension =
-      utils,
+      utils.getDownloadArchiveExtension as jest.Mock;
-      'getDownloadArchiveExtension'
-    );
     spyUtilGetDownloadArchiveExtension.mockReturnValue('tar.gz');
 
     // Mock core.error to suppress error logs
-    spyCoreError = jest.spyOn(core, 'error');
+    spyCoreError = core.error as jest.Mock;
     spyCoreError.mockImplementation(() => {});
   });
 
@@ -36,7 +79,7 @@ describe('getAvailableVersions', () => {
   });
 
   const mockPlatform = (
-    distribution: DragonwellDistribution,
+    distribution: InstanceType<typeof DragonwellDistribution>,
     platform: string
   ) => {
     distribution['getPlatformOption'] = () => platform;

__tests__/distributors/graalvm-installer.test.ts

@@ -1,53 +1,116 @@
-import * as core from '@actions/core';
-import * as tc from '@actions/tool-cache';
-import * as http from '@actions/http-client';
-import fs from 'fs';
-import path from 'path';
 import {
-  GraalVMCommunityDistribution,
+  jest,
-  GraalVMDistribution
+  describe,
-} from '../../src/distributions/graalvm/installer';
+  it,
-import {getJavaDistribution} from '../../src/distributions/distribution-factory';
+  expect,
-import {JavaInstallerOptions} from '../../src/distributions/base-models';
+  beforeEach,
-import * as util from '../../src/util';
+  beforeAll,
+  afterAll
+} from '@jest/globals';
+import path from 'path';
 
-jest.mock('@actions/core');
+// Mock @actions modules
-jest.mock('@actions/tool-cache');
+jest.unstable_mockModule('@actions/core', () => ({
-jest.mock('@actions/http-client');
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
 
-jest.mock('../../src/util', () => ({
+jest.unstable_mockModule('@actions/tool-cache', () => ({
-  ...jest.requireActual('../../src/util'),
+  find: jest.fn(),
+  findAllVersions: jest.fn(),
+  downloadTool: jest.fn(),
+  extractZip: jest.fn(),
+  extractTar: jest.fn(),
+  extract7z: jest.fn(),
+  extractXar: jest.fn(),
+  cacheDir: jest.fn(),
+  cacheFile: jest.fn(),
+  getManifestFromRepo: jest.fn(),
+  findFromManifest: jest.fn(),
+  evaluateVersions: jest.fn()
+}));
+
+jest.unstable_mockModule('@actions/http-client', () => ({
+  HttpClient: jest.fn().mockImplementation(() => ({
+    getJson: jest.fn(),
+    head: jest.fn(),
+    get: jest.fn()
+  })),
+  HttpClientError: class HttpClientError extends Error {
+    statusCode: number;
+    constructor(message: string, statusCode: number) {
+      super(message);
+      this.statusCode = statusCode;
+    }
+  },
+  HttpCodes: {OK: 200, NotFound: 404, Unauthorized: 401, Forbidden: 403}
+}));
+
+// Get real util first, then mock specific functions
+const realUtil = await import('../../src/util.js');
+jest.unstable_mockModule('../../src/util.js', () => ({
+  ...realUtil,
   extractJdkFile: jest.fn(),
   getDownloadArchiveExtension: jest.fn(),
   renameWinArchive: jest.fn(),
   getGitHubHttpHeaders: jest.fn().mockReturnValue({Accept: 'application/json'})
 }));
 
-jest.mock('fs', () => ({
+const real_fs_module = await import('fs');
-  ...jest.requireActual('fs'),
+jest.unstable_mockModule('fs', () => ({
+  ...real_fs_module,
+  default: {
+    ...real_fs_module.default,
+    readdirSync: jest.fn(),
+    existsSync: jest.fn()
+  },
   readdirSync: jest.fn(),
   existsSync: jest.fn()
 }));
 
+// Dynamic imports after mocking
+const core = await import('@actions/core');
+const tc = await import('@actions/tool-cache');
+const http = await import('@actions/http-client');
+const fs = (await import('fs')).default;
+const util = await import('../../src/util.js');
+const {GraalVMCommunityDistribution, GraalVMDistribution} =
+  await import('../../src/distributions/graalvm/installer.js');
+const {getJavaDistribution} =
+  await import('../../src/distributions/distribution-factory.js');
+
+import type {JavaInstallerOptions} from '../../src/distributions/base-models.js';
+
 beforeAll(() => {
   process.env.NODE_ENV = 'test';
-
-  if (!jest.isMockFunction(http.HttpClient)) {
-    throw new Error('HTTP client must be mocked in tests!');
-  }
-
-  if (!jest.isMockFunction(tc.downloadTool)) {
-    throw new Error('Tool cache downloadTool must be mocked in tests!');
-  }
-
   console.log('✅ All external dependencies are properly mocked');
 });
 
 describe('GraalVMDistribution', () => {
-  let distribution: GraalVMDistribution;
+  let distribution: InstanceType<typeof GraalVMDistribution>;
-  let communityDistribution: GraalVMCommunityDistribution;
+  let communityDistribution: InstanceType<typeof GraalVMCommunityDistribution>;
-  let mockHttpClient: jest.Mocked<http.HttpClient>;
+  let mockHttpClient: any;
-  let spyCoreError: jest.SpyInstance;
+  let spyCoreError: any;
 
   const defaultOptions: JavaInstallerOptions = {
     version: '17',
@@ -62,23 +125,20 @@ describe('GraalVMDistribution', () => {
     distribution = new GraalVMDistribution(defaultOptions);
     communityDistribution = new GraalVMCommunityDistribution(defaultOptions);
 
-    mockHttpClient = new http.HttpClient() as jest.Mocked<http.HttpClient>;
+    mockHttpClient = new (http.HttpClient as any)();
     (distribution as any).http = mockHttpClient;
     (communityDistribution as any).http = mockHttpClient;
 
-    (util.getDownloadArchiveExtension as jest.Mock).mockReturnValue('tar.gz');
+    (util.getDownloadArchiveExtension as jest.Mock<any>).mockReturnValue(
+      'tar.gz'
+    );
 
     // Mock core.error to suppress error logs
-    spyCoreError = jest.spyOn(core, 'error');
+    spyCoreError = core.error as jest.Mock;
     spyCoreError.mockImplementation(() => {});
   });
 
   afterAll(() => {
-    expect(jest.isMockFunction(http.HttpClient)).toBe(true);
-
-    expect(jest.isMockFunction(tc.downloadTool)).toBe(true);
-    expect(jest.isMockFunction(tc.cacheDir)).toBe(true);
-
     jest.restoreAllMocks();
     jest.clearAllMocks();
   });
@@ -113,20 +173,24 @@ describe('GraalVMDistribution', () => {
     };
 
     beforeEach(() => {
-      (tc.downloadTool as jest.Mock).mockResolvedValue('/tmp/archive.tar.gz');
+      (tc.downloadTool as any).mockResolvedValue('/tmp/archive.tar.gz');
-      (tc.cacheDir as jest.Mock).mockResolvedValue('/cached/java/path');
+      (tc.cacheDir as any).mockResolvedValue('/cached/java/path');
 
-      (util.extractJdkFile as jest.Mock).mockResolvedValue('/tmp/extracted');
+      (util.extractJdkFile as any).mockResolvedValue('/tmp/extracted');
 
       // Mock renameWinArchive - it returns the same path (no renaming)
-      (util.renameWinArchive as jest.Mock).mockImplementation((p: string) => p);
+      (util.renameWinArchive as any).mockImplementation((p: string) => p);
 
-      (util.getDownloadArchiveExtension as jest.Mock).mockReturnValue('tar.gz');
+      (util.getDownloadArchiveExtension as jest.Mock<any>).mockReturnValue(
+        'tar.gz'
+      );
 
       // Mock fs.existsSync to return true for extracted path
-      (fs.existsSync as jest.Mock).mockReturnValue(true);
+      (fs.existsSync as jest.Mock<any>).mockReturnValue(true);
 
-      (fs.readdirSync as jest.Mock).mockReturnValue(['graalvm-jdk-17.0.5']);
+      (fs.readdirSync as jest.Mock<any>).mockReturnValue([
+        'graalvm-jdk-17.0.5'
+      ]);
 
       jest
         .spyOn(distribution as any, 'getToolcacheVersionName')
@@ -173,7 +237,7 @@ describe('GraalVMDistribution', () => {
     });
 
     it('should throw error when extracted path does not exist', async () => {
-      (fs.existsSync as jest.Mock).mockReturnValue(false);
+      (fs.existsSync as jest.Mock<any>).mockReturnValue(false);
 
       await expect(
         (distribution as any).downloadTool(javaRelease)
@@ -187,8 +251,8 @@ describe('GraalVMDistribution', () => {
     });
 
     it('should throw error when extracted directory is empty', async () => {
-      (fs.existsSync as jest.Mock).mockReturnValue(true);
+      (fs.existsSync as jest.Mock<any>).mockReturnValue(true);
-      (fs.readdirSync as jest.Mock).mockReturnValue([]);
+      (fs.readdirSync as jest.Mock<any>).mockReturnValue([]);
 
       await expect(
         (distribution as any).downloadTool(javaRelease)
@@ -203,7 +267,7 @@ describe('GraalVMDistribution', () => {
 
     it('should handle download errors', async () => {
       const downloadError = new Error('Network error during download');
-      (tc.downloadTool as jest.Mock).mockRejectedValue(downloadError);
+      (tc.downloadTool as any).mockRejectedValue(downloadError);
 
       await expect(
         (distribution as any).downloadTool(javaRelease)
@@ -216,7 +280,7 @@ describe('GraalVMDistribution', () => {
 
     it('should handle extraction errors', async () => {
       const extractError = new Error('Failed to extract archive');
-      (util.extractJdkFile as jest.Mock).mockRejectedValue(extractError);
+      (util.extractJdkFile as any).mockRejectedValue(extractError);
 
       await expect(
         (distribution as any).downloadTool(javaRelease)
@@ -229,8 +293,10 @@ describe('GraalVMDistribution', () => {
 
     it('should handle different archive extensions', async () => {
       // Test with a .zip file
-      (util.getDownloadArchiveExtension as jest.Mock).mockReturnValue('zip');
+      (util.getDownloadArchiveExtension as jest.Mock<any>).mockReturnValue(
-      (tc.downloadTool as jest.Mock).mockResolvedValue('/tmp/archive.zip');
+        'zip'
+      );
+      (tc.downloadTool as any).mockResolvedValue('/tmp/archive.zip');
 
       const zipRelease = {
         version: '17.0.5',
@@ -309,7 +375,7 @@ describe('GraalVMDistribution', () => {
       it('should construct correct URL for specific version', async () => {
         const mockResponse = {
           message: {statusCode: 200}
-        } as http.HttpClientResponse;
+        } as any;
         mockHttpClient.head.mockResolvedValue(mockResponse);
 
         const result = await (distribution as any).findPackageForDownload(
@@ -326,7 +392,7 @@ describe('GraalVMDistribution', () => {
       it('should construct correct URL for major version (latest)', async () => {
         const mockResponse = {
           message: {statusCode: 200}
-        } as http.HttpClientResponse;
+        } as any;
         mockHttpClient.head.mockResolvedValue(mockResponse);
 
         const result = await (distribution as any).findPackageForDownload('21');
@@ -351,6 +417,61 @@ describe('GraalVMDistribution', () => {
         );
       });
 
+      describe('latest alias', () => {
+        it('resolves the newest major version from the Adoptium API', async () => {
+          const latestDistribution = new GraalVMDistribution({
+            ...defaultOptions,
+            version: 'latest'
+          });
+          (latestDistribution as any).http = mockHttpClient;
+          jest
+            .spyOn(latestDistribution, 'getPlatform')
+            .mockReturnValue('linux');
+          mockHttpClient.getJson.mockResolvedValue({
+            statusCode: 200,
+            result: {most_recent_feature_release: 25},
+            headers: {}
+          });
+          mockHttpClient.head.mockResolvedValue({
+            message: {statusCode: 200}
+          });
+
+          const result = await (
+            latestDistribution as any
+          ).findPackageForDownload('x');
+
+          expect(result).toEqual({
+            url: 'https://download.oracle.com/graalvm/25/latest/graalvm-jdk-25_linux-x64_bin.tar.gz',
+            version: '25'
+          });
+        });
+
+        it('throws an actionable error when the latest major is not yet available', async () => {
+          const latestDistribution = new GraalVMDistribution({
+            ...defaultOptions,
+            version: 'latest'
+          });
+          (latestDistribution as any).http = mockHttpClient;
+          jest
+            .spyOn(latestDistribution, 'getPlatform')
+            .mockReturnValue('linux');
+          mockHttpClient.getJson.mockResolvedValue({
+            statusCode: 200,
+            result: {most_recent_feature_release: 25},
+            headers: {}
+          });
+          mockHttpClient.head.mockResolvedValue({
+            message: {statusCode: 404}
+          });
+
+          await expect(
+            (latestDistribution as any).findPackageForDownload('x')
+          ).rejects.toThrow(
+            /is not yet available for the GraalVM distribution/
+          );
+        });
+      });
+
       it('should throw error for JDK versions less than 17', async () => {
         await expect(
           (distribution as any).findPackageForDownload('11')
@@ -374,7 +495,7 @@ describe('GraalVMDistribution', () => {
       it('should throw error when file not found (404)', async () => {
         const mockResponse = {
           message: {statusCode: 404}
-        } as http.HttpClientResponse;
+        } as any;
         mockHttpClient.head.mockResolvedValue(mockResponse);
 
         // Verify the error is thrown with the expected message
@@ -395,7 +516,7 @@ describe('GraalVMDistribution', () => {
       it('should throw error for unauthorized access (401)', async () => {
         const mockResponse = {
           message: {statusCode: 401}
-        } as http.HttpClientResponse;
+        } as any;
         mockHttpClient.head.mockResolvedValue(mockResponse);
 
         await expect(
@@ -408,7 +529,7 @@ describe('GraalVMDistribution', () => {
       it('should throw error for forbidden access (403)', async () => {
         const mockResponse = {
           message: {statusCode: 403}
-        } as http.HttpClientResponse;
+        } as any;
         mockHttpClient.head.mockResolvedValue(mockResponse);
 
         await expect(
@@ -424,7 +545,7 @@ describe('GraalVMDistribution', () => {
             statusCode: 500,
             statusMessage: 'Internal Server Error'
           }
-        } as http.HttpClientResponse;
+        } as any;
         mockHttpClient.head.mockResolvedValue(mockResponse);
 
         await expect(
@@ -437,7 +558,7 @@ describe('GraalVMDistribution', () => {
       it('should throw error for other HTTP errors without status message', async () => {
         const mockResponse = {
           message: {statusCode: 500}
-        } as http.HttpClientResponse;
+        } as any;
         mockHttpClient.head.mockResolvedValue(mockResponse);
 
         await expect(
@@ -713,7 +834,7 @@ describe('GraalVMDistribution', () => {
       }
     ];
 
-    let fetchEASpy: jest.SpyInstance;
+    let fetchEASpy: any;
 
     beforeEach(() => {
       fetchEASpy = jest.spyOn(distribution as any, 'fetchEAJson');
@@ -932,7 +1053,7 @@ describe('GraalVMDistribution', () => {
 
         const mockResponse = {
           message: {statusCode: 200}
-        } as http.HttpClientResponse;
+        } as any;
         mockHttpClient.head.mockResolvedValue(mockResponse);
 
         const result = await (distribution as any).findPackageForDownload('17');
@@ -960,7 +1081,7 @@ describe('GraalVMDistribution', () => {
 
         const mockResponse = {
           message: {statusCode: 200}
-        } as http.HttpClientResponse;
+        } as any;
         mockHttpClient.head.mockResolvedValue(mockResponse);
 
         const result = await (distribution as any).findPackageForDownload('17');
@@ -1049,6 +1170,60 @@ describe('GraalVMDistribution', () => {
         });
       });
 
+      it('resolves latest to the newest GA across all Community majors without calling Adoptium', async () => {
+        const latestCommunity = new GraalVMCommunityDistribution({
+          ...defaultOptions,
+          version: 'latest'
+        });
+        (latestCommunity as any).http = mockHttpClient;
+        jest.spyOn(latestCommunity, 'getPlatform').mockReturnValue('linux');
+
+        mockHttpClient.getJson.mockResolvedValue({
+          result: [
+            {
+              draft: false,
+              prerelease: false,
+              assets: [
+                {
+                  name: 'graalvm-community-jdk-21.0.2_linux-x64_bin.tar.gz',
+                  browser_download_url:
+                    'https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-21.0.2/graalvm-community-jdk-21.0.2_linux-x64_bin.tar.gz'
+                }
+              ]
+            },
+            {
+              draft: false,
+              prerelease: false,
+              assets: [
+                {
+                  name: 'graalvm-community-jdk-24.0.1_linux-x64_bin.tar.gz',
+                  browser_download_url:
+                    'https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-24.0.1/graalvm-community-jdk-24.0.1_linux-x64_bin.tar.gz'
+                }
+              ]
+            }
+          ],
+          statusCode: 200,
+          headers: {}
+        });
+
+        const result = await (latestCommunity as any).findPackageForDownload(
+          'x'
+        );
+
+        expect(result).toEqual({
+          url: 'https://github.com/graalvm/graalvm-ce-builds/releases/download/jdk-24.0.1/graalvm-community-jdk-24.0.1_linux-x64_bin.tar.gz',
+          version: '24.0.1'
+        });
+        // The Community release list is authoritative, so the Adoptium
+        // most_recent_feature_release endpoint must not be consulted.
+        expect(mockHttpClient.getJson).toHaveBeenCalledTimes(1);
+        expect(mockHttpClient.getJson).toHaveBeenCalledWith(
+          expect.stringContaining('graalvm-ce-builds/releases'),
+          expect.anything()
+        );
+      });
+
       it('should reject GraalVM Community early access requests', async () => {
         (communityDistribution as any).stable = false;
 

__tests__/distributors/jetbrains-installer.test.ts

@@ -1,14 +1,53 @@
+import {
+  jest,
+  describe,
+  it,
+  expect,
+  beforeEach,
+  afterEach,
+  beforeAll,
+  afterAll
+} from '@jest/globals';
 import https from 'https';
 import {HttpClient} from '@actions/http-client';
-import {JetBrainsDistribution} from '../../src/distributions/jetbrains/installer';
 
-import manifestData from '../data/jetbrains.json';
+import manifestData from '../data/jetbrains.json' with {type: 'json'};
 import os from 'os';
-import * as core from '@actions/core';
+
+// Mock @actions/core before importing source modules that depend on it
+jest.unstable_mockModule('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
+
+// Dynamic imports after mocking
+const core = await import('@actions/core');
+const {JetBrainsDistribution} =
+  await import('../../src/distributions/jetbrains/installer.js');
 
 describe('getAvailableVersions', () => {
-  let spyHttpClient: jest.SpyInstance;
+  let spyHttpClient: any;
-  let spyCoreError: jest.SpyInstance;
+  let spyCoreError: any;
 
   beforeEach(() => {
     spyHttpClient = jest.spyOn(HttpClient.prototype, 'getJson');
@@ -19,7 +58,7 @@ describe('getAvailableVersions', () => {
     });
 
     // Mock core.error to suppress error logs
-    spyCoreError = jest.spyOn(core, 'error');
+    spyCoreError = core.error as jest.Mock;
     spyCoreError.mockImplementation(() => {});
   });
 
@@ -31,10 +70,16 @@ describe('getAvailableVersions', () => {
 
   it('load available versions', async () => {
     spyHttpClient = jest.spyOn(HttpClient.prototype, 'getJson');
-    spyHttpClient.mockReturnValueOnce({
+    spyHttpClient
+      .mockReturnValueOnce({
         statusCode: 200,
         headers: {},
         result: manifestData as any
+      })
+      .mockReturnValue({
+        statusCode: 200,
+        headers: {},
+        result: []
       });
 
     const distribution = new JetBrainsDistribution({

__tests__/distributors/kona-installer.test.ts

@@ -1,6 +1,6 @@
-import {KonaDistribution} from '../../src/distributions/kona/installer';
+import {KonaDistribution} from '../../src/distributions/kona/installer.js';
 
