* Restore dependency and wrapper caches concurrently
Run primary dependency and wrapper cache restores in parallel while preserving existing outputs and save semantics.
Add unit and E2E coverage for concurrent restore behavior, wrapper cache validation, and additional-cache error handling.
Include a manual benchmark workflow for baseline-vs-candidate restore timing comparisons across OSes.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d43ec3dd-96c7-4eb3-909e-b8123cd12d3c
* Address PR review comments
Use env variables for cache-hit values in benchmark record steps to avoid expression expansion in run commands, and rename E2E restore step labels for clarity.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d43ec3dd-96c7-4eb3-909e-b8123cd12d3c
* Stabilize wrapper cache restore checks
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Copilot-Session: d43ec3dd-96c7-4eb3-909e-b8123cd12d3c
* Extract repeated directory-check assertions into check-dir.sh helper
The e2e-cache.yml workflow repeated the same inline shell block many times
to assert a cache directory exists (and list it), plus inverse checks that a
directory does NOT exist (the gradle2/maven2/sbt2 cache-miss jobs).
Add `__tests__/check-dir.sh` (POSIX sh, executable) with a
`check-dir.sh <dir> [present|absent]` interface and replace every inline
check with a call to it, passing already-expanded $HOME paths to avoid
tilde-expansion pitfalls. The sbt jobs override working-directory, so they
call the helper via $GITHUB_WORKSPACE. Per-OS Coursier conditionals and all
build steps are left unchanged.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Address review: argc guard in check-dir.sh, fix sbt ubuntu matrix conditionals
- check-dir.sh: with set -u, invoking without a <dir> argument failed with an
opaque "parameter not set" error. Add an explicit argc check that prints a
usage message and exits 2 (distinct from the assertion failure code 1).
- e2e-cache.yml: the sbt-save and sbt-restore jobs run on an ubuntu-22.04
matrix entry, but their coursier-cache steps were guarded by
'if: matrix.os == "ubuntu-latest"', so those checks never executed on
Ubuntu. Align the conditionals with the matrix (ubuntu-22.04), matching the
newer sbt1/sbt2 jobs.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Merge cache-dependency-path e2e workflow into e2e-cache
Fold the standalone 'Validate cache with cache-dependency-path option'
workflow into e2e-cache.yml and delete the separate file. The three
gradle1-save/gradle1-restore/gradle2-restore jobs are copied verbatim,
preserving their matrix, cache-dependency-path inputs, and needs
relationships. No change in test coverage.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 635b89fa-5c35-49e1-a257-dc9001ebb8db
* Add cache-dependency-path e2e coverage for maven and sbt
Previously only gradle exercised the cache-dependency-path input. Mirror
the gradle save/restore(hit)/restore(miss) pattern for maven and sbt:
- maven1-save/maven1-restore/maven2-restore
- sbt1-save/sbt1-restore/sbt2-restore
Each save+restore pair uses the same cache-dependency-path so the restore
is a hit, while the second restore points at a new maven2/sbt2 fixture
whose different dependencies produce a different hash, so the cache is a
miss (directory not created). New fixtures added under __tests__/cache.
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot-Session: 635b89fa-5c35-49e1-a257-dc9001ebb8db
---------
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
* Harden workflows with least-privilege permissions and zizmor
Apply GitHub Actions security best practices to the action's own
workflows and integrate zizmor to catch regressions.
- Add explicit least-privilege `permissions:` to every workflow
(contents: read for read-only workflows; default-deny `{}` with
job-scoped grants for codeql, publish-immutable-actions and
update-config-files).
- Set `persist-credentials: false` on all checkout steps that don't
need the GITHUB_TOKEN afterwards.
- Move `${{ ... }}` expansions out of `run:` blocks into `env:` vars
to avoid template injection.
- Pin the alpine container image (alpine:latest -> alpine:3.21).
- Add a zizmor CI workflow that uploads SARIF to code scanning, plus a
`.github/zizmor.yml` pinning policy (ref-pin for actions/* and
github/*, hash-pin for third-party actions).
zizmor now reports no findings (offline and online).
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
* Potential fix for pull request finding
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* Fix indentation of if: in zizmor SARIF upload step
The `if:` key on the "Upload SARIF results to code scanning" step had no
indentation, producing invalid YAML ("Nested mappings are not allowed in
compact mappings"). This broke `npm run format-check` (prettier) in Basic
validation.
Indent `if:` to 8 spaces so it nests under the step alongside uses/with.
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
---------
Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>
* eat: bump to use node20 runtime, actions/checkout to v4
* docs: update version of setup-java in documentation and e2e tests
---------
Co-authored-by: Ivan Zosimov <ivanzosimov@github.com>
* implement a core logic to cache dependnecies
* integrate the cache logic to entry points
* add a user doc about the dependency cache feature
* reflect changes to the dist dir
* add a prefix to the cache key
https://github.com/actions/setup-java/pull/193/files#r669521434
* test: extract build.gradle to a file in __tests__ dir
* run the restore e2e test on the specified OS
* add an e2e test for maven
* fix the dependency among workflows
* stabilize the cache on the Windows in e2e test
* add .gitignore files to __tests__/cache directories
* try to run restore after the authentication
* use the key in state to save caches in the post process
* suggest users to run without daemon if fail to save Gradle cache on Windows
* add missing description in the README.md
* run clean-up tasks in serial
* Add validation for post step (#3)
* work on fixing cache post step
* fix tests
* Update src/cleanup-java.ts
Co-authored-by: Konrad Pabjan <konradpabjan@github.com>
* Update src/cache.ts
Co-authored-by: Konrad Pabjan <konradpabjan@github.com>
* style: put the name of input to the constants.ts
* format: run `npm run build` to reflect changes to the dist dir
* chore: update licensed files by `licensed cache`
it still has three errors as follows:
>* setup-java.npm.sax
> filename: /Users/kengo/GitHub/setup-java/.licenses/npm/sax.dep.yml
> - license needs review: other
>
>* setup-java.npm.tslib-1.14.1
> filename: /Users/kengo/GitHub/setup-java/.licenses/npm/tslib-1.14.1.dep.yml
> - license needs review: 0bsd
>
>* setup-java.npm.tslib-2.3.0
> filename: /Users/kengo/GitHub/setup-java/.licenses/npm/tslib-2.3.0.dep.yml
> - license needs review: 0bsd
* fix: rerun ncc on macOS with node v12
* build: follow the suggestion at PR page
https://github.com/actions/setup-java/pull/193#issuecomment-901839546
* fix: throw error in case of no package manager file found
Co-authored-by: Dmitry Shibanov <dmitry-shibanov@github.com>
Co-authored-by: Konrad Pabjan <konradpabjan@github.com>
