Add conditional JDK caching (#1201)

* Add JDK caching Cache resolved JDK tool-cache entries by exact platform and release identity, with a default-on cache-jdk input and explicit opt-out. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Apply batched suggestions from code review Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> * Fix JDK cache CI validation Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Update brace-expansion security fix Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Refresh brace-expansion license metadata Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Refine JDK cache semantics Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Refine JDK cache documentation Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Simplify JDK cache identity Use one normalized runner OS dimension, reset the internal cache key schema for the unreleased feature, and align documentation, tests, and bundles. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Align JDK cache OS identity Use the established RUNNER_OS value directly and retain process.platform only as a non-Actions fallback. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Harden JDK cache saves and document tool-cache reuse Bind each JDK cache key to the installation identity it was computed for, keep post-job saves best-effort per entry, and state the real reuse and verification guarantee in the documentation. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs: restructure README caching section Rename '## Caching dependencies' to '## Caching' and add a what-gets-cached overview table covering the dependency, wrapper, and JDK caches. Lead with the common 'cache: maven' example and the dependency-cache material, and demote JDK caching into its own subsection. Also corrects the IMPORTANT callout, which implied JDK caching required an explicit opt-in; it is enabled implicitly whenever 'cache' is set. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs: fix caching documentation defects - Remove pull-request framing that compared behavior to `main`; state the tool-cache and `jdkfile` behavior directly and unconditionally. - Clarify that the JDK cache is a separate cache *entry* from the dependency and wrapper caches, while its *enablement* is coupled to `cache`, so the opening paragraph agrees with the enablement matrix. - Cite the actions/setup-java-benchmarks repository instead of an open PR and a self-referential PR comment, keeping the measured figures and caveats. - Keep the `cache`/`cache-jdk` matrix only in docs/advanced-usage.md and summarize the rules in prose in README.md to avoid divergence. - Describe the guarantee that a cache key is only saved with the installation it was computed for, instead of documenting inode/size/timestamp internals. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * docs: add V6 what's new entry for JDK caching Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: e2755464-4e83-47b6-ba71-731bb481b418 --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com> Copilot-Session: e2755464-4e83-47b6-ba71-731bb481b418
2026-08-07 02:31:20 +00:00 · 2026-08-04 21:54:10 -04:00
parent 7a9a8b1dcc
commit 955f34f16f
26 changed files with 2756 additions and 827 deletions
@@ -0,0 +1,224 @@
+export const id = 314;
+export const ids = [314];
+export const modules = {
+
+/***/ 2314:
+/***/ ((__unused_webpack_module, __webpack_exports__, __webpack_require__) => {
+
+
+// EXPORTS
+__webpack_require__.d(__webpack_exports__, {
+  saveJdkCaches: () => (/* binding */ saveJdkCaches)
+});
+
+// UNUSED EXPORTS: buildJdkCacheKey, getJdkVerificationIdentity, registerJdk, restoreJdk
+
+// EXTERNAL MODULE: external "crypto"
+var external_crypto_ = __webpack_require__(6982);
+// EXTERNAL MODULE: external "fs"
+var external_fs_ = __webpack_require__(9896);
+var external_fs_default = /*#__PURE__*/__webpack_require__.n(external_fs_);
+// EXTERNAL MODULE: external "path"
+var external_path_ = __webpack_require__(6928);
+var external_path_default = /*#__PURE__*/__webpack_require__.n(external_path_);
+// EXTERNAL MODULE: ./node_modules/@actions/cache/lib/cache.js + 291 modules
+var lib_cache = __webpack_require__(5767);
+// EXTERNAL MODULE: ./node_modules/@actions/core/lib/core.js + 7 modules
+var lib_core = __webpack_require__(3838);
+// EXTERNAL MODULE: ./src/util.ts
+var util = __webpack_require__(4527);
+;// CONCATENATED MODULE: ./src/cache-feature.ts
+
+
+
+function cache_feature_isCacheFeatureAvailable() {
+    if (cache.isFeatureAvailable()) {
+        return true;
+    }
+    if (isGhes()) {
+        core.warning('Caching is only supported on GHES version >= 3.5. If you are on a version >= 3.5, please check with your GHES admin if the Actions cache service is enabled or not.');
+        return false;
+    }
+    core.warning('The runner was not able to contact the cache service. Caching will be skipped');
+    return false;
+}
+
+;// CONCATENATED MODULE: ./src/jdk-cache.ts
+
+
+
+
+
+
+const STATE_JDK_CACHES = 'jdk-caches';
+const JDK_CACHE_KEY_VERSION = 1;
+const restoredCaches = (/* unused pure expression or super */ null && ([]));
+async function restoreJdk(jdk) {
+    if (!jdk.path || !isCacheFeatureAvailable()) {
+        return false;
+    }
+    const key = buildJdkCacheKey(jdk);
+    let matchedKey;
+    try {
+        matchedKey = await cache.restoreCache([jdk.path], key);
+    }
+    catch (error) {
+        core.warning(`Failed to restore JDK cache: ${error.message}`);
+    }
+    const architecturePath = path.join(jdk.path, jdk.architecture);
+    if (matchedKey &&
+        (!fs.existsSync(architecturePath) ||
+            !fs.existsSync(`${architecturePath}.complete`))) {
+        core.warning(`JDK cache key ${matchedKey} was restored without the expected tool-cache path; downloading the JDK instead.`);
+        matchedKey = undefined;
+    }
+    recordJdkCache({
+        key,
+        path: jdk.path,
+        architecture: jdk.architecture,
+        matchedKey
+    });
+    if (matchedKey) {
+        core.info(`JDK cache restored from key: ${matchedKey}`);
+        return true;
+    }
+    core.info(`JDK cache is not found for ${jdk.distribution} ${jdk.version}`);
+    return false;
+}
+function registerJdk(jdk) {
+    if (!jdk.path) {
+        return;
+    }
+    recordJdkCache({
+        key: buildJdkCacheKey(jdk),
+        path: jdk.path,
+        architecture: jdk.architecture,
+        installation: getInstallationIdentity(jdk.path, jdk.architecture)
+    });
+}
+/**
+ * Cheap fingerprint of the installation stored at a tool-cache path. The
+ * `<architecture>.complete` marker is (re)created by `tc.cacheDir` every time an
+ * installation is written, so its inode and timestamps change whenever the
+ * installation is replaced. This avoids rehashing a multi-hundred-megabyte JDK
+ * directory while still detecting that the bytes behind a key were swapped.