-import manifestData from '../data/kona.json';
+import manifestData from '../data/kona.json' with {type: 'json'};
 
 function mockDistr(
   version: string,

__tests__/distributors/liberica-installer.test.ts

@@ -1,17 +1,56 @@
-import {LibericaDistributions} from '../../src/distributions/liberica/installer';
 import {
+  jest,
+  describe,
+  it,
+  expect,
+  beforeEach,
+  afterEach,
+  beforeAll,
+  afterAll
+} from '@jest/globals';
+import type {
   ArchitectureOptions,
   LibericaVersion
-} from '../../src/distributions/liberica/models';
+} from '../../src/distributions/liberica/models.js';
 import {HttpClient} from '@actions/http-client';
 import os from 'os';
-import * as core from '@actions/core';
 
-import manifestData from '../data/liberica.json';
+import manifestData from '../data/liberica.json' with {type: 'json'};
+
+// Mock @actions/core before importing source modules that depend on it
+jest.unstable_mockModule('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
+
+// Dynamic imports after mocking
+const core = await import('@actions/core');
+const {LibericaDistributions} =
+  await import('../../src/distributions/liberica/installer.js');
 
 describe('getAvailableVersions', () => {
-  let spyHttpClient: jest.SpyInstance;
+  let spyHttpClient: any;
-  let spyCoreError: jest.SpyInstance;
+  let spyCoreError: any;
 
   beforeEach(() => {
     spyHttpClient = jest.spyOn(HttpClient.prototype, 'getJson');
@@ -22,7 +61,7 @@ describe('getAvailableVersions', () => {
     });
 
     // Mock core.error to suppress error logs
-    spyCoreError = jest.spyOn(core, 'error');
+    spyCoreError = core.error as jest.Mock;
     spyCoreError.mockImplementation(() => {});
   });
 
@@ -184,7 +223,7 @@ describe('getArchitectureOptions', () => {
 });
 
 describe('findPackageForDownload', () => {
-  let distribution: LibericaDistributions;
+  let distribution: InstanceType<typeof LibericaDistributions>;
 
   beforeEach(() => {
     distribution = new LibericaDistributions({

__tests__/distributors/liberica-linux-installer.test.ts

@@ -1,17 +1,56 @@
-import {LibericaDistributions} from '../../src/distributions/liberica/installer';
 import {
+  jest,
+  describe,
+  it,
+  expect,
+  beforeEach,
+  afterEach,
+  beforeAll,
+  afterAll
+} from '@jest/globals';
+import type {
   ArchitectureOptions,
   LibericaVersion
-} from '../../src/distributions/liberica/models';
+} from '../../src/distributions/liberica/models.js';
 import {HttpClient} from '@actions/http-client';
 import os from 'os';
-import * as core from '@actions/core';
 
-import manifestData from '../data/liberica-linux.json';
+import manifestData from '../data/liberica-linux.json' with {type: 'json'};
+
+// Mock @actions/core before importing source modules that depend on it
+jest.unstable_mockModule('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
+
+// Dynamic imports after mocking
+const core = await import('@actions/core');
+const {LibericaDistributions} =
+  await import('../../src/distributions/liberica/installer.js');
 
 describe('getAvailableVersions', () => {
-  let spyHttpClient: jest.SpyInstance;
+  let spyHttpClient: any;
-  let spyCoreError: jest.SpyInstance;
+  let spyCoreError: any;
 
   beforeEach(() => {
     spyHttpClient = jest.spyOn(HttpClient.prototype, 'getJson');
@@ -22,7 +61,7 @@ describe('getAvailableVersions', () => {
     });
 
     // Mock core.error to suppress error logs
-    spyCoreError = jest.spyOn(core, 'error');
+    spyCoreError = core.error as jest.Mock;
     spyCoreError.mockImplementation(() => {});
   });
 
@@ -184,7 +223,7 @@ describe('getArchitectureOptions', () => {
 });
 
 describe('findPackageForDownload', () => {
-  let distribution: LibericaDistributions;
+  let distribution: InstanceType<typeof LibericaDistributions>;
 
   beforeEach(() => {
     distribution = new LibericaDistributions({

__tests__/distributors/liberica-nik-installer.test.ts

@@ -0,0 +1,219 @@
+import {jest, describe, it, expect, beforeEach, afterEach} from '@jest/globals';
+import type {
+  ArchitectureOptions,
+  NikVersion
+} from '../../src/distributions/liberica-nik/models.js';
+import {HttpClient} from '@actions/http-client';
+
+import manifestData from '../data/liberica-nik.json' with {type: 'json'};
+
+// Mock @actions/core before importing source modules that depend on it
+jest.unstable_mockModule('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
+
+// Dynamic imports after mocking
+const {LibericaNikDistributions} =
+  await import('../../src/distributions/liberica-nik/installer.js');
+
+const ADDITIONAL_PARAMS =
+  '&installation-type=archive&fields=downloadUrl%2Cversion%2Ccomponents%2Ccomponent%2Cembedded';
+
+describe('getAvailableVersions', () => {
+  let spyHttpClient: any;
+
+  beforeEach(() => {
+    spyHttpClient = jest.spyOn(HttpClient.prototype, 'getJson');
+    spyHttpClient.mockReturnValue({
+      statusCode: 200,
+      headers: {},
+      result: manifestData as NikVersion[]
+    });
+  });
+
+  afterEach(() => {
+    jest.resetAllMocks();
+    jest.clearAllMocks();
+    jest.restoreAllMocks();
+  });
+
+  it.each([
+    [
+      {version: '21', architecture: 'x64', packageType: 'jdk'},
+      'bundle-type=standard&bitness=64&arch=x86&build-type=all'
+    ],
+    [
+      {version: '21-ea', architecture: 'x64', packageType: 'jdk'},
+      'bundle-type=standard&bitness=64&arch=x86&build-type=ea'
+    ],
+    [
+      {version: '21', architecture: 'aarch64', packageType: 'jdk'},
+      'bundle-type=standard&bitness=64&arch=arm&build-type=all'
+    ],
+    [
+      {version: '21', architecture: 'x64', packageType: 'jdk+fx'},
+      'bundle-type=full&bitness=64&arch=x86&build-type=all'
+    ]
+  ])('build correct url for %s -> %s', async (input, urlParams) => {
+    const distribution = new LibericaNikDistributions({
+      ...input,
+      checkLatest: false
+    });
+    distribution['getPlatformOption'] = () => 'linux';
+    const buildUrl = `https://api.bell-sw.com/v1/nik/releases?os=linux&${urlParams}${ADDITIONAL_PARAMS}`;
+
+    await distribution['getAvailableVersions']();
+
+    expect(spyHttpClient.mock.calls).toHaveLength(1);
+    expect(spyHttpClient.mock.calls[0][0]).toBe(buildUrl);
+  });
+
+  it('load available versions', async () => {
+    const distribution = new LibericaNikDistributions({
+      version: '21',
+      architecture: 'x64',
+      packageType: 'jdk',
+      checkLatest: false
+    });
+    const availableVersions = await distribution['getAvailableVersions']();
+    expect(availableVersions).toEqual(manifestData);
+  });
+});
+
+describe('getArchitectureOptions', () => {
+  it.each([
+    ['x64', {bitness: '64', arch: 'x86'}],
+    ['aarch64', {bitness: '64', arch: 'arm'}]
+  ] as [string, ArchitectureOptions][])(
+    'parse architecture %s -> %s',
+    (input, expected) => {
+      const distributions = new LibericaNikDistributions({
+        architecture: input,
+        checkLatest: false,
+        packageType: 'jdk',
+        version: '21'
+      });
+
+      expect(distributions['getArchitectureOptions']()).toEqual(expected);
+    }
+  );
+
+  it.each(['x86', 'armv7', 's390x'])('not support architecture %s', input => {
+    const distributions = new LibericaNikDistributions({
+      architecture: input,
+      checkLatest: false,
+      packageType: 'jdk',
+      version: '21'
+    });
+
+    expect(() => distributions['getArchitectureOptions']()).toThrow(
+      /Architecture '\w+' is not supported\. Supported architectures: .*/
+    );
+  });
+});
+
+describe('findPackageForDownload', () => {
+  let distribution: InstanceType<typeof LibericaNikDistributions>;
+
+  beforeEach(() => {
+    distribution = new LibericaNikDistributions({
+      version: '',
+      architecture: 'x64',
+      packageType: 'jdk',
+      checkLatest: false
+    });
+    distribution['getAvailableVersions'] = async () => manifestData;
+  });
+
+  // The user's java-version resolves against the embedded JDK version, not
+  // NIK's own GraalVM version.
+  it.each([
+    ['21', '21.0.11+12'],
+    ['17', '17.0.19+12'],
+    ['25', '25.0.3+12'],
+    ['11', '11.0.22+12'],
+    ['21.0.2', '21.0.2+14'],
+    ['23', '23.0.2+9'],
+    ['20.x', '20.0.2+10'],
+    ['25.0.1', '25.0.1+16']
+  ])('version is %s -> %s', async (input, expected) => {
+    const result = await distribution['findPackageForDownload'](input);
+    expect(result.version).toBe(expected);
+  });
+
+  it('should throw an error', async () => {
+    await expect(distribution['findPackageForDownload']('7')).rejects.toThrow(
+      /No matching version found for SemVer/
+    );
+  });
+});
+
+describe('getPlatformOption', () => {
+  const distributions = new LibericaNikDistributions({
+    architecture: 'x64',
+    version: '21',
+    packageType: 'jdk',
+    checkLatest: false
+  });
+
+  it.each([
+    ['linux', 'linux'],
+    ['darwin', 'macos'],
+    ['win32', 'windows'],
+    ['cygwin', 'windows']
+  ])('os version %s -> %s', (input, expected) => {
+    const actual = distributions['getPlatformOption'](input as NodeJS.Platform);
+
+    expect(actual).toEqual(expected);
+  });
+
+  it.each(['sunos', 'aix', 'android', 'freebsd'])(
+    'not support os version %s',
+    input => {
+      expect(() =>
+        distributions['getPlatformOption'](input as NodeJS.Platform)
+      ).toThrow(/Platform '\w+' is not supported\. Supported platforms: .+/);
+    }
+  );
+});
+
+describe('convertVersionToSemver', () => {
+  const distributions = new LibericaNikDistributions({
+    architecture: 'x64',
+    version: '21',
+    packageType: 'jdk',
+    checkLatest: false
+  });
+
+  it.each([
+    ['25.0.1+16', '25.0.1+16'],
+    ['21+37', '21.0.0+37'],
+    ['23+38', '23.0.0+38'],
+    ['11.0.15.1+2', '11.0.15+1.2'],
+    ['17.0.5', '17.0.5']
+  ])('%s -> %s', (input, expected) => {
+    const actual = distributions['convertVersionToSemver'](input);
+    expect(actual).toEqual(expected);
+  });
+});

__tests__/distributors/liberica-windows-installer.test.ts

@@ -1,17 +1,56 @@
-import {LibericaDistributions} from '../../src/distributions/liberica/installer';
 import {
+  jest,
+  describe,
+  it,
+  expect,
+  beforeEach,
+  afterEach,
+  beforeAll,
+  afterAll
+} from '@jest/globals';
+import type {
   ArchitectureOptions,
   LibericaVersion
-} from '../../src/distributions/liberica/models';
+} from '../../src/distributions/liberica/models.js';
 import {HttpClient} from '@actions/http-client';
 import os from 'os';
-import * as core from '@actions/core';
 
-import manifestData from '../data/liberica-windows.json';
+import manifestData from '../data/liberica-windows.json' with {type: 'json'};
+
+// Mock @actions/core before importing source modules that depend on it
+jest.unstable_mockModule('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
+
+// Dynamic imports after mocking
+const core = await import('@actions/core');
+const {LibericaDistributions} =
+  await import('../../src/distributions/liberica/installer.js');
 
 describe('getAvailableVersions', () => {
-  let spyHttpClient: jest.SpyInstance;
+  let spyHttpClient: any;
-  let spyCoreError: jest.SpyInstance;
+  let spyCoreError: any;
 
   beforeEach(() => {
     spyHttpClient = jest.spyOn(HttpClient.prototype, 'getJson');
@@ -21,7 +60,7 @@ describe('getAvailableVersions', () => {
       result: manifestData as LibericaVersion[]
     });
     // Mock core.error to suppress error logs
-    spyCoreError = jest.spyOn(core, 'error');
+    spyCoreError = core.error as jest.Mock;
     spyCoreError.mockImplementation(() => {});
   });
 
@@ -183,7 +222,7 @@ describe('getArchitectureOptions', () => {
 });
 
 describe('findPackageForDownload', () => {
-  let distribution: LibericaDistributions;
+  let distribution: InstanceType<typeof LibericaDistributions>;
 
   beforeEach(() => {
     distribution = new LibericaDistributions({

__tests__/distributors/local-installer.test.ts

@@ -1,37 +1,101 @@
+import {
+  jest,
+  describe,
+  it,
+  expect,
+  beforeEach,
+  afterEach,
+  beforeAll,
+  afterAll
+} from '@jest/globals';
 import fs from 'fs';
 
-import * as tc from '@actions/tool-cache';
-import * as core from '@actions/core';
-
 import path from 'path';
 import * as semver from 'semver';
-import * as util from '../../src/util';
 
-import {LocalDistribution} from '../../src/distributions/local/installer';
+// Mock @actions/core before importing source modules that depend on it
+jest.unstable_mockModule('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
+
+jest.unstable_mockModule('@actions/tool-cache', () => ({
+  find: jest.fn(),
+  findAllVersions: jest.fn(),
+  downloadTool: jest.fn(),
+  extractZip: jest.fn(),
+  extractTar: jest.fn(),
+  extract7z: jest.fn(),
+  extractXar: jest.fn(),
+  cacheDir: jest.fn(),
+  cacheFile: jest.fn(),
+  getManifestFromRepo: jest.fn(),
+  findFromManifest: jest.fn(),
+  evaluateVersions: jest.fn()
+}));
+
+const real_util_module = await import('../../src/util.js');
+jest.unstable_mockModule('../../src/util.js', () => ({
+  ...real_util_module,
+  extractJdkFile: jest.fn(),
+  getDownloadArchiveExtension: jest.fn(),
+  getToolcachePath: jest.fn(),
+  isJobStatusSuccess: jest.fn(),
+  renameWinArchive: jest.fn(),
+  isVersionSatisfies: real_util_module.isVersionSatisfies,
+  getTempDir: real_util_module.getTempDir
+}));
+
+// Dynamic imports after mocking
+const core = await import('@actions/core');
+const tc = await import('@actions/tool-cache');
+const util = await import('../../src/util.js');
+const {LocalDistribution} =
+  await import('../../src/distributions/local/installer.js');
 
 describe('setupJava', () => {
   const actualJavaVersion = '11.1.10';
   const javaPath = path.join('Java_jdkfile_jdk', actualJavaVersion, 'x86');
 
-  let mockJavaBase: LocalDistribution;
+  let mockJavaBase: InstanceType<typeof LocalDistribution>;
 
-  let spyGetToolcachePath: jest.SpyInstance;
+  let spyGetToolcachePath: any;
-  let spyTcCacheDir: jest.SpyInstance;
+  let spyTcCacheDir: any;
-  let spyTcFindAllVersions: jest.SpyInstance;
+  let spyTcFindAllVersions: any;
-  let spyCoreDebug: jest.SpyInstance;
+  let spyCoreDebug: any;
-  let spyCoreInfo: jest.SpyInstance;
+  let spyCoreInfo: any;
-  let spyCoreExportVariable: jest.SpyInstance;
+  let spyCoreExportVariable: any;
-  let spyCoreAddPath: jest.SpyInstance;
+  let spyCoreAddPath: any;
-  let spyCoreSetOutput: jest.SpyInstance;
+  let spyCoreSetOutput: any;
-  let spyFsStat: jest.SpyInstance;
+  let spyFsStat: any;
-  let spyFsReadDir: jest.SpyInstance;
+  let spyFsReadDir: any;
-  let spyUtilsExtractJdkFile: jest.SpyInstance;
+  let spyUtilsExtractJdkFile: any;
-  let spyPathResolve: jest.SpyInstance;
+  let spyPathResolve: any;
-  let spyCoreError: jest.SpyInstance;
+  let spyCoreError: any;
   const expectedJdkFile = 'JavaLocalJdkFile';
 
   beforeEach(() => {
-    spyGetToolcachePath = jest.spyOn(util, 'getToolcachePath');
+    spyGetToolcachePath = util.getToolcachePath as jest.Mock;
     spyGetToolcachePath.mockImplementation(
       (toolname: string, javaVersion: string, architecture: string) => {
         const semverVersion = new semver.Range(javaVersion);
@@ -49,7 +113,7 @@ describe('setupJava', () => {
       }
     );
 
-    spyTcCacheDir = jest.spyOn(tc, 'cacheDir');
+    spyTcCacheDir = tc.cacheDir as jest.Mock;
     spyTcCacheDir.mockImplementation(
       (
         archivePath: string,
@@ -59,23 +123,23 @@ describe('setupJava', () => {
       ) => path.join(toolcacheFolderName, version, architecture)
     );
 
-    spyTcFindAllVersions = jest.spyOn(tc, 'findAllVersions');
+    spyTcFindAllVersions = tc.findAllVersions as jest.Mock;
     spyTcFindAllVersions.mockReturnValue([actualJavaVersion]);
 
     // Spy on core methods
-    spyCoreDebug = jest.spyOn(core, 'debug');
+    spyCoreDebug = core.debug as jest.Mock;
     spyCoreDebug.mockImplementation(() => undefined);
 
-    spyCoreInfo = jest.spyOn(core, 'info');
+    spyCoreInfo = core.info as jest.Mock;
     spyCoreInfo.mockImplementation(() => undefined);
 
-    spyCoreAddPath = jest.spyOn(core, 'addPath');
+    spyCoreAddPath = core.addPath as jest.Mock;
     spyCoreAddPath.mockImplementation(() => undefined);
 
-    spyCoreExportVariable = jest.spyOn(core, 'exportVariable');
+    spyCoreExportVariable = core.exportVariable as jest.Mock;
     spyCoreExportVariable.mockImplementation(() => undefined);
 
-    spyCoreSetOutput = jest.spyOn(core, 'setOutput');
+    spyCoreSetOutput = core.setOutput as jest.Mock;
     spyCoreSetOutput.mockImplementation(() => undefined);
 
     // Spy on fs methods
@@ -88,7 +152,7 @@ describe('setupJava', () => {
     });
 
     // Spy on util methods
-    spyUtilsExtractJdkFile = jest.spyOn(util, 'extractJdkFile');
+    spyUtilsExtractJdkFile = util.extractJdkFile as jest.Mock;
     spyUtilsExtractJdkFile.mockImplementation(() => 'some/random/path/');
 
     // Spy on path methods
@@ -96,7 +160,7 @@ describe('setupJava', () => {
     spyPathResolve.mockImplementation((path: string) => path);
 
     // Mock core.error to suppress error logs
-    spyCoreError = jest.spyOn(core, 'error');
+    spyCoreError = core.error as jest.Mock;
     spyCoreError.mockImplementation(() => {});
   });
 
@@ -106,6 +170,20 @@ describe('setupJava', () => {
     jest.restoreAllMocks();
   });
 
+  it('throws for the latest alias since jdkfile has no version list', async () => {
+    const inputs = {
+      version: 'latest',
+      architecture: 'x86',
+      packageType: 'jdk',
+      checkLatest: false
+    };
+
+    mockJavaBase = new LocalDistribution(inputs, expectedJdkFile);
+    await expect(mockJavaBase.setupJava()).rejects.toThrow(
+      "The 'latest' version alias is not supported for the 'jdkfile' distribution. Please specify a concrete version."
+    );
+  });
+
   it('java is resolved from toolcache, jdkfile is untouched', async () => {
     const inputs = {
       version: actualJavaVersion,

__tests__/distributors/microsoft-installer.test.ts

@@ -1,23 +1,115 @@
 import {
-  MicrosoftDistributions,
+  jest,
-  MICROSOFT_PUBLIC_KEY
+  describe,
-} from '../../src/distributions/microsoft/installer';
+  it,
-import os from 'os';
+  expect,
-import data from '../data/microsoft.json';
+  beforeEach,
-import * as httpm from '@actions/http-client';
+  afterEach,
-import * as core from '@actions/core';
+  beforeAll,
-import * as tc from '@actions/tool-cache';
+  afterAll
-import * as gpg from '../../src/gpg';
+} from '@jest/globals';
-import * as util from '../../src/util';
+import {HttpClient} from '@actions/http-client';
-import fs from 'fs';
+import data from '../data/microsoft.json' with {type: 'json'};
+
+const mockOsArch = jest.fn(() => 'x64');
+const mockOsPlatform = jest.fn(() => 'linux');
+
+const real_os_module = await import('os');
+jest.unstable_mockModule('os', () => ({
+  ...real_os_module,
+  default: {
+    ...real_os_module.default,
+    arch: mockOsArch,
+    platform: mockOsPlatform,
+    homedir: real_os_module.default.homedir
+  },
+  arch: mockOsArch,
+  platform: mockOsPlatform
+}));
+
+const real_fs_module = await import('fs');
+const mockReaddirSync = jest.fn();
+jest.unstable_mockModule('fs', () => ({
+  ...real_fs_module,
+  default: {
+    ...real_fs_module.default,
+    readdirSync: mockReaddirSync
+  },
+  readdirSync: mockReaddirSync
+}));
+
+// Mock @actions/core before importing source modules that depend on it
+jest.unstable_mockModule('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
+
+const real_tc_module = await import('@actions/tool-cache');
+jest.unstable_mockModule('@actions/tool-cache', () => ({
+  ...real_tc_module,
+  downloadTool: jest.fn(),
+  cacheDir: jest.fn(),
+  cacheFile: jest.fn()
+}));
+
+const real_util_module = await import('../../src/util.js');
+jest.unstable_mockModule('../../src/util.js', () => ({
+  ...real_util_module,
+  extractJdkFile: jest.fn(),
+  getDownloadArchiveExtension: jest.fn(),
+  getToolcachePath: jest.fn(),
+  isJobStatusSuccess: jest.fn(),
+  renameWinArchive: jest.fn(),
+  isVersionSatisfies: real_util_module.isVersionSatisfies,
+  getTempDir: real_util_module.getTempDir
+}));
+
+jest.unstable_mockModule('../../src/gpg.js', () => ({
+  importKey: jest.fn(),
+  deleteKey: jest.fn(),
+  verifyPackageSignature: jest.fn()
+}));
+
+// Dynamic imports after mocking
+const core = await import('@actions/core');
+const gpg = await import('../../src/gpg.js');
+const tc = await import('@actions/tool-cache');
+const os = (await import('os')).default;
+const fs = (await import('fs')).default;
+const {MicrosoftDistributions, MICROSOFT_PUBLIC_KEY} =
+  await import('../../src/distributions/microsoft/installer.js');
+const util = await import('../../src/util.js');
 
 describe('findPackageForDownload', () => {
-  let distribution: MicrosoftDistributions;
+  let distribution: InstanceType<typeof MicrosoftDistributions>;
-  let spyGetManifestFromRepo: jest.SpyInstance;
+  let spyGetManifestFromRepo: any;
-  let spyDebug: jest.SpyInstance;
+  let spyDebug: any;
-  let spyCoreError: jest.SpyInstance;
+  let spyCoreError: any;
 
   beforeEach(() => {
+    mockOsArch.mockReturnValue('x64');
+    mockOsPlatform.mockReturnValue(process.platform);
+
     distribution = new MicrosoftDistributions({
       version: '',
       architecture: 'x64',
@@ -25,18 +117,18 @@ describe('findPackageForDownload', () => {
       checkLatest: false
     });
 
-    spyGetManifestFromRepo = jest.spyOn(httpm.HttpClient.prototype, 'getJson');
+    spyGetManifestFromRepo = jest.spyOn(HttpClient.prototype, 'getJson');
     spyGetManifestFromRepo.mockReturnValue({
       result: data,
       statusCode: 200,
       headers: {}
     });
 
-    spyDebug = jest.spyOn(core, 'debug');
+    spyDebug = core.debug as jest.Mock;
     spyDebug.mockImplementation(() => {});
 
     // Mock core.error to suppress error logs
-    spyCoreError = jest.spyOn(core, 'error');
+    spyCoreError = core.error as jest.Mock;
     spyCoreError.mockImplementation(() => {});
   });
 
@@ -118,10 +210,8 @@ describe('findPackageForDownload', () => {
   ])(
     'defaults to os.arch(): %s mapped to distro arch: %s',
     async (osArch: string, distroArch: string) => {
-      jest
+      mockOsArch.mockReturnValue(osArch);
-        .spyOn(os, 'arch')
+      mockOsPlatform.mockReturnValue('darwin');
-        .mockReturnValue(osArch as ReturnType<typeof os.arch>);
-      jest.spyOn(os, 'platform').mockReturnValue('darwin');
 
       const version = '17';
       const distro = new MicrosoftDistributions({
@@ -144,10 +234,8 @@ describe('findPackageForDownload', () => {
   ])(
     'defaults to os.arch(): %s mapped to distro arch: %s',
     async (osArch: string, distroArch: string) => {
-      jest
+      mockOsArch.mockReturnValue(osArch);
-        .spyOn(os, 'arch')
+      mockOsPlatform.mockReturnValue('linux');
-        .mockReturnValue(osArch as ReturnType<typeof os.arch>);
-      jest.spyOn(os, 'platform').mockReturnValue('linux');
 
       const version = '17';
       const distro = new MicrosoftDistributions({
@@ -170,10 +258,8 @@ describe('findPackageForDownload', () => {
   ])(
     'defaults to os.arch(): %s mapped to distro arch: %s',
     async (osArch: string, distroArch: string) => {
-      jest
+      mockOsArch.mockReturnValue(osArch);
-        .spyOn(os, 'arch')
+      mockOsPlatform.mockReturnValue('win32');
-        .mockReturnValue(osArch as ReturnType<typeof os.arch>);
-      jest.spyOn(os, 'platform').mockReturnValue('win32');
 
       const version = '17';
       const distro = new MicrosoftDistributions({
@@ -217,7 +303,7 @@ describe('findPackageForDownload', () => {
       statusCode: 200,
       headers: {}
     });
-    jest.spyOn(os, 'platform').mockReturnValue('linux');
+    mockOsPlatform.mockReturnValue('linux');
 
     const result = await distribution['findPackageForDownload']('17.0.10');
 
@@ -228,16 +314,14 @@ describe('findPackageForDownload', () => {
 });
 
 describe('downloadTool', () => {
-  let spyDownloadTool: jest.SpyInstance;
+  let spyDownloadTool: any;
-  let spyExtractJdkFile: jest.SpyInstance;
+  let spyExtractJdkFile: any;
-  let spyCacheDir: jest.SpyInstance;
+  let spyCacheDir: any;
-  let spyVerifySignature: jest.SpyInstance;
+  let spyVerifySignature: any;
-  let distribution: MicrosoftDistributions;
+  let distribution: InstanceType<typeof MicrosoftDistributions>;
 
   beforeEach(() => {
-    jest
+    mockOsPlatform.mockReturnValue(process.platform);
-      .spyOn(os, 'platform')
-      .mockReturnValue(process.platform as ReturnType<typeof os.platform>);
 
     distribution = new MicrosoftDistributions({
       version: '17',
@@ -246,27 +330,27 @@ describe('downloadTool', () => {
       checkLatest: false
     });
 
-    spyDownloadTool = jest.spyOn(tc, 'downloadTool');
+    spyDownloadTool = tc.downloadTool as jest.Mock;
     spyDownloadTool.mockImplementation(async () => {
       return '/tmp/jdk.tar.gz';
     });
 
-    spyExtractJdkFile = jest.spyOn(util, 'extractJdkFile');
+    spyExtractJdkFile = util.extractJdkFile as jest.Mock;
     spyExtractJdkFile.mockImplementation(async () => {
       return '/tmp/unpacked';
     });
 
-    jest.spyOn(fs, 'readdirSync').mockReturnValue(['jdk'] as any);
+    mockReaddirSync.mockReturnValue(['jdk'] as any);
-    spyCacheDir = jest.spyOn(tc, 'cacheDir');
+    spyCacheDir = tc.cacheDir as jest.Mock;
     spyCacheDir.mockImplementation(async () => {
       return '/tmp/cached';
     });
 
-    jest
+    (util.renameWinArchive as jest.Mock<any>).mockImplementation(
-      .spyOn(util, 'renameWinArchive')
+      (archivePath: string) => `${archivePath}.zip`
-      .mockImplementation((archivePath: string) => `${archivePath}.zip`);
+    );
 
-    spyVerifySignature = jest.spyOn(gpg, 'verifyPackageSignature');
+    spyVerifySignature = gpg.verifyPackageSignature as jest.Mock;
     spyVerifySignature.mockImplementation(async () => {});
   });
 

__tests__/distributors/oracle-installer.test.ts

@@ -1,14 +1,53 @@
-import {OracleDistribution} from '../../src/distributions/oracle/installer';
+import {
+  jest,
+  describe,
+  it,
+  expect,
+  beforeEach,
+  afterEach,
+  beforeAll,
+  afterAll
+} from '@jest/globals';
 import os from 'os';
-import * as core from '@actions/core';
-import {getDownloadArchiveExtension} from '../../src/util';
 import {HttpClient} from '@actions/http-client';
 
+// Mock @actions/core before importing source modules that depend on it
+jest.unstable_mockModule('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
+
+// Dynamic imports after mocking
+const core = await import('@actions/core');
+const {OracleDistribution} =
+  await import('../../src/distributions/oracle/installer.js');
+const {getDownloadArchiveExtension} = await import('../../src/util.js');
+
 describe('findPackageForDownload', () => {
-  let distribution: OracleDistribution;
+  let distribution: InstanceType<typeof OracleDistribution>;
-  let spyDebug: jest.SpyInstance;
+  let spyDebug: any;
-  let spyHttpClient: jest.SpyInstance;
+  let spyHttpClient: any;
-  let spyCoreError: jest.SpyInstance;
+  let spyCoreError: any;
 
   beforeEach(() => {
     distribution = new OracleDistribution({
@@ -18,11 +57,11 @@ describe('findPackageForDownload', () => {
       checkLatest: false
     });
 
-    spyDebug = jest.spyOn(core, 'debug');
+    spyDebug = core.debug as jest.Mock;
     spyDebug.mockImplementation(() => {});
 
     // Mock core.error to suppress error logs
-    spyCoreError = jest.spyOn(core, 'error');
+    spyCoreError = core.error as jest.Mock;
     spyCoreError.mockImplementation(() => {});
   });
 
@@ -135,3 +174,59 @@ describe('findPackageForDownload', () => {
     );
   });
 });
+describe('findPackageForDownload with latest', () => {
+  let spyHttpClientHead: any;
+  let spyHttpClientGetJson: any;
+
+  beforeEach(() => {
+    (core.debug as jest.Mock).mockImplementation(() => {});
+    (core.error as jest.Mock).mockImplementation(() => {});
+    spyHttpClientGetJson = jest.spyOn(HttpClient.prototype, 'getJson');
+    spyHttpClientGetJson.mockResolvedValue({
+      statusCode: 200,
+      result: {most_recent_feature_release: 25},
+      headers: {}
+    });
+  });
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it('resolves the newest major version from the Adoptium API', async () => {
+    spyHttpClientHead = jest.spyOn(HttpClient.prototype, 'head');
+    spyHttpClientHead.mockResolvedValue({message: {statusCode: 200}});
+
+    const distribution = new OracleDistribution({
+      version: 'latest',
+      architecture: 'x64',
+      packageType: 'jdk',
+      checkLatest: false
+    });
+
+    const result = await distribution['findPackageForDownload']('x');
+    const osType = distribution.getPlatform();
+    const archiveType = getDownloadArchiveExtension();
+
+    expect(result.version).toBe('25');
+    expect(result.url).toBe(
+      `https://download.oracle.com/java/25/latest/jdk-25_${osType}-x64_bin.${archiveType}`
+    );
+  });
+
+  it('throws an actionable error when the latest major is not yet available', async () => {
+    spyHttpClientHead = jest.spyOn(HttpClient.prototype, 'head');
+    spyHttpClientHead.mockResolvedValue({message: {statusCode: 404}});
+
+    const distribution = new OracleDistribution({
+      version: 'latest',
+      architecture: 'x64',
+      packageType: 'jdk',
+      checkLatest: false
+    });
+
+    await expect(distribution['findPackageForDownload']('x')).rejects.toThrow(
+      /is not yet available for the Oracle JDK distribution/
+    );
+  });
+});

__tests__/distributors/sapmachine-installer.test.ts

@@ -1,14 +1,59 @@
+import {
+  jest,
+  describe,
+  it,
+  expect,
+  beforeEach,
+  afterEach,
+  beforeAll,
+  afterAll
+} from '@jest/globals';
 import {HttpClient} from '@actions/http-client';
-import {SapMachineDistribution} from '../../src/distributions/sapmachine/installer';
-import * as utils from '../../src/util';
-import * as core from '@actions/core';
 
-import manifestData from '../data/sapmachine.json';
+import manifestData from '../data/sapmachine.json' with {type: 'json'};
+
+// Mock @actions/core before importing source modules that depend on it
+jest.unstable_mockModule('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
+
+const real_util_module = await import('../../src/util.js');
+jest.unstable_mockModule('../../src/util.js', () => ({
+  ...real_util_module,
+  getDownloadArchiveExtension: jest.fn()
+}));
+
+// Dynamic imports after mocking
+const core = await import('@actions/core');
+const {SapMachineDistribution} =
+  await import('../../src/distributions/sapmachine/installer.js');
+const utils = await import('../../src/util.js');
 
 describe('getAvailableVersions', () => {
-  let spyHttpClient: jest.SpyInstance;
+  let spyHttpClient: any;
-  let spyUtilGetDownloadArchiveExtension: jest.SpyInstance;
+  let spyUtilGetDownloadArchiveExtension: any;
-  let spyCoreError: jest.SpyInstance;
+  let spyCoreError: any;
 
   beforeEach(() => {
     spyHttpClient = jest.spyOn(HttpClient.prototype, 'getJson');
@@ -18,14 +63,12 @@ describe('getAvailableVersions', () => {
       result: manifestData
     });
 
-    spyUtilGetDownloadArchiveExtension = jest.spyOn(
+    spyUtilGetDownloadArchiveExtension =
-      utils,
+      utils.getDownloadArchiveExtension as jest.Mock<any>;
-      'getDownloadArchiveExtension'
-    );
     spyUtilGetDownloadArchiveExtension.mockReturnValue('tar.gz');
 
     // Mock core.error to suppress error logs
-    spyCoreError = jest.spyOn(core, 'error');
+    spyCoreError = core.error as jest.Mock;
     spyCoreError.mockImplementation(() => {});
   });
 
@@ -36,7 +79,7 @@ describe('getAvailableVersions', () => {
   });
 
   const mockPlatform = (
-    distribution: SapMachineDistribution,
+    distribution: InstanceType<typeof SapMachineDistribution>,
     platform: string
   ) => {
     distribution['getPlatformOption'] = () => platform;

__tests__/distributors/semeru-installer.test.ts

@@ -1,15 +1,53 @@
+import {
+  jest,
+  describe,
+  it,
+  expect,
+  beforeEach,
+  afterEach,
+  beforeAll,
+  afterAll
+} from '@jest/globals';
+import type {JavaInstallerOptions} from '../../src/distributions/base-models.js';
 import {HttpClient} from '@actions/http-client';
 
-import {JavaInstallerOptions} from '../../src/distributions/base-models';
+import manifestData from '../data/semeru.json' with {type: 'json'};
-import {SemeruDistribution} from '../../src/distributions/semeru/installer';
 
-import manifestData from '../data/semeru.json';
+// Mock @actions/core before importing source modules that depend on it
-import * as core from '@actions/core';
+jest.unstable_mockModule('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
+
+// Dynamic imports after mocking
+const core = await import('@actions/core');
+const {SemeruDistribution} =
+  await import('../../src/distributions/semeru/installer.js');
 
 describe('getAvailableVersions', () => {
-  let spyHttpClient: jest.SpyInstance;
+  let spyHttpClient: any;
-  let spyCoreError: jest.SpyInstance;
+  let spyCoreError: any;
-  let spyCoreWarning: jest.SpyInstance;
+  let spyCoreWarning: any;
 
   beforeEach(() => {
     spyHttpClient = jest.spyOn(HttpClient.prototype, 'getJson');
@@ -19,9 +57,9 @@ describe('getAvailableVersions', () => {
       result: []
     });
     // Mock core.error to suppress error logs
-    spyCoreError = jest.spyOn(core, 'error');
+    spyCoreError = core.error as jest.Mock;
     spyCoreError.mockImplementation(() => {});
-    spyCoreWarning = jest.spyOn(core, 'warning');
+    spyCoreWarning = core.warning as jest.Mock;
     spyCoreWarning.mockImplementation(() => {});
   });
 

__tests__/distributors/temurin-installer.test.ts

@@ -1,23 +1,92 @@
+import {
+  jest,
+  describe,
+  it,
+  expect,
+  beforeEach,
+  afterEach,
+  beforeAll,
+  afterAll
+} from '@jest/globals';
+import type {JavaInstallerOptions} from '../../src/distributions/base-models.js';
+import type {TemurinImplementation as TemurinImplementationType} from '../../src/distributions/temurin/installer.js';
 import {HttpClient} from '@actions/http-client';
-import * as tc from '@actions/tool-cache';
 import fs from 'fs';
 import os from 'os';
-import {
-  TemurinDistribution,
-  TemurinImplementation,
-  ADOPTIUM_PUBLIC_KEY
-} from '../../src/distributions/temurin/installer';
-import {JavaInstallerOptions} from '../../src/distributions/base-models';
-import * as util from '../../src/util';
-import * as gpg from '../../src/gpg';
 
-import manifestData from '../data/temurin.json';
+import manifestData from '../data/temurin.json' with {type: 'json'};
-import * as core from '@actions/core';
+
+// Mock @actions/core before importing source modules that depend on it
+jest.unstable_mockModule('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
+
+jest.unstable_mockModule('@actions/tool-cache', () => ({
+  find: jest.fn(),
+  findAllVersions: jest.fn(),
+  downloadTool: jest.fn(),
+  extractZip: jest.fn(),
+  extractTar: jest.fn(),
+  extract7z: jest.fn(),
+  extractXar: jest.fn(),
+  cacheDir: jest.fn(),
+  cacheFile: jest.fn(),
+  getManifestFromRepo: jest.fn(),
+  findFromManifest: jest.fn(),
+  evaluateVersions: jest.fn()
+}));
+
+const real_util_module = await import('../../src/util.js');
+jest.unstable_mockModule('../../src/util.js', () => ({
+  ...real_util_module,
+  extractJdkFile: jest.fn(),
+  getDownloadArchiveExtension: jest.fn(),
+  getToolcachePath: jest.fn(),
+  isJobStatusSuccess: jest.fn(),
+  renameWinArchive: jest.fn(),
+  isVersionSatisfies: real_util_module.isVersionSatisfies,
+  getTempDir: real_util_module.getTempDir
+}));
+
+jest.unstable_mockModule('../../src/gpg.js', () => ({
+  importKey: jest.fn(),
+  deleteKey: jest.fn(),
+  verifyPackageSignature: jest.fn()
+}));
+
+// Dynamic imports after mocking
+const core = await import('@actions/core');
+const gpg = await import('../../src/gpg.js');
+const tc = await import('@actions/tool-cache');
+const {TemurinDistribution, TemurinImplementation, ADOPTIUM_PUBLIC_KEY} =
+  await import('../../src/distributions/temurin/installer.js');
+const util = await import('../../src/util.js');
 
 describe('getAvailableVersions', () => {
-  let spyHttpClient: jest.SpyInstance;
+  let spyHttpClient: any;
-  let spyCoreError: jest.SpyInstance;
+  let spyCoreError: any;
-  let spyCoreWarning: jest.SpyInstance;
+  let spyCoreWarning: any;
 
   beforeEach(() => {
     spyHttpClient = jest.spyOn(HttpClient.prototype, 'getJson');
@@ -27,9 +96,9 @@ describe('getAvailableVersions', () => {
       result: []
     });
     // Mock core.error to suppress error logs
-    spyCoreError = jest.spyOn(core, 'error');
+    spyCoreError = core.error as jest.Mock;
     spyCoreError.mockImplementation(() => {});
-    spyCoreWarning = jest.spyOn(core, 'warning');
+    spyCoreWarning = core.warning as jest.Mock;
     spyCoreWarning.mockImplementation(() => {});
   });
 