+ */
+function getInstallationIdentity(jdkPath, architecture) {
+    const architecturePath = external_path_default().join(jdkPath, architecture);
+    try {
+        const marker = external_fs_default().statSync(`${architecturePath}.complete`);
+        const installation = external_fs_default().statSync(architecturePath);
+        return [
+            marker.ino,
+            marker.mtimeMs,
+            marker.ctimeMs,
+            marker.size,
+            installation.ino,
+            installation.mtimeMs,
+            installation.ctimeMs
+        ].join(':');
+    }
+    catch {
+        return undefined;
+    }
+}
+function getJdkVerificationIdentity(verifySignature, publicKey) {
+    if (!verifySignature) {
+        return 'unverified';
+    }
+    if (!publicKey) {
+        return 'verified:bundled';
+    }
+    const normalizedKey = publicKey.replace(/\r\n?/g, '\n').trim();
+    const fingerprint = createHash('sha256').update(normalizedKey).digest('hex');
+    return `verified:custom:sha256:${fingerprint}`;
+}
+async function saveJdkCaches() {
+    const state = lib_core/* getState */.Gu(STATE_JDK_CACHES);
+    if (!state) {
+        return;
+    }
+    const caches = parseJdkCacheState(state);
+    for (const jdk of caches) {
+        if (jdk.matchedKey === jdk.key) {
+            lib_core/* info */.pq(`Cache hit occurred on the JDK primary key ${jdk.key}, not saving cache.`);
+            continue;
+        }
+        if (!external_fs_default().existsSync(jdk.path)) {
+            lib_core/* debug */.Yz(`JDK cache path does not exist, not saving: ${jdk.path}`);
+            continue;
+        }
+        if (!jdk.installation) {
+            lib_core/* debug */.Yz(`No JDK installation was registered for the key ${jdk.key}, not saving cache.`);
+            continue;
+        }
+        if (getInstallationIdentity(jdk.path, jdk.architecture) !== jdk.installation) {
+            lib_core/* warning */.$e(`The JDK installation in ${jdk.path} was replaced after it was registered for the key ${jdk.key}; not saving cache.`);
+            continue;
+        }
+        try {
+            const cacheId = await lib_cache/* saveCache */.Io([jdk.path], jdk.key);
+            if (cacheId !== -1) {
+                lib_core/* info */.pq(`JDK cache saved with the key: ${jdk.key}`);
+            }
+        }
+        catch (error) {
+            const err = error;
+            if (err.name === lib_cache/* ReserveCacheError */.Zh.name) {
+                lib_core/* info */.pq(err.message);
+            }
+            else {
+                // Saving is best-effort and per entry: one failure must not suppress
+                // the remaining JDK caches.
+                lib_core/* warning */.$e(`Failed to save the JDK cache with the key ${jdk.key}: ${err.message}`);
+            }
+        }
+    }
+}
+function buildJdkCacheKey(jdk) {
+    const runnerOs = process.env['RUNNER_OS'] ?? process.platform;
+    const normalizedArchitecture = jdk.architecture.toLowerCase();
+    const identity = JSON.stringify({
+        keyVersion: JDK_CACHE_KEY_VERSION,
+        runnerOs,
+        distribution: jdk.distribution.toLowerCase(),
+        packageType: jdk.packageType.toLowerCase(),
+        architecture: normalizedArchitecture,
+        version: jdk.version,
+        source: jdk.source,
+        verification: jdk.verification
+    });
+    const digest = createHash('sha256').update(identity).digest('hex');
+    return `setup-java-jdk-v${JDK_CACHE_KEY_VERSION}-${runnerOs}-${normalizedArchitecture}-${digest}`;
+}
+function recordJdkCache(jdk) {
+    const existing = restoredCaches.findIndex(item => item.key === jdk.key && item.path === jdk.path);
+    if (existing === -1) {
+        restoredCaches.push(jdk);
+    }
+    else {
+        restoredCaches[existing] = { ...restoredCaches[existing], ...jdk };
+    }
+    core.saveState(STATE_JDK_CACHES, JSON.stringify(restoredCaches));
+}
+function parseJdkCacheState(state) {
+    const value = JSON.parse(state);
+    if (!Array.isArray(value) ||
+        !value.every(item => typeof item === 'object' &&
+            item !== null &&
+            typeof item.key === 'string' &&
+            typeof item.path === 'string' &&
+            typeof item.architecture === 'string' &&
+            (item.matchedKey === undefined ||
+                typeof item.matchedKey === 'string') &&
+            (item.installation === undefined ||
+                typeof item.installation === 'string'))) {
+        throw new Error('Invalid JDK cache information retrieved from state.');
+    }
+    return value;
+}
+
+
+/***/ })
+
+};