@@ -84,7 +153,7 @@ describe('getAvailableVersions', () => {
     'build correct url for %s',
     async (
       installerOptions: JavaInstallerOptions,
-      impl: TemurinImplementation,
+      impl: TemurinImplementationType,
       expectedParameters
     ) => {
       const distribution = new TemurinDistribution(installerOptions, impl);
@@ -163,7 +232,11 @@ describe('getAvailableVersions', () => {
     [TemurinImplementation.Hotspot, 'jre', 'Java_Temurin-Hotspot_jre']
   ])(
     'find right toolchain folder',
-    (impl: TemurinImplementation, packageType: string, expected: string) => {
+    (
+      impl: TemurinImplementationType,
+      packageType: string,
+      expected: string
+    ) => {
       const distribution = new TemurinDistribution(
         {
           version: '8',
@@ -239,6 +312,24 @@ describe('findPackageForDownload', () => {
     expect(resolvedVersion.signatureUrl).toBeDefined();
   });
 
+  it('version "latest" is normalized to the newest available version', async () => {
+    const distribution = new TemurinDistribution(
+      {
+        version: 'latest',
+        architecture: 'x64',
+        packageType: 'jdk',
+        checkLatest: false
+      },
+      TemurinImplementation.Hotspot
+    );
+    distribution['getAvailableVersions'] = async () => manifestData as any;
+    // normalizeVersion turns `latest` into the wildcard carried on `this.version`
+    const resolvedVersion = await distribution['findPackageForDownload'](
+      distribution['version']
+    );
+    expect(resolvedVersion.version).toBe('16.0.2+7');
+  });
+
   it('version is found but binaries list is empty', async () => {
     const distribution = new TemurinDistribution(
       {
@@ -289,25 +380,25 @@ describe('findPackageForDownload', () => {
 });
 
 describe('downloadTool', () => {
-  let spyDownloadTool: jest.SpyInstance;
+  let spyDownloadTool: any;
-  let spyVerifySignature: jest.SpyInstance;
+  let spyVerifySignature: any;
-  let spyExtractJdkFile: jest.SpyInstance;
+  let spyExtractJdkFile: any;
-  let spyCacheDir: jest.SpyInstance;
+  let spyCacheDir: any;
-  let spyReadDirSync: jest.SpyInstance;
+  let spyReadDirSync: any;
-  let spyRenameWinArchive: jest.SpyInstance;
+  let spyRenameWinArchive: any;
 
   beforeEach(() => {
-    spyDownloadTool = jest.spyOn(tc, 'downloadTool');
+    spyDownloadTool = tc.downloadTool as jest.Mock;
     spyDownloadTool.mockResolvedValue('/tmp/jdk.tar.gz');
-    spyVerifySignature = jest.spyOn(gpg, 'verifyPackageSignature');
+    spyVerifySignature = gpg.verifyPackageSignature as jest.Mock;
     spyVerifySignature.mockResolvedValue(undefined);
-    spyExtractJdkFile = jest.spyOn(util, 'extractJdkFile');
+    spyExtractJdkFile = util.extractJdkFile as jest.Mock;
     spyExtractJdkFile.mockResolvedValue('/tmp/extracted');
-    spyCacheDir = jest.spyOn(tc, 'cacheDir');
+    spyCacheDir = tc.cacheDir as jest.Mock;
     spyCacheDir.mockResolvedValue('/tmp/toolcache');
     spyReadDirSync = jest.spyOn(fs, 'readdirSync');
     spyReadDirSync.mockReturnValue(['jdk-17'] as any);
-    spyRenameWinArchive = jest.spyOn(util, 'renameWinArchive');
+    spyRenameWinArchive = util.renameWinArchive as jest.Mock;
     spyRenameWinArchive.mockReturnValue('/tmp/jdk.tar.gz.zip');
   });
 

__tests__/distributors/zulu-installer.test.ts

@@ -1,16 +1,60 @@
+import {
+  jest,
+  describe,
+  it,
+  expect,
+  beforeEach,
+  afterEach,
+  beforeAll,
+  afterAll
+} from '@jest/globals';
+import type {IZuluVersions} from '../../src/distributions/zulu/models.js';
 import {HttpClient} from '@actions/http-client';
-import {ZuluDistribution} from '../../src/distributions/zulu/installer';
-import {IZuluVersions} from '../../src/distributions/zulu/models';
-import * as utils from '../../src/util';
 import os from 'os';
-import * as core from '@actions/core';
 
-import manifestData from '../data/zulu-releases-default.json';
+import manifestData from '../data/zulu-releases-default.json' with {type: 'json'};
+
+// Mock @actions/core before importing source modules that depend on it
+jest.unstable_mockModule('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
+
+const real_util_module = await import('../../src/util.js');
+jest.unstable_mockModule('../../src/util.js', () => ({
+  ...real_util_module,
+  getDownloadArchiveExtension: jest.fn()
+}));
+
+// Dynamic imports after mocking
+const core = await import('@actions/core');
+const {ZuluDistribution} =
+  await import('../../src/distributions/zulu/installer.js');
+const utils = await import('../../src/util.js');
 
 describe('getAvailableVersions', () => {
-  let spyHttpClient: jest.SpyInstance;
+  let spyHttpClient: any;
-  let spyUtilGetDownloadArchiveExtension: jest.SpyInstance;
+  let spyCoreError: any;
-  let spyCoreError: jest.SpyInstance;
 
   beforeEach(() => {
     spyHttpClient = jest.spyOn(HttpClient.prototype, 'getJson');
@@ -20,14 +64,12 @@ describe('getAvailableVersions', () => {
       result: [] as IZuluVersions[]
     });
 
-    spyUtilGetDownloadArchiveExtension = jest.spyOn(
+    (utils.getDownloadArchiveExtension as jest.Mock<any>).mockReturnValue(
-      utils,
+      'tar.gz'
-      'getDownloadArchiveExtension'
     );
-    spyUtilGetDownloadArchiveExtension.mockReturnValue('tar.gz');
 
     // Mock core.error to suppress error logs
-    spyCoreError = jest.spyOn(core, 'error');
+    spyCoreError = core.error as jest.Mock;
     spyCoreError.mockImplementation(() => {});
   });
 

__tests__/distributors/zulu-linux-installer.test.ts

@@ -1,17 +1,62 @@
+import {
+  jest,
+  describe,
+  it,
+  expect,
+  beforeEach,
+  afterEach,
+  beforeAll,
+  afterAll
+} from '@jest/globals';
+import type {IZuluVersions} from '../../src/distributions/zulu/models.js';
 import {HttpClient} from '@actions/http-client';
 import * as semver from 'semver';
-import {ZuluDistribution} from '../../src/distributions/zulu/installer';
-import {IZuluVersions} from '../../src/distributions/zulu/models';
-import * as utils from '../../src/util';
 import os from 'os';
-import * as core from '@actions/core';
 
-import manifestData from '../data/zulu-linux.json';
+import manifestData from '../data/zulu-linux.json' with {type: 'json'};
+
+// Mock @actions/core before importing source modules that depend on it
+jest.unstable_mockModule('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
+
+const real_util_module = await import('../../src/util.js');
+jest.unstable_mockModule('../../src/util.js', () => ({
+  ...real_util_module,
+  getDownloadArchiveExtension: jest.fn()
+}));
+
+// Dynamic imports after mocking
+const core = await import('@actions/core');
+const {ZuluDistribution} =
+  await import('../../src/distributions/zulu/installer.js');
+const utils = await import('../../src/util.js');
 
 describe('getAvailableVersions', () => {
-  let spyHttpClient: jest.SpyInstance;
+  let spyHttpClient: any;
-  let spyUtilGetDownloadArchiveExtension: jest.SpyInstance;
+  let spyUtilGetDownloadArchiveExtension: any;
-  let spyCoreError: jest.SpyInstance;
+  let spyCoreError: any;
 
   beforeEach(() => {
     spyHttpClient = jest.spyOn(HttpClient.prototype, 'getJson');
@@ -21,14 +66,12 @@ describe('getAvailableVersions', () => {
       result: [] as IZuluVersions[]
     });
 
-    spyUtilGetDownloadArchiveExtension = jest.spyOn(
+    spyUtilGetDownloadArchiveExtension =
-      utils,
+      utils.getDownloadArchiveExtension as jest.Mock<any>;
-      'getDownloadArchiveExtension'
-    );
     spyUtilGetDownloadArchiveExtension.mockReturnValue('zip');
 
     // Mock core.error to suppress error logs
-    spyCoreError = jest.spyOn(core, 'error');
+    spyCoreError = core.error as jest.Mock;
     spyCoreError.mockImplementation(() => {});
   });
 

__tests__/distributors/zulu-windows-installer.test.ts

@@ -1,17 +1,61 @@
+import {
+  jest,
+  describe,
+  it,
+  expect,
+  beforeEach,
+  afterEach,
+  beforeAll,
+  afterAll
+} from '@jest/globals';
+import type {IZuluVersions} from '../../src/distributions/zulu/models.js';
 import {HttpClient} from '@actions/http-client';
 import * as semver from 'semver';
-import {ZuluDistribution} from '../../src/distributions/zulu/installer';
-import {IZuluVersions} from '../../src/distributions/zulu/models';
-import * as utils from '../../src/util';
 import os from 'os';
-import * as core from '@actions/core';
 
-import manifestData from '../data/zulu-windows.json';
+import manifestData from '../data/zulu-windows.json' with {type: 'json'};
+
+// Mock @actions/core before importing source modules that depend on it
+jest.unstable_mockModule('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
+
+const real_util_module = await import('../../src/util.js');
+jest.unstable_mockModule('../../src/util.js', () => ({
+  ...real_util_module,
+  getDownloadArchiveExtension: jest.fn()
+}));
+
+// Dynamic imports after mocking
+const core = await import('@actions/core');
+const {ZuluDistribution} =
+  await import('../../src/distributions/zulu/installer.js');
+const utils = await import('../../src/util.js');
 
 describe('getAvailableVersions', () => {
-  let spyHttpClient: jest.SpyInstance;
+  let spyHttpClient: any;
-  let spyUtilGetDownloadArchiveExtension: jest.SpyInstance;
+  let spyCoreError: any;
-  let spyCoreError: jest.SpyInstance;
 
   beforeEach(() => {
     spyHttpClient = jest.spyOn(HttpClient.prototype, 'getJson');
@@ -21,14 +65,12 @@ describe('getAvailableVersions', () => {
       result: [] as IZuluVersions[]
     });
 
-    spyUtilGetDownloadArchiveExtension = jest.spyOn(
+    (utils.getDownloadArchiveExtension as jest.Mock<any>).mockReturnValue(
-      utils,
+      'zip'
-      'getDownloadArchiveExtension'
     );
-    spyUtilGetDownloadArchiveExtension.mockReturnValue('zip');
 
     // Mock core.error to suppress error logs
-    spyCoreError = jest.spyOn(core, 'error');
+    spyCoreError = core.error as jest.Mock;
     spyCoreError.mockImplementation(() => {});
   });
 

__tests__/gpg.test.ts

@@ -1,20 +1,29 @@
+import {
+  jest,
+  describe,
+  it,
+  expect,
+  beforeEach,
+  afterAll,
+  afterEach
+} from '@jest/globals';
+import {fileURLToPath} from 'url';
 import * as path from 'path';
 import * as io from '@actions/io';
-import * as exec from '@actions/exec';
-import * as tc from '@actions/tool-cache';
-import * as gpg from '../src/gpg';
 
-jest.mock('@actions/exec', () => {
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
-  return {
+
+jest.unstable_mockModule('@actions/exec', () => ({
   exec: jest.fn()
-  };
+}));
-});
 
-jest.mock('@actions/tool-cache', () => {
+jest.unstable_mockModule('@actions/tool-cache', () => ({
-  return {
   downloadTool: jest.fn()
-  };
+}));
-});
+
+const exec = await import('@actions/exec');
+const tc = await import('@actions/tool-cache');
+const gpg = await import('../src/gpg.js');
 
 const tempDir = path.join(__dirname, 'runner', 'temp');
 process.env['RUNNER_TEMP'] = tempDir;
@@ -92,7 +101,9 @@ describe('gpg tests', () => {
       it('imports bundled key and verifies package', async () => {
         const publicKeyContent =
           '-----BEGIN PGP PUBLIC KEY BLOCK-----\ntest\n-----END PGP PUBLIC KEY BLOCK-----';
-        (tc.downloadTool as jest.Mock).mockResolvedValue('/tmp/jdk.tar.gz.sig');
+        (tc.downloadTool as jest.Mock<any>).mockResolvedValue(
+          '/tmp/jdk.tar.gz.sig'
+        );
         await gpg.verifyPackageSignature(
           '/tmp/jdk.tar.gz',
           'https://example.com/jdk.tar.gz.sig',

__tests__/maven-args.test.ts

@@ -1,42 +1,68 @@
-import * as core from '@actions/core';
+import {afterEach, beforeEach, describe, expect, it, jest} from '@jest/globals';
 
-import {configureMavenArgs} from '../src/maven-args';
+const mockGetInput = jest.fn<(...args: any[]) => any>();
-import {
+const mockExportVariable = jest.fn<(...args: any[]) => any>();
+const mockInfo = jest.fn<(...args: any[]) => any>();
+const mockDebug = jest.fn<(...args: any[]) => any>();
+const mockWarning = jest.fn<(...args: any[]) => any>();
+
+jest.unstable_mockModule('@actions/core', () => ({
+  getInput: mockGetInput,
+  exportVariable: mockExportVariable,
+  info: mockInfo,
+  debug: mockDebug,
+  warning: mockWarning,
+  setSecret: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  addPath: jest.fn(),
+  getMultilineInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getState: jest.fn(),
+  saveState: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn(),
+  isDebug: jest.fn(),
+  setCommandEcho: jest.fn(),
+  getIDToken: jest.fn(),
+  ExitCode: {Success: 0, Failure: 1},
+  summary: {},
+  markdownSummary: {},
+  platform: {},
+  toPosixPath: jest.fn(),
+  toWin32Path: jest.fn(),
+  toPlatformPath: jest.fn()
+}));
+
+const {configureMavenArgs} = await import('../src/maven-args.js');
+const {
   INPUT_SHOW_DOWNLOAD_PROGRESS,
   MAVEN_ARGS_ENV,
   MAVEN_NO_TRANSFER_PROGRESS_FLAG
-} from '../src/constants';
+} = await import('../src/constants.js');
 
 describe('configureMavenArgs', () => {
   let inputs: Record<string, string>;
-  let spyGetInput: jest.SpyInstance;
-  let spyExportVariable: jest.SpyInstance;
-  let spyInfo: jest.SpyInstance;
-  let spyDebug: jest.SpyInstance;
   const originalMavenArgs = process.env[MAVEN_ARGS_ENV];
 
   beforeEach(() => {
     inputs = {};
 
-    spyGetInput = jest.spyOn(core, 'getInput');
+    mockGetInput.mockImplementation((name: string) => inputs[name] ?? '');
-    spyGetInput.mockImplementation((name: string) => inputs[name] ?? '');
+    mockExportVariable.mockImplementation((name: string, value: string) => {
-
-    spyExportVariable = jest.spyOn(core, 'exportVariable');
-    spyExportVariable.mockImplementation((name: string, value: string) => {
       process.env[name] = value;
     });
-
+    mockInfo.mockImplementation(() => undefined);
-    spyInfo = jest.spyOn(core, 'info');
+    mockDebug.mockImplementation(() => undefined);
-    spyInfo.mockImplementation(() => undefined);
-
-    spyDebug = jest.spyOn(core, 'debug');
-    spyDebug.mockImplementation(() => undefined);
 
     delete process.env[MAVEN_ARGS_ENV];
   });
 
   afterEach(() => {
-    jest.restoreAllMocks();
+    jest.resetAllMocks();
     if (originalMavenArgs === undefined) {
       delete process.env[MAVEN_ARGS_ENV];
     } else {
@@ -47,7 +73,7 @@ describe('configureMavenArgs', () => {
   it('sets MAVEN_ARGS with -ntp by default', () => {
     configureMavenArgs();
 
-    expect(spyExportVariable).toHaveBeenCalledWith(
+    expect(mockExportVariable).toHaveBeenCalledWith(
       MAVEN_ARGS_ENV,
       MAVEN_NO_TRANSFER_PROGRESS_FLAG
     );
@@ -59,7 +85,7 @@ describe('configureMavenArgs', () => {
 
     configureMavenArgs();
 
-    expect(spyExportVariable).not.toHaveBeenCalled();
+    expect(mockExportVariable).not.toHaveBeenCalled();
     expect(process.env[MAVEN_ARGS_ENV]).toBeUndefined();
   });
 
@@ -68,7 +94,7 @@ describe('configureMavenArgs', () => {
 
     configureMavenArgs();
 
-    expect(spyExportVariable).toHaveBeenCalledWith(
+    expect(mockExportVariable).toHaveBeenCalledWith(
       MAVEN_ARGS_ENV,
       `-B -Dstyle.color=always ${MAVEN_NO_TRANSFER_PROGRESS_FLAG}`
     );
@@ -79,7 +105,7 @@ describe('configureMavenArgs', () => {
 
     configureMavenArgs();
 
-    expect(spyExportVariable).not.toHaveBeenCalled();
+    expect(mockExportVariable).not.toHaveBeenCalled();
     expect(process.env[MAVEN_ARGS_ENV]).toBe('-B -ntp');
   });
 
@@ -88,7 +114,7 @@ describe('configureMavenArgs', () => {
 
     configureMavenArgs();
 
-    expect(spyExportVariable).not.toHaveBeenCalled();
+    expect(mockExportVariable).not.toHaveBeenCalled();
     expect(process.env[MAVEN_ARGS_ENV]).toBe('--no-transfer-progress -B');
   });
 
@@ -98,7 +124,7 @@ describe('configureMavenArgs', () => {
 
     configureMavenArgs();
 
-    expect(spyExportVariable).not.toHaveBeenCalled();
+    expect(mockExportVariable).not.toHaveBeenCalled();
     expect(process.env[MAVEN_ARGS_ENV]).toBe('-B');
   });
 });

__tests__/problem-matcher.test.ts

@@ -0,0 +1,44 @@
+import {afterEach, beforeEach, describe, expect, it, jest} from '@jest/globals';
+
+const mockGetInput = jest.fn<(...args: any[]) => any>();
+const mockInfo = jest.fn<(...args: any[]) => any>();
+const mockDebug = jest.fn<(...args: any[]) => any>();
+
+jest.unstable_mockModule('@actions/core', () => ({
+  getInput: mockGetInput,
+  info: mockInfo,
+  debug: mockDebug,
+  warning: jest.fn(),
+  setSecret: jest.fn()
+}));
+
+const {configureProblemMatcher} = await import('../src/problem-matcher.js');
+const {INPUT_PROBLEM_MATCHER} = await import('../src/constants.js');
+
+describe('configureProblemMatcher', () => {
+  let inputs: Record<string, string>;
+
+  beforeEach(() => {
+    inputs = {};
+    mockGetInput.mockImplementation((name: string) => inputs[name] ?? '');
+  });
+
+  afterEach(() => {
+    jest.resetAllMocks();
+  });
+
+  it('registers the Java problem matcher by default', () => {
+    configureProblemMatcher('/matchers/java.json');
+
+    expect(mockInfo).toHaveBeenCalledWith('##[add-matcher]/matchers/java.json');
+  });
+
+  it('does not register the Java problem matcher when disabled', () => {
+    inputs[INPUT_PROBLEM_MATCHER] = 'false';
+
+    configureProblemMatcher('/matchers/java.json');
+
+    expect(mockInfo).not.toHaveBeenCalled();
+    expect(mockDebug).toHaveBeenCalledWith('Java problem matcher is disabled');
+  });
+});

__tests__/toolchains.test.ts

@@ -1,23 +1,63 @@
+import {
+  jest,
+  describe,
+  it,
+  expect,
+  beforeEach,
+  afterEach,
+  beforeAll,
+  afterAll
+} from '@jest/globals';
+import {fileURLToPath} from 'url';
 import * as fs from 'fs';
 import os from 'os';
 import * as path from 'path';
-import * as core from '@actions/core';
 import * as io from '@actions/io';
-import * as toolchains from '../src/toolchains';
-import {M2_DIR, MVN_TOOLCHAINS_FILE} from '../src/constants';
 
+// Mock @actions/core before importing source modules that depend on it
+jest.unstable_mockModule('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
+
+// Dynamic imports after mocking
+const core = await import('@actions/core');
+const toolchains = await import('../src/toolchains.js');
+const {M2_DIR, MVN_TOOLCHAINS_FILE} = await import('../src/constants.js');
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
 const m2Dir = path.join(__dirname, M2_DIR);
 const toolchainsFile = path.join(m2Dir, MVN_TOOLCHAINS_FILE);
 
 describe('toolchains tests', () => {
-  let spyOSHomedir: jest.SpyInstance;
+  let spyOSHomedir: any;
-  let spyInfo: jest.SpyInstance;
+  let spyInfo: any;
 
   beforeEach(async () => {
     await io.rmRF(m2Dir);
     spyOSHomedir = jest.spyOn(os, 'homedir');
     spyOSHomedir.mockReturnValue(__dirname);
-    spyInfo = jest.spyOn(core, 'info');
+    spyInfo = core.info as jest.Mock;
     spyInfo.mockImplementation(() => null);
   }, 300000);
 
@@ -842,7 +882,7 @@ describe('toolchains tests', () => {
     // The pre-existing (Sun 1.6) toolchain must be preserved ...
     expect(updated).toContain('<id>sun_1.6</id>');
     expect(updated).toContain('<jdkHome>/opt/jdk/sun/1.6</jdkHome>');
-    // ... and the newly installed JDK must be included in the merged result.
+    // ... and the newly installed JDK must be appended.
     expect(updated).toContain('<id>temurin_17</id>');
     expect(updated).toContain('<vendor>Eclipse Temurin</vendor>');
     expect(updated).toContain(`<jdkHome>${jdkInfo.jdkHome}</jdkHome>`);
@@ -891,6 +931,11 @@ describe('toolchains tests', () => {
     const jdkHome =
       '/opt/hostedtoolcache/Java_Temurin-Hotspot_jdk/17.0.1-12/x64';
 
+    (core.getInput as jest.Mock<any>).mockImplementation((name: string) => {
+      if (name === 'settings-path') return m2Dir;
+      return '';
+    });
+
     await toolchains.configureToolchains(
       version,
       distributionName,
@@ -916,7 +961,7 @@ describe('toolchains tests', () => {
     // Running setup-java several times in the same job (e.g. multiple steps / multiple
     // java-version entries) must accumulate every JDK in toolchains.xml rather
     // than replacing previously registered entries.
-    jest.spyOn(core, 'getInput').mockImplementation((name: string) => {
+    (core.getInput as jest.Mock<any>).mockImplementation((name: string) => {
       if (name === 'settings-path') return m2Dir;
       return '';
     });

__tests__/util.test.ts

@@ -1,19 +1,64 @@
-import * as cache from '@actions/cache';
+import {
-import * as core from '@actions/core';
+  jest,
+  describe,
+  it,
+  expect,
+  beforeEach,
+  afterAll,
+  afterEach
+} from '@jest/globals';
+import {fileURLToPath} from 'url';
 import * as fs from 'fs';
 import * as path from 'path';
-import {
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+
+// Mock @actions/cache
+jest.unstable_mockModule('@actions/cache', () => ({
+  isFeatureAvailable: jest.fn(),
+  saveCache: jest.fn(),
+  restoreCache: jest.fn()
+}));
+
+// Mock @actions/core
+jest.unstable_mockModule('@actions/core', () => ({
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  setOutput: jest.fn(),
+  setFailed: jest.fn(),
+  warning: jest.fn(),
+  info: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
+
+const cache = await import('@actions/cache');
+const core = await import('@actions/core');
+
+const {
   convertVersionToSemver,
   getNextPageUrlFromLinkHeader,
   getVersionFromFileContent,
   isVersionSatisfies,
   isCacheFeatureAvailable,
   isGhes,
-  validatePaginationUrl
+  validatePaginationUrl,
-} from '../src/util';
+  getLatestMajorVersion
-
+} = await import('../src/util.js');
-jest.mock('@actions/cache');
-jest.mock('@actions/core');
 
 describe('isVersionSatisfies', () => {
   it.each([
@@ -45,8 +90,10 @@ describe('isVersionSatisfies', () => {
 
 describe('isCacheFeatureAvailable', () => {
   it('isCacheFeatureAvailable disabled on GHES', () => {
-    jest.spyOn(cache, 'isFeatureAvailable').mockImplementation(() => false);
+    (cache.isFeatureAvailable as jest.Mock<any>).mockImplementation(
-    const infoMock = jest.spyOn(core, 'warning');
+      () => false
+    );
+    const infoMock = core.warning as jest.Mock;
     const message =
       'Caching is only supported on GHES version >= 3.5. If you are on a version >= 3.5, please check with your GHES admin if the Actions cache service is enabled or not.';
     try {
@@ -59,8 +106,10 @@ describe('isCacheFeatureAvailable', () => {
   });
 
   it('isCacheFeatureAvailable disabled on dotcom', () => {
-    jest.spyOn(cache, 'isFeatureAvailable').mockImplementation(() => false);
+    (cache.isFeatureAvailable as jest.Mock<any>).mockImplementation(
-    const infoMock = jest.spyOn(core, 'warning');
+      () => false
+    );
+    const infoMock = core.warning as jest.Mock;
     const message =
       'The runner was not able to contact the cache service. Caching will be skipped';
     try {
@@ -73,9 +122,14 @@ describe('isCacheFeatureAvailable', () => {
   });
 
   it('isCacheFeatureAvailable is enabled', () => {
-    jest.spyOn(cache, 'isFeatureAvailable').mockImplementation(() => true);
+    (cache.isFeatureAvailable as jest.Mock<any>).mockImplementation(() => true);
     expect(isCacheFeatureAvailable()).toBe(true);
   });
+
+  afterEach(() => {
+    jest.resetAllMocks();
+    jest.clearAllMocks();
+  });
 });
 
 describe('convertVersionToSemver', () => {
@@ -315,7 +369,6 @@ describe('isGhes', () => {
   const pristineEnv = process.env;
 
   beforeEach(() => {
-    jest.resetModules();
     process.env = {...pristineEnv};
   });
 
@@ -348,3 +401,33 @@ describe('isGhes', () => {
     expect(isGhes()).toBeTruthy();
   });
 });
+
+describe('getLatestMajorVersion', () => {
+  const makeHttp = (getJson: jest.Mock) =>
+    ({getJson}) as unknown as import('@actions/http-client').HttpClient;
+
+  it('returns most_recent_feature_release from the Adoptium API', async () => {
+    const getJson = jest.fn(async () => ({
+      statusCode: 200,
+      result: {most_recent_feature_release: 25},
+      headers: {}
+    }));
+
+    await expect(getLatestMajorVersion(makeHttp(getJson))).resolves.toBe(25);
+    expect(getJson).toHaveBeenCalledWith(
+      'https://api.adoptium.net/v3/info/available_releases'
+    );
+  });
+
+  it('throws when the response does not contain a usable value', async () => {
+    const getJson = jest.fn(async () => ({
+      statusCode: 200,
+      result: {},
+      headers: {}
+    }));
+
+    await expect(getLatestMajorVersion(makeHttp(getJson))).rejects.toThrow(
+      'Could not determine the latest available Java major version'
+    );
+  });
+});

action.yml

@@ -4,7 +4,7 @@ description: 'Set up a specific version of the Java JDK and add the
 author: 'GitHub'
 inputs:
   java-version:
-    description: 'The Java version to set up. Takes a whole or semver Java version. See examples of supported syntax in README file'
+    description: 'The Java version to set up. Takes a whole or semver Java version, or the "latest" alias to use the newest available stable release. See examples of supported syntax in README file'
     required: false
   java-version-file:
     description: 'The path to a file containing the Java version to set up (.java-version, .tool-versions, .sdkmanrc). Used when java-version is not set. See examples of supported syntax in README file'
@@ -94,6 +94,10 @@ inputs:
     description: 'Whether Maven should print artifact download/transfer progress to the build log. When "false" (default) the action sets "-ntp" (--no-transfer-progress) in MAVEN_ARGS to produce cleaner logs. Set to "true" to keep the progress output. Has no effect on non-Maven builds.'
     required: false
     default: false
+  problem-matcher:
+    description: 'Whether to register the Java problem matcher (compiler errors/warnings and uncaught exceptions). Set to "false" to disable annotations.'
+    required: false
+    default: true
 outputs:
   distribution:
     description: 'Distribution of Java that has been installed'

dist/cleanup/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

dist/setup/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}

docs/advanced-usage.md

@@ -4,6 +4,7 @@
   - [Adopt](#Adopt)
   - [Zulu](#Zulu)
   - [Liberica](#Liberica)
+  - [Liberica Native Image Kit](#Liberica-Native-Image-Kit)
   - [Microsoft](#Microsoft)
   - [Amazon Corretto](#Amazon-Corretto)
   - [Oracle](#Oracle)
@@ -15,6 +16,7 @@
   - [Tencent Kona](#Tencent-Kona)
 - [Installing custom Java package type](#Installing-custom-Java-package-type)
   - [JavaFX Maven project](#JavaFX-Maven-project)
+- [Ensuring the Maven cache is complete (plugin dependencies)](#ensuring-the-maven-cache-is-complete-plugin-dependencies)
 - [Installing custom Java architecture](#Installing-custom-Java-architecture)
 - [Installing JDK without setting as default](#Installing-JDK-without-setting-as-default)
 - [Installing custom Java distribution from local file](#Installing-Java-from-local-file)
@@ -37,12 +39,12 @@ Inputs `java-version` and `distribution` are mandatory and needs to be provided.
 
 ```yaml
 steps:
-- uses: actions/checkout@v6
+  - uses: actions/checkout@v7
-- uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: 'temurin'
       java-version: '25'
-- run: java --version
+  - run: java --version
 ```
 
 ### Adopt
@@ -50,50 +52,64 @@ steps:
 
 ```yaml
 steps:
-- uses: actions/checkout@v6
+  - uses: actions/checkout@v7
-- uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: 'adopt-hotspot'
       java-version: '11'
-- run: java --version
+  - run: java --version
 ```
 
 ### Zulu
 
 ```yaml
 steps:
-- uses: actions/checkout@v6
+  - uses: actions/checkout@v7
-- uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: 'zulu'
       java-version: '25'
       java-package: jdk # optional (jdk, jre, jdk+fx, jre+fx, jdk+crac, or jre+crac) - defaults to jdk
-- run: java --version
+  - run: java --version
 ```
 
 ### Liberica
 
 ```yaml
 steps:
-- uses: actions/checkout@v6
+  - uses: actions/checkout@v7
-- uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: 'liberica'
       java-version: '25'
       java-package: jdk # optional (jdk, jre, jdk+fx or jre+fx) - defaults to jdk
-- run: java --version
+  - run: java --version
+```
+
+### Liberica Native Image Kit
+Liberica Native Image Kit (NIK) is a GraalVM-based distribution. `java-version` selects the underlying JDK version (e.g. `17`, `21`, `25`). Use `java-package: jdk+fx` to get the `full` bundle with JavaFX/Swing support; otherwise the `standard` bundle (with extra languages) is installed. Available on Linux, macOS and Windows for `x64` and `aarch64`.
+
+```yaml
+steps:
+  - uses: actions/checkout@v7
+  - uses: actions/setup-java@v6
+    with:
+      distribution: 'liberica-nik'
+      java-version: '25'
+      java-package: jdk # optional (jdk or jdk+fx) - defaults to jdk
+  - run: native-image --version
 ```
 
 ### Microsoft
 
 ```yaml
 steps:
-- uses: actions/checkout@v6
+  - uses: actions/checkout@v7
-- uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: 'microsoft'
       java-version: '25'
-- run: java --version
+  - run: java --version
 ```
 
 ### Using Microsoft distribution on GHES
@@ -103,7 +119,7 @@ steps:
 To get a higher rate limit, you can [generate a personal access token on github.com](https://github.com/settings/tokens/new) and pass it as the `token` input for the action:
 
 ```yaml
-uses: actions/setup-java@v5
+uses: actions/setup-java@v6
 with:
   token: ${{ secrets.GH_DOTCOM_TOKEN }}
   distribution: 'microsoft'
@@ -117,12 +133,12 @@ If the runner is not able to access github.com, any Java versions requested duri
 
 ```yaml
 steps:
-- uses: actions/checkout@v6
+  - uses: actions/checkout@v7
-- uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: 'corretto'
       java-version: '25'
-- run: java --version
+  - run: java --version
 ```
 
 ### Oracle
@@ -130,12 +146,12 @@ steps:
 
 ```yaml
 steps:
-- uses: actions/checkout@v6
+  - uses: actions/checkout@v7
-- uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: 'oracle'
       java-version: '25'
-- run: java --version
+  - run: java --version
 ```
 
 ### Alibaba Dragonwell
@@ -143,24 +159,24 @@ steps:
 
 ```yaml
 steps:
-- uses: actions/checkout@v6
+  - uses: actions/checkout@v7
-- uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: 'dragonwell'
       java-version: '8'
-- run: java --version
+  - run: java --version
 ```
 
 ### SapMachine
 **NOTE:** An OpenJDK release maintained and supported by SAP
 ```yaml
 steps:
-- uses: actions/checkout@v6
+  - uses: actions/checkout@v7
-- uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: 'sapmachine'
       java-version: '25'
-- run: java --version
+  - run: java --version
 ```
 
 ### GraalVM
@@ -168,12 +184,12 @@ steps:
 
 ```yaml
 steps:
-- uses: actions/checkout@v6
+  - uses: actions/checkout@v7
-- uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: 'graalvm'
       java-version: '25'
-- run: |
+  - run: |
       java --version
       native-image --version
 ```
@@ -183,12 +199,12 @@ steps:
 
 ```yaml
 steps:
-- uses: actions/checkout@v6
+  - uses: actions/checkout@v7
-- uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: 'graalvm-community'
       java-version: '21'
-- run: |
+  - run: |
       java --version
       native-image --version
 ```
@@ -202,12 +218,12 @@ For example, `11.0.24` is not available but `11.0.16` is.
 
 ```yaml
 steps:
-- uses: actions/checkout@v6
+  - uses: actions/checkout@v7
-- uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: 'jetbrains'
       java-version: '11'
-- run: java --version
+  - run: java --version
 ```
 
 The JetBrains installer uses the GitHub API to fetch the latest version. If you believe your project is going to be running into rate limits, you can provide a
@@ -215,15 +231,15 @@ GitHub token to the action to increase the rate limit. Set the `GITHUB_TOKEN` en
 
 ```yaml
 steps:
-- uses: actions/checkout@v6
+  - uses: actions/checkout@v7
-- uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: 'jetbrains'
       java-version: '17'
       java-package: 'jdk' # optional (jdk, jre, jdk+jcef, jre+jcef, jdk+ft, or jre+ft) - defaults to jdk
     env:
       GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-- run: java --version
+  - run: java --version
 ```
 
 You can specify your package type (as shown in the [releases page](https://github.com/JetBrains/JetBrainsRuntime/releases/)) in the `java-package` parameter. 
@@ -241,24 +257,24 @@ The available package types are:
 
 ```yaml
 steps:
-- uses: actions/checkout@v6
+  - uses: actions/checkout@v7
-- uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: 'kona'
       java-version: '21'
-- run: java --version
+  - run: java --version
 ```
 
 ## Installing custom Java package type
 ```yaml
 steps:
-- uses: actions/checkout@v6
+  - uses: actions/checkout@v7
-- uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: '<distribution>'
       java-version: '25'
       java-package: jdk # optional (jdk or jre) - defaults to jdk
-- run: java --version
+  - run: java --version
 ```
 
 ### JavaFX Maven project
@@ -267,14 +283,14 @@ For JavaFX projects that use Maven, use `jdk+fx` (or `jre+fx`) as the `java-pack
 
 ```yaml
 steps:
-- uses: actions/checkout@v6
+  - uses: actions/checkout@v7
-- uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: 'zulu'
       java-version: '25'
       java-package: jdk+fx
       cache: maven
-- name: Build with Maven
+  - name: Build with Maven
     run: mvn --no-transfer-progress compile
 ```
 
@@ -285,17 +301,140 @@ To run the JavaFX application in CI:
   run: mvn --no-transfer-progress javafx:run
 ```
 
+## Ensuring the Maven cache is complete (plugin dependencies)
+
+When you enable `cache: maven`, the action caches your local Maven repository
+(`~/.m2/repository`). The cache key is a hash of your Maven inputs — every
+`**/pom.xml`, plus `**/.mvn/wrapper/maven-wrapper.properties` and
+`**/.mvn/extensions.xml` — so changing any of those files (for example bumping
+the wrapper version or editing core extensions) produces a new key and
+invalidates the cache. At the end of the job the action saves whatever was
+downloaded during that run. It does **not** re-save the cache when the key
+already matches (a cache *hit*).
+
+Downloaded Maven Wrapper distributions (`~/.m2/wrapper/dists`) are cached in a
+**separate** cache entry keyed only on `**/.mvn/wrapper/maven-wrapper.properties`.
+Because the wrapper distribution changes far less often than your `pom.xml`
+files, this keeps it available across the frequent dependency changes that
+rotate the main cache key, so wrapper-based (`./mvnw`) builds don't re-download
+the Maven distribution on every dependency change. See
+[issue #1095](https://github.com/actions/setup-java/issues/1095).
+
+Maven resolves **plugin** dependencies lazily: it only downloads the plugins and
+plugin dependencies required by the goals that actually execute. As a result, the
+run that first creates the cache determines what is stored. If that run executed a
+"thin" goal such as `mvn compile`, plugins bound to later phases are never
+resolved. For example, `maven-shade-plugin` (bound to `package`) pulls in
+`plexus-archiver`, `commons-compress`, `io.airlift:aircompressor` and
+`org.tukaani:xz` — none of which a `compile` run downloads. Those artifacts are
+therefore absent from the cache, and because the action does not re-save on a
+hit, every later `test`/`verify`/`package` job re-downloads them on every run.
+
+### Seed the cache with a resolution step
+
+To populate `~/.m2` as comprehensively as possible on the run that creates the
+cache, run a dependency-resolution "seed" command before your build. Choose a
+command based on how thorough you need it to be:
+
+| Seed command | Resolves plugin dependencies? | Notes |
+|--------------|:-----------------------------:|-------|
+| `mvn dependency:resolve` | No | Resolves project dependencies only — misses plugin dependencies (e.g. `aircompressor`). |
+| `mvn dependency:resolve-plugins` | Yes | Resolves plugins **and their dependencies**. |
+| `mvn dependency:go-offline` | Yes | Resolves project and plugin dependencies (a superset). |
+| `mvn dependency:go-offline dependency:resolve-plugins` | Yes (most thorough) | Recommended default. Use `dependency:resolve dependency:resolve-plugins` if `go-offline` is flaky or insufficient for your project. |
+
+Single job — seed, then build (the cache saved at the end of this run contains
+the full set):
+
+```yaml
+steps:
+  - uses: actions/checkout@v7
+  - uses: actions/setup-java@v6
+    with:
+      distribution: 'temurin'
+      java-version: '25'
+      cache: 'maven'
+  - name: Seed the Maven cache
+    run: mvn dependency:go-offline dependency:resolve-plugins
+  - name: Build with Maven
+    run: mvn verify --file pom.xml
+```
+
+Separate seed job — useful for a matrix where different legs run different goals
+(`test`, `check`, `verify`, `-Pprofile1`, ...) but all share the same `~/.m2`
+cache. Without a seed, whichever job finishes first creates the cache from its
+own partial `.m2`, and parallel jobs race to save an equally partial cache; the
+seed job instead creates one comprehensive cache that every other job reuses:
+
+```yaml
+jobs:
+  seed-cache:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-java@v6
+        with:
+          distribution: 'temurin'
+          java-version: '25'
+          cache: 'maven'
+      - name: Seed the Maven cache
+        run: mvn dependency:go-offline dependency:resolve-plugins
+
+  build:
+    needs: seed-cache
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        goal: ['test', 'verify', 'test -Pprofile1']
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-java@v6
+        with:
+          distribution: 'temurin'
+          java-version: '25'
+          cache: 'maven'
+      - name: Build
+        run: mvn ${{ matrix.goal }} --file pom.xml
+```
+
+### Caveats
+
+- **The seed only helps on the run that creates the cache.** Once a cache exists
+  for the current `pom.xml` hash, later runs get a hit and any additional
+  downloads are not saved. On an existing repository whose cache is already
+  incomplete, invalidate it once (for example by changing `cache-dependency-path`
+  or deleting the repository's caches) so a complete cache is created from the
+  seed.
+- **Static resolution is not exhaustive.** `go-offline`/`resolve-plugins` resolve
+  the statically declared plugin set for the *active* profiles and modules.
+  Profile-gated plugins, conditionally-active modules, and artifacts a plugin
+  fetches at execution time may still be missed. For the most complete cache,
+  seed with the fullest goal set your CI actually uses (for example
+  `mvn verify` with every profile enabled).
+- **Multi-module projects:** run the seed at the reactor root so every module's
+  plugins are resolved.
+
+> [!NOTE]
+> The same "the cache stores only what the creating run downloaded, and is not
+> re-saved on a hit" behavior applies to `cache: gradle`, since Gradle also
+> resolves dependencies and plugin/buildscript classpaths lazily. Gradle has no
+> direct equivalent of `dependency:go-offline`, so for complete and fine-grained
+> dependency caching on Gradle projects we recommend
+> [`gradle/actions/setup-gradle`](https://github.com/gradle/actions/tree/main/setup-gradle),
+> which provides purpose-built caching (see the
+> [setup-gradle documentation](https://github.com/gradle/actions/blob/main/docs/setup-gradle.md)).
+
 ## Installing custom Java architecture
 
 ```yaml
 steps:
-- uses: actions/checkout@v6
+  - uses: actions/checkout@v7
-- uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: '<distribution>'
       java-version: '25'
       architecture: x86 # optional - default value derived from the runner machine
-- run: java --version
+  - run: java --version
 ```
 
 ## Installing JDK without setting as default
@@ -304,18 +443,18 @@ When installing multiple JDKs, the last one installed becomes the default (`JAVA
 
 ```yaml
 steps:
-- uses: actions/checkout@v6
+  - uses: actions/checkout@v7
-- uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: 'temurin'
       java-version: '17'
-- uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     id: setup-java-21
     with:
       distribution: 'temurin'
       java-version: '21'
       set-default: false
-- run: |
+  - run: |
       echo "Default java:"
       java -version
       echo "Java 21 home: $JAVA_HOME_21_X64"
@@ -334,40 +473,40 @@ If your use-case requires a custom distribution or a version that is not provide
 
 ```yaml
 steps:
-- run: |
+  - run: |
       download_url="https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.10%2B9/OpenJDK11U-jdk_x64_linux_hotspot_11.0.10_9.tar.gz"
       wget -O $RUNNER_TEMP/java_package.tar.gz $download_url
-- uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: 'jdkfile'
       jdk-file: ${{ runner.temp }}/java_package.tar.gz
       java-version: '11.0.0'
       architecture: x64
     
-- run: java --version
+  - run: java --version
 ```
 
 For example, to use an **Early Access** build from [jdk.java.net](https://jdk.java.net/), download the archive for your runner OS/architecture and install it via `distribution: 'jdkfile'` (example below assumes Linux x64):
 
 ```yaml
 steps:
-- run: |
+  - run: |
       download_url="https://download.java.net/java/early_access/jdk25/36/GPL/openjdk-25-ea+36_linux-x64_bin.tar.gz"
       wget -O $RUNNER_TEMP/java_package.tar.gz $download_url
-- uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: 'jdkfile'
       jdk-file: ${{ runner.temp }}/java_package.tar.gz
       java-version: '25.0.0-ea.36'
       architecture: x64
 
-- run: java --version
+  - run: java --version
 ```
 
 If your use-case requires a custom distribution (in the example, alpine-linux is used) or a version that is not provided by setup-java and you want to always install the latest version during runtime, then you can use the following code to auto-download the latest JDK, determine the semver needed for setup-java, and setup-java will take care of the installation and caching on the VM:
 
 ```yaml
-   steps:
+steps:
   - name: fetch latest temurin JDK
     id: fetch_latest_jdk
     run: |
@@ -380,7 +519,7 @@ If your use-case requires a custom distribution (in the example, alpine-linux is
       latest_semver_version=$(curl -sL $latest_jdk_json_url | jq -r 'version.semver')
       echo "java_version=$latest_semver_version" >> "$GITHUB_OUTPUT"
 
-      - uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: 'jdkfile'
       jdk-file: ${{ runner.temp }}/java_package.tar.gz
@@ -401,9 +540,9 @@ jobs:
         java: [ '8', '11' ]
     name: Java ${{ matrix.Java }} (${{ matrix.distribution }}) sample
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Setup java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v6
         with:
           distribution: ${{ matrix.distribution }}
           java-version: ${{ matrix.java }}
@@ -421,9 +560,9 @@ jobs:
         os: [ 'ubuntu-latest', 'macos-latest', 'windows-latest' ]
     name: Java ${{ matrix.Java }} (${{ matrix.os }}) sample
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Setup java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@v6
         with:
           distribution: 'temurin'
           java-version: ${{ matrix.java }}
@@ -438,15 +577,15 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Set up JDK 11
-      uses: actions/setup-java@v5
+        uses: actions/setup-java@v6
         with:
           distribution: '<distribution>'
           java-version: '11'
 
       - name: Build with Maven
-      run: mvn -B package --file pom.xml
+        run: mvn package --file pom.xml
 
       - name: Publish to GitHub Packages Apache Maven
         run: mvn deploy
@@ -454,21 +593,20 @@ jobs:
           GITHUB_TOKEN: ${{ github.token }} # GITHUB_TOKEN is the default env for the password
 
       - name: Set up Apache Maven Central
-      uses: actions/setup-java@v5
+        uses: actions/setup-java@v6
         with: # running setup-java again overwrites the settings.xml
           distribution: 'temurin'
           java-version: '11'
           server-id: maven # Value of the distributionManagement/repository/id field of the pom.xml
           server-username: MAVEN_USERNAME # env variable for username in deploy
           server-password: MAVEN_CENTRAL_TOKEN # env variable for token in deploy
-        gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} # Value of the GPG private key to import
-        gpg-passphrase: MAVEN_GPG_PASSPHRASE # env variable for GPG private key passphrase
 
       - name: Publish to Apache Maven Central
-      run: mvn deploy
+        run: mvn deploy -Dgpg.signer=bc # requires maven-gpg-plugin >= 3.2.0 (bc signer support)
         env:
           MAVEN_USERNAME: maven_username123
           MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
+          MAVEN_GPG_KEY: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} # ASCII-armored secret key (TSK), e.g. from `gpg --armor --export-secret-keys YOUR_ID`
           MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
 ```
 
@@ -486,10 +624,6 @@ The two `settings.xml` files created from the above example look like the follow
       <username>${env.GITHUB_ACTOR}</username>
       <password>${env.GITHUB_TOKEN}</password>
     </server>
-    <server>
-      <id>gpg.passphrase</id>
-      <passphrase>${env.GPG_PASSPHRASE}</passphrase>
-    </server>
   </servers>
 </settings>
 ```
@@ -506,10 +640,6 @@ The two `settings.xml` files created from the above example look like the follow
       <username>${env.MAVEN_USERNAME}</username>
       <password>${env.MAVEN_CENTRAL_TOKEN}</password>
     </server>
-    <server>
-      <id>gpg.passphrase</id>
-      <passphrase>${env.MAVEN_GPG_PASSPHRASE}</passphrase>
-    </server>
   </servers>
 </settings>
 ```
@@ -520,9 +650,64 @@ The two `settings.xml` files created from the above example look like the follow
 
 If you don't want to overwrite the `settings.xml` file, you can set `overwrite-settings: false`
 
-### Extra setup for pom.xml:
+### GPG
 
-The Maven GPG Plugin configuration in the pom.xml file should contain the following structure to avoid possible issues like `Inappropriate ioctl for device` or `gpg: signing failed: No such file or directory`:
+The example above uses the [Maven GPG Plugin](https://maven.apache.org/plugins/maven-gpg-plugin/)'s Bouncy Castle signer (`-Dgpg.signer=bc`, available since `maven-gpg-plugin` 3.2.0). It is a pure-Java signer that reads the key directly from the `MAVEN_GPG_KEY` environment variable, so it does **not** require the `gpg` executable, importing the key into a GPG keychain, or the `--pinentry-mode loopback` workaround in your `pom.xml`. The key must be an ASCII-armored secret key (transferable secret key format).
+
+**GPG key should be exported by: `gpg --armor --export-secret-keys YOUR_ID`**
+
+See the help docs on [Publishing a Package](https://help.github.com/en/github/managing-packages-with-github-packages/configuring-apache-maven-for-use-with-github-packages#publishing-a-package) for more information on the `pom.xml` file.
+
+#### Legacy / alternative: let setup-java import the key
+
+If you prefer signing with the `gpg` executable (for example because you are using `maven-gpg-plugin` older than 3.2.0), you can let setup-java import the key instead by providing the `gpg-private-key` and `gpg-passphrase` inputs. The private key is written to a file in the runner's temp directory, imported into the GPG keychain, and the file is promptly removed before proceeding with the rest of the setup process. A cleanup step removes the imported private key from the GPG keychain after the job completes regardless of the job status. This ensures that the private key is no longer accessible on self-hosted runners and cannot "leak" between jobs (hosted runners are always clean instances).
+
+setup-java imports the key independently of the plugin version, but the generated passphrase profile described below uses `gpg.passphraseEnvName`, which requires `maven-gpg-plugin` 3.2.0 or newer. Since `gpg-passphrase` defaults to `GPG_PASSPHRASE`, setup-java writes that profile unless you override the input to `MAVEN_GPG_PASSPHRASE`.
+
+```yaml
+    - name: Set up Apache Maven Central
+      uses: actions/setup-java@v6
+      with:
+        distribution: 'temurin'
+        java-version: '11'
+        server-id: maven # Value of the distributionManagement/repository/id field of the pom.xml
+        server-username: MAVEN_USERNAME # env variable for username in deploy
+        server-password: MAVEN_CENTRAL_TOKEN # env variable for token in deploy
+        gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }} # Value of the GPG private key to import
+        gpg-passphrase: MAVEN_GPG_PASSPHRASE # env variable for GPG private key passphrase
+
+    - name: Publish to Apache Maven Central
+      run: mvn deploy
+      env:
+        MAVEN_USERNAME: maven_username123
+        MAVEN_CENTRAL_TOKEN: ${{ secrets.MAVEN_CENTRAL_TOKEN }}
+        MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
+```
+
+The `gpg-passphrase` input is the **name of the environment variable** that holds the passphrase (not the passphrase itself). It defaults to `GPG_PASSPHRASE`. The [Maven GPG Plugin](https://maven.apache.org/plugins/maven-gpg-plugin/) reads the passphrase from the environment variable named by its `gpg.passphraseEnvName` property, whose own default is `MAVEN_GPG_PASSPHRASE`.
+
+- If `gpg-passphrase` is `MAVEN_GPG_PASSPHRASE`, the plugin already reads that variable by default, so setup-java writes nothing extra to `settings.xml`.
+- Otherwise (including the default `GPG_PASSPHRASE`), setup-java configures `gpg.passphraseEnvName` through an active profile in the generated `settings.xml` so the plugin reads the passphrase from that variable. For the default `gpg-passphrase: GPG_PASSPHRASE`:
+
+```xml
+    <profiles>
+      <profile>
+        <id>setup-java-gpg</id>
+        <properties>
+          <gpg.passphraseEnvName>GPG_PASSPHRASE</gpg.passphraseEnvName>
+        </properties>
+      </profile>
+    </profiles>
+    <activeProfiles>
+      <activeProfile>setup-java-gpg</activeProfile>
+    </activeProfiles>
+```
+
+> **Note:** Earlier versions of setup-java wrote a `gpg.passphrase` server to `settings.xml`. That mechanism is deprecated by the Maven GPG Plugin and fails when its `bestPractices` mode is enabled, so setup-java now relies on `gpg.passphraseEnvName` instead. The `gpg-passphrase` input and its `GPG_PASSPHRASE` default are unchanged, so existing workflows that set the `GPG_PASSPHRASE` environment variable keep working.
+
+> **Compatibility note:** Reading the passphrase from an environment variable (`gpg.passphraseEnvName`) requires `maven-gpg-plugin` 3.2.0 or newer. Older versions do not honor this property and will not pick up the passphrase, because setup-java no longer writes the deprecated `gpg.passphrase` server to `settings.xml`. If you are pinned to `maven-gpg-plugin` older than 3.2.0, upgrade to 3.2.0+.
+
+When signing with the `gpg` executable, the Maven GPG Plugin configuration in your `pom.xml` should contain the following structure to avoid possible issues like `Inappropriate ioctl for device` or `gpg: signing failed: No such file or directory`:
 
 ```xml
 <configuration>
@@ -533,17 +718,10 @@ The Maven GPG Plugin configuration in the pom.xml file should contain the follow
   </gpgArguments>
 </configuration>
 ```
-GPG 2.1 requires `--pinentry-mode` to be set to `loopback` in order to pick up the `gpg.passphrase` value defined in Maven `settings.xml`.
 
-### GPG
+GPG 2.1 requires `--pinentry-mode` to be set to `loopback` in order to read the passphrase non-interactively.
 
-If `gpg-private-key` input is provided, the private key will be written to a file in the runner's temp directory, the private key file will be imported into the GPG keychain, and then the file will be promptly removed before proceeding with the rest of the setup process. A cleanup step will remove the imported private key from the GPG keychain after the job completes regardless of the job status. This ensures that the private key is no longer accessible on self-hosted runners and cannot "leak" between jobs (hosted runners are always clean instances).
+***NOTE***: If, when using the default `gpg` signer, the error `gpg: Sorry, no terminal at all requested - can't get input` [is encountered](https://github.com/actions/setup-java/issues/554), please update the version of `maven-gpg-plugin` to 1.6 or higher.
-
-**GPG key should be exported by: `gpg --armor --export-secret-keys YOUR_ID`**
-
-See the help docs on [Publishing a Package](https://help.github.com/en/github/managing-packages-with-github-packages/configuring-apache-maven-for-use-with-github-packages#publishing-a-package) for more information on the `pom.xml` file.
-
-***NOTE***: If the error that states, `gpg: Sorry, no terminal at all requested - can't get input` [is encountered](https://github.com/actions/setup-java/issues/554), please update the version of `maven-gpg-plugin` to 1.6 or higher.
 
 ## Apache Maven with a settings path
 
@@ -555,9 +733,9 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
       - name: Set up JDK 11 for Shared Runner
-      uses: actions/setup-java@v5
+        uses: actions/setup-java@v6
         with:
           distribution: '<distribution>'
           java-version: '11'
@@ -565,7 +743,7 @@ jobs:
           settings-path: ${{ github.workspace }} # location for the settings.xml file
 
       - name: Build with Maven
-      run: mvn -B package --file pom.xml
+        run: mvn package --file pom.xml
 
       - name: Publish to GitHub Packages Apache Maven
         run: mvn deploy -s $GITHUB_WORKSPACE/settings.xml
@@ -587,34 +765,35 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
-    - uses: actions/setup-java@v5
+      - uses: actions/setup-java@v6
         with:
           distribution: '<distribution>'
           java-version: '21'
           show-download-progress: true # keep Maven download/transfer progress in the logs
 
       - name: Build with Maven
-      run: mvn -B package --file pom.xml
+        run: mvn package --file pom.xml
 ```
 
 ***NOTES***:
 - `MAVEN_ARGS` is honored by Maven 3.9.0+ and the Maven Wrapper (`mvnw`). Older Maven versions ignore it, so on those you can pass `--no-transfer-progress` on the command line instead.
 - This setting only affects Maven. It has no effect on Gradle, sbt, or other build tools.
-- `-ntp` only controls transfer/progress output; it does not change whether Maven runs in batch mode. Use `-B`/`--batch-mode` (or `<interactiveMode>false</interactiveMode>` in `settings.xml`) if you also want non-interactive runs.
+- `-ntp` only controls transfer/progress output. The `settings.xml` generated by `setup-java` separately sets `<interactiveMode>false</interactiveMode>`. If you use `overwrite-settings: false`, ensure your existing settings disable interactive mode or pass `-B`/`--batch-mode`.
 
 ## Java problem matcher (compiler annotations)
 
-`setup-java` registers a [problem matcher](https://github.com/actions/toolkit/blob/main/docs/problem-matchers.md) for Java after installing the JDK. It scans the log output of subsequent steps and turns `javac` diagnostics into GitHub [annotations](https://docs.github.com/actions/using-workflows/workflow-commands-for-github-actions#setting-a-warning-message) that appear in the run summary and inline on the affected files. It matches two kinds of lines:
+By default, `setup-java` registers a [problem matcher](https://github.com/actions/toolkit/blob/main/docs/problem-matchers.md) for Java after installing the JDK. It scans the log output of subsequent steps and turns Java diagnostics into GitHub [annotations](https://docs.github.com/actions/using-workflows/workflow-commands-for-github-actions#setting-a-warning-message) that appear in the run summary and inline on the affected files. It matches three kinds of lines:
 
 - Compiler errors and warnings, e.g. `App.java:12: error: cannot find symbol` (owner `javac`).
+- Maven compiler errors and warnings, e.g. `[ERROR] /path/App.java:[12,5] cannot find symbol` (owner `maven-javac`).
 - Uncaught-exception header lines, e.g. `Exception in thread "main" ...`; because these lines have no file or line captures, they appear as log/run-level annotations rather than inline file annotations (owner `java`).
 
-This is enabled by default and requires no configuration.
+GitHub Actions limits problem matcher annotations to 10 of each severity per step and 50 annotations per job. Additional diagnostics remain available in the build log. Log grouping does not change these limits because every matched diagnostic still counts as an annotation.
 
 ### Disabling the problem matcher
 
-There is no action input to turn the matcher off, but you can disable it for the rest of the job with the built-in [`remove-matcher`](https://github.com/actions/toolkit/blob/main/docs/problem-matchers.md#remove-a-problem-matcher) workflow command. Pass the matcher **owner** (not a file name); the Java matcher defines two owners, `javac` and `java`, so remove both to fully suppress it:
+Set `problem-matcher` to `false` to prevent the matcher from being registered:
 
 ```yaml
 jobs:
@@ -622,24 +801,18 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
-    - uses: actions/setup-java@v5
+      - uses: actions/setup-java@v6
         with:
           distribution: '<distribution>'
           java-version: '21'
-
+          problem-matcher: false
-    - name: Disable the Java problem matcher
-      run: |
-        echo "::remove-matcher owner=javac::"
-        echo "::remove-matcher owner=java::"
 
       - name: Build with Maven
-      run: mvn -B package --file pom.xml
+        run: mvn package --file pom.xml
 ```
 
-***NOTES***:
+Disabling the matcher only stops annotations from being created. Compiler output remains in the log, and compilation errors still fail the build step.
-- `remove-matcher` only stops annotations from being created; the underlying compiler output is unchanged, so a failing `javac`/build still fails the step.
-- The command is scoped to the job, so add the step right after `setup-java` (and before your build) in every job where you want the matcher disabled.
 
 ## Publishing using Gradle
 ```yaml
@@ -649,10 +822,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-    - uses: actions/checkout@v6
+      - uses: actions/checkout@v7
 
       - name: Set up JDK 11
-      uses: actions/setup-java@v5
+        uses: actions/setup-java@v6
         with:
           distribution: '<distribution>'
           java-version: '11'
@@ -688,14 +861,14 @@ Toolchain entries are always merged non-destructively: existing JDK, custom, and
 
 ```yaml
 steps:
-- uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: '<distribution>'
       java-version: |
         8
         11
 
-- uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: '<distribution>'
       java-version: '15'
@@ -707,7 +880,7 @@ The result is a Toolchain with entries for JDKs 8, 11 and 15. You can even combi
 - run: |
     download_url="https://example.com/java/jdk/6u45-b06/jdk-6u45-linux-x64.tar.gz"
     wget -O $RUNNER_TEMP/java_package.tar.gz $download_url
-- uses: actions/setup-java@v5
+- uses: actions/setup-java@v6
   with:
     distribution: 'jdkfile'
     jdk-file: ${{ runner.temp }}/java_package.tar.gz
@@ -724,7 +897,7 @@ Each JDK provider will receive a default `vendor` using the `distribution` input
 - run: |
     download_url="https://example.com/java/jdk/6u45-b06/jdk-6u45-linux-x64.tar.gz"
     wget -O $RUNNER_TEMP/java_package.tar.gz $download_url
-- uses: actions/setup-java@v5
+- uses: actions/setup-java@v6
   with:
     distribution: 'jdkfile'
     jdk-file: ${{ runner.temp }}/java_package.tar.gz
@@ -739,7 +912,7 @@ In case you install multiple versions of Java at once with multi-line `java-vers
 
 ```yaml
 steps:
-- uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: '<distribution>'
       java-version: |
@@ -753,20 +926,20 @@ Each JDK provider will receive a default `id` based on the combination of `distr
 
 ```yaml
 steps:
-- uses: actions/checkout@v6
+  - uses: actions/checkout@v7
-- uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: 'temurin'
       java-version: '11'
       mvn-toolchain-id: 'some_other_id'
-- run: java --version
+  - run: java --version
 ```
 
 In case you install multiple versions of Java at once you can use the same syntax as used in `java-versions`. Please note that you have to declare an ID for all Java versions that will be installed or the `mvn-toolchain-id` instruction will be skipped wholesale due to mapping ambiguities.
 
 ```yaml
 steps:
-- uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: '<distribution>'
       java-version: |
@@ -828,7 +1001,7 @@ steps:
 **Example step using `Sdkman!`** (distribution inferred from `.sdkmanrc`):
 ```yml
   - name: Setup java
-    uses: actions/setup-java@v5
+    uses: actions/setup-java@v6
     with:
       java-version-file: '.sdkmanrc'
 ```
@@ -841,7 +1014,7 @@ java=17.0.7-tem
 **Example step using `asdf`** (distribution inferred from `.tool-versions`):
 ```yml
   - name: Setup java
-    uses: actions/setup-java@v5
+    uses: actions/setup-java@v6
     with:
       java-version-file: '.tool-versions'
 ```
@@ -885,7 +1058,7 @@ steps:
   - name: Trust the internal CA
     run: echo "NODE_EXTRA_CA_CERTS=/etc/ssl/certs/internal-ca.pem" >> "$GITHUB_ENV"
 
-  - uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: 'temurin'
       java-version: '21'
@@ -900,7 +1073,7 @@ steps:
       echo "${{ secrets.INTERNAL_CA_PEM }}" > "${RUNNER_TEMP}/internal-ca.pem"
       echo "NODE_EXTRA_CA_CERTS=${RUNNER_TEMP}/internal-ca.pem" >> "$GITHUB_ENV"
 
-  - uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: 'temurin'
       java-version: '21'
@@ -928,7 +1101,7 @@ The JDK keeps its own trust store — a keystore named `cacerts` under `$JAVA_HO
 
 ```yaml
 steps:
-  - uses: actions/setup-java@v5
+  - uses: actions/setup-java@v6
     with:
       distribution: 'temurin'
       java-version: '21'
@@ -953,4 +1126,3 @@ Notes and caveats:
 - Prefer giving the certificate a stable, descriptive `-alias` so re-runs are idempotent (re-importing the same alias will fail; add `keytool -delete -alias internal-ca ...` first if you re-run within a long-lived runner).
 
 This documents the post-install workflow; there is no dedicated action input for supplying a custom `cacerts` file.
-

docs/switching-to-v2.md

@@ -4,13 +4,13 @@ The major breaking change in V2 is the new mandatory `distribution` input. This
 Use the `zulu` keyword if you would like to continue using the same distribution as in V1.
 ```yaml
 steps:
-- uses: actions/checkout@v2
+  - uses: actions/checkout@v2
-- uses: actions/setup-java@v2
+  - uses: actions/setup-java@v2
     with:
       distribution: 'zulu'
       java-version: '11'
       java-package: jdk # optional (jdk or jre) - defaults to jdk
-- run: java -cp java HelloWorldApp
+  - run: java -cp java HelloWorldApp
 ```
 
 **General recommendation** — configure CI with the same distribution that is used on your local dev machine.
@@ -19,10 +19,10 @@ steps:
 Since the `distribution` input is required in V2, you should specify it using `jdkfile` to continue installing Java from a local file on the runner
 ```yaml
 steps:
-- run: |
+  - run: |
       download_url="https://github.com/AdoptOpenJDK/openjdk11-binaries/releases/download/jdk-11.0.10%2B9/OpenJDK11U-jdk_x64_linux_hotspot_11.0.10_9.tar.gz"
       wget -O $RUNNER_TEMP/java_package.tar.gz $download_url
-- uses: actions/setup-java@v2
+  - uses: actions/setup-java@v2
     with:
       distribution: 'jdkfile'
       jdkFile: ${{ runner.temp }}/java_package.tar.gz

eslint.config.mjs

@@ -0,0 +1,74 @@
+// This is a reusable configuration file copied from https://github.com/actions/reusable-workflows/tree/main/reusable-configurations. Please don't make changes to this file as it's the subject of an automatic update.
+import js from '@eslint/js';
+import tsParser from '@typescript-eslint/parser';
+import tsPlugin from '@typescript-eslint/eslint-plugin';
+import jest from 'eslint-plugin-jest';
+import n from 'eslint-plugin-n';
+import prettier from 'eslint-config-prettier';
+import globals from 'globals';
+
+export default [
+  {
+    ignores: ['**/*', '!src/**', '!__tests__/**']
+  },
+  js.configs.recommended,
+  {
+    files: ['**/*.ts'],
+    languageOptions: {
+      parser: tsParser,
+      ecmaVersion: 2022,
+      sourceType: 'module',
+      globals: {
+        ...globals.node,
+        ...globals.es2015
+      }
+    },
+    plugins: {
+      '@typescript-eslint': tsPlugin,
+      n
+    },
+    rules: {
+      ...tsPlugin.configs.recommended.rules,
+      '@typescript-eslint/no-require-imports': 'error',
+      '@typescript-eslint/no-non-null-assertion': 'off',
+      '@typescript-eslint/no-explicit-any': 'off',
+      '@typescript-eslint/no-empty-function': 'off',
+      '@typescript-eslint/ban-ts-comment': [
+        'error',
+        {
+          'ts-ignore': 'allow-with-description'
+        }
+      ],
+      'no-console': 'error',
+      yoda: 'error',
+      'prefer-const': [
+        'error',
+        {
+          destructuring: 'all'
+        }
+      ],
+      'no-control-regex': 'off',
+      'no-constant-condition': ['error', {checkLoops: false}],
+      'no-undef': 'off',
+      'no-useless-assignment': 'off',
+      'n/no-extraneous-import': 'error'
+    }
+  },
+  {
+    files: ['**/*{test,spec}.ts'],
+    plugins: {jest},
+    languageOptions: {
+      globals: {
+        ...globals.jest
+      }
+    },
+    rules: {
+      ...jest.configs['flat/recommended'].rules,
+      '@typescript-eslint/no-unused-vars': 'off',
+      'jest/no-standalone-expect': 'off',
+      'jest/no-conditional-expect': 'off',
+      'no-console': 'off'
+    }
+  },
+  prettier
+];

jest.config.js

@@ -1,11 +0,0 @@
-module.exports = {
-  clearMocks: true,
-  moduleFileExtensions: ['js', 'ts'],
-  testEnvironment: 'node',
-  testMatch: ['**/*.test.ts'],
-  testRunner: 'jest-circus/runner',
-  transform: {
-    '^.+\\.ts$': 'ts-jest'
-  },
-  verbose: true
-}

jest.config.ts

@@ -0,0 +1,24 @@
+export default {
+  clearMocks: true,
+  moduleFileExtensions: ['js', 'ts'],
+  roots: ['<rootDir>'],
+  testEnvironment: 'node',
+  testMatch: ['**/*.test.ts'],
+  transform: {
+    '^.+\\.ts$': [
+      'ts-jest',
+      {
+        useESM: true,
+        diagnostics: {
+          ignoreCodes: [151002]
+        }
+      }
+    ]
+  },
+  extensionsToTreatAsEsm: ['.ts'],
+  transformIgnorePatterns: ['node_modules/(?!(@actions)/)'],
+  moduleNameMapper: {
+    '^(\\.{1,2}/.*)\\.js$': '$1'
+  },
+  verbose: true
+}

package.json

@@ -1,6 +1,7 @@
 {
   "name": "setup-java",
-  "version": "5.6.0",
+  "version": "6.0.0",
+  "type": "module",
   "private": true,
   "description": "setup java action",
   "main": "dist/setup/index.js",
@@ -9,24 +10,24 @@
   },
   "scripts": {
     "build": "ncc build -o dist/setup src/setup-java.ts && ncc build -o dist/cleanup src/cleanup-java.ts",
-    "format": "prettier --no-error-on-unmatched-pattern --config ./.prettierrc.js --write \"**/*.{ts,yml,yaml}\"",
+    "format": "prettier --no-error-on-unmatched-pattern --write \"**/*.{ts,yml,yaml}\"",
-    "format-check": "prettier --no-error-on-unmatched-pattern --config ./.prettierrc.js --check \"**/*.{ts,yml,yaml}\"",
+    "format-check": "prettier --no-error-on-unmatched-pattern --check \"**/*.{ts,yml,yaml}\"",
-    "lint": "eslint --config ./.eslintrc.js \"**/*.ts\"",
+    "lint": "eslint \"**/*.ts\"",
-    "lint:fix": "eslint --config ./.eslintrc.js \"**/*.ts\" --fix",
+    "lint:fix": "eslint \"**/*.ts\" --fix",
     "check": "npm run format-check && npm run lint && npm run build && npm test",
     "fix": "npm run format && npm run lint:fix && npm run build",
     "prepare": "husky install",
     "prerelease": "npm run-script build",
     "release": "git add -f dist/setup/index.js dist/cleanup/index.js",
-    "test": "jest"
+    "test": "node --experimental-vm-modules ./node_modules/jest/bin/jest.js --runInBand --coverage"
   },
   "lint-staged": {
     "*.ts": [
-      "prettier --no-error-on-unmatched-pattern --config ./.prettierrc.js --write",
+      "prettier --no-error-on-unmatched-pattern --write",
-      "eslint --config ./.eslintrc.js --fix"
+      "eslint --fix"
     ],
     "*.{yml,yaml}": [
-      "prettier --no-error-on-unmatched-pattern --config ./.prettierrc.js --write"
+      "prettier --no-error-on-unmatched-pattern --write"
     ]
   },
   "repository": {
@@ -41,34 +42,35 @@
   "author": "GitHub",
   "license": "MIT",
   "dependencies": {
-    "@actions/cache": "^5.1.0",
+    "@actions/cache": "^6.2.0",
-    "@actions/core": "^2.0.3",
+    "@actions/core": "^3.0.1",
-    "@actions/exec": "^2.0.0",
+    "@actions/exec": "^3.0.0",
-    "@actions/glob": "^0.5.1",
+    "@actions/glob": "^0.7.0",
-    "@actions/http-client": "^3.0.2",
+    "@actions/http-client": "^4.0.1",
-    "@actions/io": "^2.0.0",
+    "@actions/io": "^3.0.2",
-    "@actions/tool-cache": "^3.0.1",
+    "@actions/tool-cache": "^4.0.0",
-    "semver": "^7.6.0",
+    "semver": "^7.8.5",
     "xmlbuilder2": "^4.0.3"
   },
   "devDependencies": {
-    "@types/jest": "^30.0.0",
+    "@eslint/js": "^10.0.1",
-    "@types/node": "^26.0.0",
+    "@jest/globals": "^30.4.1",
-    "@types/semver": "^7.5.8",
+    "@types/node": "^26.1.1",
-    "@typescript-eslint/eslint-plugin": "^8.48.0",
+    "@types/semver": "^7.7.0",
+    "@typescript-eslint/eslint-plugin": "^8.62.0",
     "@typescript-eslint/parser": "^8.62.0",
     "@vercel/ncc": "^0.44.0",
-    "eslint": "^8.57.0",
+    "eslint": "^10.7.0",
     "eslint-config-prettier": "^10.1.8",
     "eslint-plugin-jest": "^29.15.4",
-    "eslint-plugin-node": "^11.1.0",
+    "eslint-plugin-n": "^18.2.2",
+    "globals": "^17.7.0",
     "husky": "^9.1.7",
     "jest": "^30.4.2",
-    "jest-circus": "^30.4.2",
     "lint-staged": "^17.0.8",
-    "prettier": "^3.9.1",
+    "prettier": "^3.9.5",
     "ts-jest": "^29.4.11",
-    "typescript": "^5.3.3"
+    "typescript": "^6.0.3"
   },
   "bugs": {
     "url": "https://github.com/actions/setup-java/issues"

src/auth.ts

@@ -6,9 +6,9 @@ import * as fs from 'fs';
 import * as os from 'os';
 
 import {create as xmlCreate} from 'xmlbuilder2';
-import * as constants from './constants';
+import * as constants from './constants.js';
-import * as gpg from './gpg';
+import * as gpg from './gpg.js';
-import {getBooleanInput} from './util';
+import {getBooleanInput} from './util.js';
 
 export async function configureAuthentication() {
   const id = core.getInput(constants.INPUT_SERVER_ID);
@@ -93,12 +93,27 @@ export function generate(
     }
   };
 
-  if (gpgPassphrase) {
+  // The maven-gpg-plugin reads the passphrase from the environment variable
-    const gpgServer = {
+  // named by the `gpg.passphraseEnvName` property (default MAVEN_GPG_PASSPHRASE).
-      id: 'gpg.passphrase',
+  // Only configure it when the requested env var name differs from that default;
-      passphrase: `\${env.${gpgPassphrase}}`
+  // otherwise the plugin already reads the right variable and no extra settings
+  // are needed. Writing `gpg.passphrase` to settings.xml is deprecated and fails
+  // when the plugin's `bestPractices` mode is enabled.
+  if (
+    gpgPassphrase &&
+    gpgPassphrase !== constants.MAVEN_GPG_PASSPHRASE_DEFAULT_ENV
+  ) {
+    xmlObj.settings.profiles = {
+      profile: {
+        id: constants.GPG_PASSPHRASE_PROFILE_ID,
+        properties: {
+          'gpg.passphraseEnvName': gpgPassphrase
+        }
+      }
+    };
+    xmlObj.settings.activeProfiles = {
+      activeProfile: constants.GPG_PASSPHRASE_PROFILE_ID
     };
-    xmlObj.settings.servers.server.push(gpgServer);
   }
 
   return xmlCreate(xmlObj).end({

src/cleanup-java.ts

@@ -1,8 +1,9 @@
 import * as core from '@actions/core';
-import * as gpg from './gpg';
+import * as gpg from './gpg.js';
-import * as constants from './constants';
+import * as constants from './constants.js';
-import {isJobStatusSuccess} from './util';
+import {isJobStatusSuccess} from './util.js';
-import {save} from './cache';
+import {save} from './cache.js';
+import {fileURLToPath} from 'url';
 
 async function removePrivateKeyFromKeychain() {
   if (core.getInput(constants.INPUT_GPG_PRIVATE_KEY, {required: false})) {
@@ -52,7 +53,7 @@ export async function run() {
   await ignoreError(saveCache());
 }
 
-if (require.main === module) {
+if (process.argv[1] === fileURLToPath(import.meta.url)) {
   run();
 } else {
   // https://nodejs.org/api/modules.html#modules_accessing_the_main_module

src/constants.ts

@@ -8,6 +8,7 @@ export const INPUT_JDK_FILE = 'jdk-file';
 export const INPUT_JDK_FILE_DEPRECATED = 'jdkFile';
 export const INPUT_CHECK_LATEST = 'check-latest';
 export const INPUT_SET_DEFAULT = 'set-default';
+export const INPUT_PROBLEM_MATCHER = 'problem-matcher';
 export const INPUT_VERIFY_SIGNATURE = 'verify-signature';
 export const INPUT_VERIFY_SIGNATURE_PUBLIC_KEY = 'verify-signature-public-key';
 export const INPUT_SERVER_ID = 'server-id';
@@ -21,6 +22,14 @@ export const INPUT_GPG_PASSPHRASE = 'gpg-passphrase';
 export const INPUT_DEFAULT_GPG_PRIVATE_KEY = undefined;
 export const INPUT_DEFAULT_GPG_PASSPHRASE = 'GPG_PASSPHRASE';
 
+// The default name of the environment variable the maven-gpg-plugin reads the
+// passphrase from (property `gpg.passphraseEnvName`). When the configured
+// passphrase env var name matches this, no extra configuration is required.
+export const MAVEN_GPG_PASSPHRASE_DEFAULT_ENV = 'MAVEN_GPG_PASSPHRASE';
+
+// Id of the settings.xml profile used to set `gpg.passphraseEnvName`.
+export const GPG_PASSPHRASE_PROFILE_ID = 'setup-java-gpg';
+
 export const INPUT_CACHE = 'cache';
 export const INPUT_CACHE_DEPENDENCY_PATH = 'cache-dependency-path';
 export const INPUT_JOB_STATUS = 'job-status';

src/distributions/adopt/installer.ts

@@ -5,13 +5,13 @@ import fs from 'fs';
 import path from 'path';
 import semver from 'semver';
 
-import {JavaBase} from '../base-installer';
+import {JavaBase} from '../base-installer.js';
-import {IAdoptAvailableVersions} from './models';
+import {IAdoptAvailableVersions} from './models.js';
 import {
   JavaDownloadRelease,
   JavaInstallerOptions,
   JavaInstallerResults
-} from '../base-models';
+} from '../base-models.js';
 import {
   extractJdkFile,
   getNextPageUrlFromLinkHeader,
@@ -20,8 +20,11 @@ import {
   renameWinArchive,
   MAX_PAGINATION_PAGES,
   validatePaginationUrl
-} from '../../util';
+} from '../../util.js';
-import {TemurinDistribution, TemurinImplementation} from '../temurin/installer';
+import {
+  TemurinDistribution,
+  TemurinImplementation
+} from '../temurin/installer.js';
 
 export enum AdoptImplementation {
   Hotspot = 'Hotspot',

src/distributions/base-installer.ts

@@ -4,13 +4,17 @@ import * as fs from 'fs';
 import semver from 'semver';
 import path from 'path';
 import * as httpm from '@actions/http-client';
-import {getToolcachePath, isVersionSatisfies} from '../util';
+import {
+  convertVersionToSemver,
+  getToolcachePath,
+  isVersionSatisfies
+} from '../util.js';
 import {
   JavaDownloadRelease,
   JavaInstallerOptions,
   JavaInstallerResults
-} from './base-models';
+} from './base-models.js';
-import {MACOS_JAVA_CONTENT_POSTFIX} from '../constants';
+import {MACOS_JAVA_CONTENT_POSTFIX} from '../constants.js';
 import os from 'os';
 
 export abstract class JavaBase {
@@ -19,6 +23,7 @@ export abstract class JavaBase {
   protected architecture: string;
   protected packageType: string;
   protected stable: boolean;
+  protected latest: boolean;
   protected checkLatest: boolean;
   protected setDefault: boolean;
   protected verifySignature: boolean;
@@ -33,9 +38,11 @@ export abstract class JavaBase {
       maxRetries: 3
     });
 
-    ({version: this.version, stable: this.stable} = this.normalizeVersion(
+    ({
-      installerOptions.version
+      version: this.version,
-    ));
+      stable: this.stable,
+      latest: this.latest
+    } = this.normalizeVersion(installerOptions.version));
     this.architecture = installerOptions.architecture || os.arch();
     this.packageType = installerOptions.packageType;
     this.checkLatest = installerOptions.checkLatest;
@@ -62,7 +69,7 @@ export abstract class JavaBase {
     }
 
     let foundJava = this.findInToolcache();
-    if (foundJava && !this.checkLatest) {
+    if (foundJava && !this.checkLatest && !this.latest) {
       core.info(`Resolved Java ${foundJava.version} from tool-cache`);
     } else {
       core.info('Trying to resolve the latest version from remote');
@@ -263,6 +270,30 @@ export abstract class JavaBase {
 
   protected normalizeVersion(version: string) {
     let stable = true;
+    const latest = false;
+
+    // Support the `latest` alias (case-insensitive), which floats to the newest
+    // available stable/GA release. It is translated to the SemVer wildcard `x`
+    // so the existing "newest satisfying version wins" resolution applies.
+    const normalized = version.trim().toLowerCase();
+    if (normalized === 'latest') {
+      return {
+        version: 'x',
+        stable: true,
+        latest: true
+      };
+    }
+
+    // Reject `latest` combined with any qualifier (e.g. `latest-ea`). Such inputs
+    // would otherwise have their `-ea` suffix stripped and fall through to the
+    // generic SemVer check, which fails with a confusing "'latest' is not valid
+    // SemVer" message even though `latest` is a supported value. Fail early with a
+    // targeted explanation instead.
+    if (normalized.startsWith('latest')) {
+      throw new Error(
+        `The 'latest' alias resolves stable (GA) releases only and cannot be combined with '-ea' or other qualifiers (received '${version}'). Use 'latest' on its own, or specify a concrete version.`
+      );
+    }
 
     if (version.endsWith('-ea')) {
       version = version.replace(/-ea$/, '');
@@ -273,6 +304,15 @@ export abstract class JavaBase {
       stable = false;
     }
 
+    // Java uses a versioning scheme (JEP 322) that can contain more numeric
+    // fields than SemVer allows, e.g. '18.0.1.1' or '11.0.9.1'. Convert such
+    // exact versions to SemVer build notation ('18.0.1+1') so they are
+    // accepted. Ranges and versions that already carry build metadata are
+    // left untouched.
+    if (/^\d+(\.\d+){3,}$/.test(version)) {
+      version = convertVersionToSemver(version);
+    }
+
     if (!semver.validRange(version)) {
       throw new Error(
         `The string '${version}' is not valid SemVer notation for a Java version. Please check README file for code snippets and more detailed information`
@@ -281,7 +321,8 @@ export abstract class JavaBase {
 
     return {
       version,
-      stable
+      stable,
+      latest
     };
   }
 

src/distributions/corretto/installer.ts

@@ -7,17 +7,17 @@ import {
   getDownloadArchiveExtension,
   convertVersionToSemver,
   renameWinArchive
-} from '../../util';
+} from '../../util.js';
-import {JavaBase} from '../base-installer';
+import {JavaBase} from '../base-installer.js';
 import {
   JavaDownloadRelease,
   JavaInstallerOptions,
   JavaInstallerResults
-} from '../base-models';
+} from '../base-models.js';
 import {
   ICorrettoAllAvailableVersions,
   ICorrettoAvailableVersions
-} from './models';
+} from './models.js';
 
 export class CorrettoDistribution extends JavaBase {
   constructor(installerOptions: JavaInstallerOptions) {
@@ -59,10 +59,28 @@ export class CorrettoDistribution extends JavaBase {
     if (!this.stable) {
       throw new Error('Early access versions are not supported');
     }
+    const availableVersions = await this.getAvailableVersions();
+
+    // The `latest` alias is normalized to the SemVer wildcard, but Corretto
+    // matches on an exact major version, so resolve it to the newest available
+    // major from Corretto's own list.
+    if (this.latest) {
+      const majors = availableVersions
+        .map(item => parseInt(item.version, 10))
+        .filter(major => Number.isFinite(major) && major > 0);
+
+      if (majors.length === 0) {
+        throw new Error(
+          'Could not determine the latest available Corretto major version from remote metadata'
+        );
+      }
+
+      version = Math.max(...majors).toString();
+    }
+
     if (version.includes('.')) {
       throw new Error('Only major versions are supported');
     }
-    const availableVersions = await this.getAvailableVersions();
     const matchingVersions = availableVersions
       .filter(item => item.version == version)
       .map(item => {

src/distributions/distribution-factory.ts

@@ -1,22 +1,26 @@
-import {JavaBase} from './base-installer';
+import {JavaBase} from './base-installer.js';
-import {JavaInstallerOptions} from './base-models';
+import {JavaInstallerOptions} from './base-models.js';
-import {LocalDistribution} from './local/installer';
+import {LocalDistribution} from './local/installer.js';
-import {ZuluDistribution} from './zulu/installer';
+import {ZuluDistribution} from './zulu/installer.js';
-import {AdoptDistribution, AdoptImplementation} from './adopt/installer';
+import {AdoptDistribution, AdoptImplementation} from './adopt/installer.js';
-import {TemurinDistribution, TemurinImplementation} from './temurin/installer';
+import {
-import {LibericaDistributions} from './liberica/installer';
+  TemurinDistribution,
-import {MicrosoftDistributions} from './microsoft/installer';
+  TemurinImplementation
-import {SemeruDistribution} from './semeru/installer';
+} from './temurin/installer.js';
-import {CorrettoDistribution} from './corretto/installer';
+import {LibericaDistributions} from './liberica/installer.js';
-import {OracleDistribution} from './oracle/installer';
+import {LibericaNikDistributions} from './liberica-nik/installer.js';
-import {DragonwellDistribution} from './dragonwell/installer';
+import {MicrosoftDistributions} from './microsoft/installer.js';
-import {SapMachineDistribution} from './sapmachine/installer';
+import {SemeruDistribution} from './semeru/installer.js';
+import {CorrettoDistribution} from './corretto/installer.js';
+import {OracleDistribution} from './oracle/installer.js';
+import {DragonwellDistribution} from './dragonwell/installer.js';
+import {SapMachineDistribution} from './sapmachine/installer.js';
 import {
   GraalVMCommunityDistribution,
   GraalVMDistribution
-} from './graalvm/installer';
+} from './graalvm/installer.js';
-import {JetBrainsDistribution} from './jetbrains/installer';
+import {JetBrainsDistribution} from './jetbrains/installer.js';
-import {KonaDistribution} from './kona/installer';
+import {KonaDistribution} from './kona/installer.js';
 
 enum JavaDistribution {
   Adopt = 'adopt',
@@ -25,6 +29,7 @@ enum JavaDistribution {
   Temurin = 'temurin',
   Zulu = 'zulu',
   Liberica = 'liberica',
+  LibericaNik = 'liberica-nik',
   JdkFile = 'jdkfile',
   Microsoft = 'microsoft',
   Semeru = 'semeru',
@@ -66,6 +71,8 @@ export function getJavaDistribution(
       return new ZuluDistribution(installerOptions);
     case JavaDistribution.Liberica:
       return new LibericaDistributions(installerOptions);
+    case JavaDistribution.LibericaNik:
+      return new LibericaNikDistributions(installerOptions);
     case JavaDistribution.Microsoft:
       return new MicrosoftDistributions(installerOptions);
     case JavaDistribution.Semeru:

src/distributions/dragonwell/installer.ts

@@ -5,7 +5,7 @@ import semver from 'semver';
 import fs from 'fs';
 import path from 'path';
 
-import {JavaBase} from '../base-installer';
+import {JavaBase} from '../base-installer.js';
 import {
   convertVersionToSemver,
   extractJdkFile,
@@ -13,13 +13,13 @@ import {
   getGitHubHttpHeaders,
   isVersionSatisfies,
   renameWinArchive
-} from '../../util';
+} from '../../util.js';
-import {IDragonwellVersions, IDragonwellAllVersions} from './models';
+import {IDragonwellVersions, IDragonwellAllVersions} from './models.js';
 import {
   JavaDownloadRelease,
   JavaInstallerOptions,
   JavaInstallerResults
-} from '../base-models';
+} from '../base-models.js';
 
 export class DragonwellDistribution extends JavaBase {
   constructor(installerOptions: JavaInstallerOptions) {

src/distributions/graalvm/installer.ts

@@ -3,25 +3,26 @@ import * as tc from '@actions/tool-cache';
 import fs from 'fs';
 import path from 'path';
 import semver from 'semver';
-import {JavaBase} from '../base-installer';
+import {JavaBase} from '../base-installer.js';
 import {HttpCodes} from '@actions/http-client';
-import {GraalVMEAVersion} from './models';
+import {GraalVMEAVersion} from './models.js';
 import {
   JavaDownloadRelease,
   JavaInstallerOptions,
   JavaInstallerResults
-} from '../base-models';
+} from '../base-models.js';
 import {
   convertVersionToSemver,
   extractJdkFile,
   getDownloadArchiveExtension,
   getGitHubHttpHeaders,
+  getLatestMajorVersion,
   getNextPageUrlFromLinkHeader,
   isVersionSatisfies,
   MAX_PAGINATION_PAGES,
   renameWinArchive,
   validatePaginationUrl
-} from '../../util';
+} from '../../util.js';
 
 const GRAALVM_DL_BASE = 'https://download.oracle.com/graalvm';
 const GRAALVM_DOWNLOAD_URL = 'https://www.graalvm.org/downloads/';
@@ -119,6 +120,13 @@ export class GraalVMDistribution extends JavaBase {
       return this.findEABuildDownloadUrl(`${range}-ea`);
     }
 
+    // The `latest` alias is normalized to the SemVer wildcard. Oracle GraalVM
+    // builds its download URLs from a concrete major and has no endpoint to list
+    // releases, so resolve the newest available GA major from the Adoptium API.
+    if (this.latest) {
+      range = (await getLatestMajorVersion(this.http)).toString();
+    }
+
     const {platform, extension, major} = this.validateStableBuildRequest(range);
 
     const fileUrl = this.constructFileUrl(
@@ -203,6 +211,9 @@ export class GraalVMDistribution extends JavaBase {
     if (statusCode === HttpCodes.NotFound) {
       // Create the standard error with additional hint about checking the download URL
       const error = this.createVersionNotFoundError(range);
+      if (this.latest) {
+        error.message += `\nThe latest Java major version (${range}) is not yet available for the ${this.distribution} distribution. Please specify a concrete version instead of 'latest'.`;
+      }
       error.message += `\nPlease check if this version is available at ${GRAALVM_DOWNLOAD_URL} . Pick a version from the list.`;
       throw error;
     }
@@ -300,17 +311,20 @@ export class GraalVMDistribution extends JavaBase {
         // Check if it's a 404 error (file not found)
         if (error.message?.includes('404')) {
           throw new Error(
-            `GraalVM EA version '${javaEaVersion}' not found. Please verify the version exists in the EA builds repository.`
+            `GraalVM EA version '${javaEaVersion}' not found. Please verify the version exists in the EA builds repository.`,
+            {cause: error}
           );
         }
         // Re-throw with more context
         throw new Error(
-          `Failed to fetch GraalVM EA version information for '${javaEaVersion}': ${error.message}`
+          `Failed to fetch GraalVM EA version information for '${javaEaVersion}': ${error.message}`,
+          {cause: error}
         );
       }
       // If it's not an Error instance, throw a generic error
       throw new Error(
-        `Failed to fetch GraalVM EA version information for '${javaEaVersion}'`
+        `Failed to fetch GraalVM EA version information for '${javaEaVersion}'`,
+        {cause: error}
       );
     }
   }
@@ -351,7 +365,27 @@ export class GraalVMCommunityDistribution extends GraalVMDistribution {
     }
 
     const arch = this.getSupportedArchitecture();
-    const {platform, extension} = this.validateStableBuildRequest(range);
+
+    // GraalVM Community publishes its releases on GitHub, so the `latest` alias
+    // (normalized to the SemVer wildcard `x`) can float to the newest GA it
+    // actually ships. Unlike Oracle GraalVM (which has no listing endpoint and
+    // must derive the newest major from the Adoptium API), we match against the
+    // real release list here, so `latest` never fails when GraalVM lags behind a
+    // brand-new Java major.
+    let platform: OsVersions;
+    let extension: string;
+    if (this.latest) {
+      if (this.packageType !== 'jdk') {
+        throw new Error(
+          `${this.distribution} provides only the \`jdk\` package type`
+        );
+      }
+      platform = this.getPlatform();
+      extension = getDownloadArchiveExtension();
+    } else {
+      ({platform, extension} = this.validateStableBuildRequest(range));
+    }
+
     // GraalVM Community asset names embed the platform, architecture and
     // archive type, e.g. `graalvm-community-jdk-21.0.2_linux-x64_bin.tar.gz`.
     const assetSuffix = `_${platform}-${arch}_bin.${extension}`;

src/distributions/jetbrains/installer.ts

@@ -5,14 +5,14 @@ import fs from 'fs';
 import path from 'path';
 import semver from 'semver';
 
-import {JavaBase} from '../base-installer';
+import {JavaBase} from '../base-installer.js';
-import {IJetBrainsRawVersion, IJetBrainsVersion} from './models';
+import {IJetBrainsRawVersion, IJetBrainsVersion} from './models.js';
 import {
   JavaDownloadRelease,
   JavaInstallerOptions,
   JavaInstallerResults
-} from '../base-models';
+} from '../base-models.js';
-import {extractJdkFile, isVersionSatisfies} from '../../util';
+import {extractJdkFile, isVersionSatisfies} from '../../util.js';
 import {OutgoingHttpHeaders} from 'http';
 import {HttpCodes} from '@actions/http-client';
 

src/distributions/kona/installer.ts

@@ -5,19 +5,19 @@ import semver from 'semver';
 import fs from 'fs';
 import path from 'path';
 
-import {JavaBase} from '../base-installer';
+import {JavaBase} from '../base-installer.js';
-import {IKonaReleaseInfo, IKonaRelease} from './models';
+import {IKonaReleaseInfo, IKonaRelease} from './models.js';
 import {
   JavaDownloadRelease,
   JavaInstallerOptions,
   JavaInstallerResults
-} from '../base-models';
+} from '../base-models.js';
 import {
   extractJdkFile,
   getDownloadArchiveExtension,
   isVersionSatisfies,
   renameWinArchive
-} from '../../util';
+} from '../../util.js';
 
 export class KonaDistribution extends JavaBase {
   constructor(installerOptions: JavaInstallerOptions) {

src/distributions/liberica-nik/installer.ts

@@ -0,0 +1,180 @@
+import {JavaBase} from '../base-installer.js';
+import {
+  JavaDownloadRelease,
+  JavaInstallerOptions,
+  JavaInstallerResults
+} from '../base-models.js';
+import semver from 'semver';
+import {
+  extractJdkFile,
+  getDownloadArchiveExtension,
+  isVersionSatisfies,
+  renameWinArchive
+} from '../../util.js';
+import * as core from '@actions/core';
+import {ArchitectureOptions, NikVersion, OsVersions} from './models.js';
+import * as tc from '@actions/tool-cache';
+import fs from 'fs';
+import path from 'path';
+
+const supportedPlatform = `'linux', 'macos', 'windows'`;
+
+const supportedArchitectures = `'x64', 'aarch64'`;
+
+export class LibericaNikDistributions extends JavaBase {
+  constructor(installerOptions: JavaInstallerOptions) {
+    super('Liberica_NIK', installerOptions);
+  }
+
+  protected async downloadTool(
+    javaRelease: JavaDownloadRelease
+  ): Promise<JavaInstallerResults> {
+    core.info(
+      `Downloading Java ${javaRelease.version} (${this.distribution}) from ${javaRelease.url} ...`
+    );
+    let javaArchivePath = await tc.downloadTool(javaRelease.url);
+
+    core.info(`Extracting Java archive...`);
+    const extension = getDownloadArchiveExtension();
+    if (process.platform === 'win32') {
+      javaArchivePath = renameWinArchive(javaArchivePath);
+    }
+    const extractedJavaPath = await extractJdkFile(javaArchivePath, extension);
+
+    const archiveName = fs.readdirSync(extractedJavaPath)[0];
+    const archivePath = path.join(extractedJavaPath, archiveName);
+
+    const javaPath = await tc.cacheDir(
+      archivePath,
+      this.toolcacheFolderName,
+      this.getToolcacheVersionName(javaRelease.version),
+      this.architecture
+    );
+
+    return {version: javaRelease.version, path: javaPath};
+  }
+
+  protected async findPackageForDownload(
+    range: string
+  ): Promise<JavaDownloadRelease> {
+    const availableVersionsRaw = await this.getAvailableVersions();
+
+    const availableVersions = availableVersionsRaw
+      .map(item => {
+        const jdkVersion = this.getJdkVersion(item);
+        return jdkVersion ? {url: item.downloadUrl, version: jdkVersion} : null;
+      })
+      .filter((item): item is {url: string; version: string} => item !== null);
+
+    const satisfiedVersion = availableVersions
+      .filter(item => isVersionSatisfies(range, item.version))
+      .sort((a, b) => -semver.compareBuild(a.version, b.version))[0];
+
+    if (!satisfiedVersion) {
+      const availableVersionStrings = availableVersions.map(
+        item => item.version
+      );
+      throw this.createVersionNotFoundError(range, availableVersionStrings);
+    }
+
+    return satisfiedVersion;
+  }
+
+  private async getAvailableVersions(): Promise<NikVersion[]> {
+    if (core.isDebug()) {
+      console.time('Retrieving available versions for Liberica NIK took'); // eslint-disable-line no-console
+    }
+    const url = this.prepareAvailableVersionsUrl();
+
+    core.debug(`Gathering available versions from '${url}'`);
+
+    const availableVersions =
+      (await this.http.getJson<NikVersion[]>(url)).result ?? [];
+
+    if (core.isDebug()) {
+      core.startGroup('Print information about available versions');
+      console.timeEnd('Retrieving available versions for Liberica NIK took'); // eslint-disable-line no-console
+      core.debug(`Available versions: [${availableVersions.length}]`);
+      core.debug(availableVersions.map(item => item.version).join(', '));
+      core.endGroup();
+    }
+
+    return availableVersions;
+  }
+
+  private prepareAvailableVersionsUrl() {
+    const urlOptions = {
+      os: this.getPlatformOption(),
+      'bundle-type': this.getBundleType(),
+      ...this.getArchitectureOptions(),
+      'build-type': this.stable ? 'all' : 'ea',
+      'installation-type': 'archive',
+      fields: 'downloadUrl,version,components,component,embedded'
+    };
+
+    const searchParams = new URLSearchParams(urlOptions).toString();
+
+    return `https://api.bell-sw.com/v1/nik/releases?${searchParams}`;
+  }
+
+  // NIK's top-level `version` is the GraalVM/NIK version; the JDK version that
+  // users select on lives in the embedded `liberica` component.
+  private getJdkVersion(release: NikVersion): string | null {
+    const liberica = release.components?.find(
+      component => component.component === 'liberica'
+    );
+    return liberica ? this.convertVersionToSemver(liberica.version) : null;
+  }
+
+  // The `full` bundle adds JavaFX/Swing GUI support; otherwise use `standard`.
+  private getBundleType(): string {
+    const [, feature] = this.packageType.split('+');
+    return feature?.includes('fx') ? 'full' : 'standard';
+  }
+
+  private getArchitectureOptions(): ArchitectureOptions {
+    const arch = this.distributionArchitecture();
+    switch (arch) {
+      case 'x64':
+        return {bitness: '64', arch: 'x86'};
+      case 'aarch64':
+        return {bitness: '64', arch: 'arm'};
+      default:
+        throw new Error(
+          `Architecture '${this.architecture}' is not supported. Supported architectures: ${supportedArchitectures}`
+        );
+    }
+  }
+
+  private getPlatformOption(
+    platform: NodeJS.Platform = process.platform
+  ): OsVersions {
+    switch (platform) {
+      case 'darwin':
+        return 'macos';
+      case 'win32':
+      case 'cygwin':
+        return 'windows';
+      case 'linux':
+        return 'linux';
+      default:
+        throw new Error(
+          `Platform '${platform}' is not supported. Supported platforms: ${supportedPlatform}`
+        );
+    }
+  }
+
+  // JDK versions come as strings like '25.0.1+16', '23+38' or '11.0.15.1+2'.
+  // Normalize them to valid SemVer while preserving build metadata so newer
+  // NIK builds of the same JDK sort ahead of older ones.
+  private convertVersionToSemver(jdkVersion: string): string {
+    const [main, build] = jdkVersion.split('+');
+    const parts = main.split('.');
+    while (parts.length < 3) {
+      parts.push('0');
+    }
+    const base = parts.slice(0, 3).join('.');
+    const buildMeta = [...parts.slice(3), ...(build ? [build] : [])];
+    return buildMeta.length ? `${base}+${buildMeta.join('.')}` : base;
+  }
+}

src/distributions/liberica-nik/models.ts

@@ -0,0 +1,26 @@
+// Models from https://api.bell-sw.com/api.html (NIK product)
+
+export type Bitness = '32' | '64';
+export type ArchType = 'arm' | 'ppc' | 'sparc' | 'x86';
+
+export type OsVersions = 'linux' | 'linux-musl' | 'macos' | 'windows';
+
+export interface ArchitectureOptions {
+  bitness: Bitness;
+  arch: ArchType;
+}
+
+export interface NikComponent {
+  component: string;
+  version: string;
+  embedded?: boolean;
+}
+
+export interface NikVersion {
+  // The main Liberica NIK VM bundle download URL.
+  downloadUrl: string;
+  // NIK/GraalVM version (e.g. '24.1.0+1'), kept for logging only.
+  version: string;
+  // The embedded `liberica` component carries the actual JDK version.
+  components: NikComponent[];
+}