Report concrete versions for floating Oracle JDK downloads (#1213)

* Fix floating Oracle JDK version resolution Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Update generated distribution bundles Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Harden floating artifact cache identity Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Regenerate setup bundle after cache hardening Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Temporarily enable hosted full validation Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Export hosted formatting results Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Apply repository formatting Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Run hosted validation after formatting Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Correct floating version regression tests Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Remove temporary validation wiring Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Cache checksum-less floating artifacts by their response fingerprint Oracle and Oracle GraalVM do not always publish a `.sha256` sibling next to a `/latest/` artifact. Those floating releases were excluded from both the resolution cache and the JDK cache, so `cache-jdk` users lost caching entirely for them. A floating URL is a constant string, so it cannot serve as a cache identity on its own — a stale entry would be reused forever. Instead, derive a validator from the headers of the HEAD request that already resolves the artifact: the ETag when present, otherwise `Last-Modified` combined with `Content-Length`. Republishing changes the validator, which changes the cache key, so a new build is downloaded rather than masked. `getJdkReleaseIdentity` now falls back to that fingerprint before the URL, and the floating cache gates ask whether the release has a stable identity (checksum or fingerprint) rather than a checksum specifically. A floating release with neither is still left uncached. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>
2026-08-07 02:31:20 +00:00 · 2026-08-05 17:57:27 +02:00
parent ab597f914a
commit f4bfb3ddea
20 changed files with 1037 additions and 66 deletions
@@ -148,7 +148,8 @@ function getResolutionIdentity(request) {
        packageType: request.packageType.toLowerCase(),
        architecture: request.architecture.toLowerCase(),
        versionSpec: request.versionSpec,
-        stable: request.stable
+        stable: request.stable,
+        source: request.source
    });
    return createHash('sha256').update(identity).digest('hex');
 }
@@ -190,6 +191,7 @@ function parseResolvedRelease(contents) {
    const version = candidate['version'];
    const url = candidate['url'];
    const signatureUrl = candidate['signatureUrl'];
+    const floating = candidate['floating'];
    if (typeof version !== 'string' || !version) {
        throw new Error('The cached resolution has no version.');
    }
@@ -197,6 +199,9 @@ function parseResolvedRelease(contents) {
    if (signatureUrl !== undefined) {
        assertHttpsUrl(signatureUrl, 'signatureUrl');
    }
+    if (floating !== undefined && typeof floating !== 'boolean') {
+        throw new Error('The cached resolution has an invalid floating flag.');
+    }
    const release = {
        version,
        url: url
@@ -204,6 +209,9 @@ function parseResolvedRelease(contents) {
    if (signatureUrl !== undefined) {
        release.signatureUrl = signatureUrl;
    }
+    if (floating !== undefined) {
+        release.floating = floating;
+    }
    const checksum = candidate['checksum'];
    if (checksum !== undefined) {
        release.checksum = parseChecksum(checksum);
@@ -30840,7 +30840,7 @@ const DISTRIBUTIONS_ONLY_MAJOR_VERSION = (/* unused pure expression or super */
 /* harmony export */   Vt: () => (/* binding */ getBooleanInput),
 /* harmony export */   lN: () => (/* binding */ isJdkCacheEnabled)
 /* harmony export */ });
-/* unused harmony exports getVersionFromToolcachePath, extractJdkFile, cacheJdkDir, getDownloadArchiveExtension, isVersionSatisfies, getToolcachePath, isGhes, getVersionFromFileContent, convertVersionToSemver, getGitHubHttpHeaders, MAX_PAGINATION_PAGES, getNextPageUrlFromLinkHeader, validatePaginationUrl, renameWinArchive, getLatestMajorVersion */
+/* unused harmony exports getVersionFromToolcachePath, extractJdkFile, cacheJdkDir, getJavaVersionFromReleaseFile, getDownloadArchiveExtension, isVersionSatisfies, getToolcachePath, isGhes, getVersionFromFileContent, convertVersionToSemver, getArtifactFingerprint, getGitHubHttpHeaders, MAX_PAGINATION_PAGES, getNextPageUrlFromLinkHeader, validatePaginationUrl, renameWinArchive, getLatestMajorVersion */
 /* harmony import */ var os__WEBPACK_IMPORTED_MODULE_0__ = __nccwpck_require__(857);
 /* harmony import */ var os__WEBPACK_IMPORTED_MODULE_0___default = /*#__PURE__*/__nccwpck_require__.n(os__WEBPACK_IMPORTED_MODULE_0__);
 /* harmony import */ var path__WEBPACK_IMPORTED_MODULE_1__ = __nccwpck_require__(6928);
@@ -31005,6 +31005,46 @@ async function cacheJdkDir(sourceDir, toolName, version, architecture) {
    }
    return await tc.cacheDir(sourceDir, toolName, version, architecture);
 }
+function getJavaVersionFromReleaseFile(javaHome) {
+    const releasePaths = [
+        path.join(javaHome, 'release'),
+        path.join(javaHome, 'Contents', 'Home', 'release')
+    ];
+    const releasePath = releasePaths.find(candidate => fs.existsSync(candidate));
+    if (!releasePath) {
+        throw new Error(`Unable to determine the installed Java version: no release file found under '${javaHome}'.`);
+    }
+    const properties = new Map();
+    for (const line of fs.readFileSync(releasePath, 'utf8').split(/\r?\n/)) {
+        const match = line.match(/^([A-Z0-9_]+)="(.*)"$/);
+        if (match) {
+            properties.set(match[1], match[2]);
+        }
+    }
+    const runtimeVersion = properties.get('JAVA_RUNTIME_VERSION');
+    const runtimeMatch = runtimeVersion?.match(/^(\d+(?:\.\d+)*(?:\+\d+(?:\.\d+)*)?)/);
+    if (runtimeMatch) {
+        return normalizeJavaReleaseVersion(runtimeMatch[1]);
+    }
+    const javaVersion = properties.get('JAVA_VERSION');
+    if (javaVersion && /^\d+(?:\.\d+)*$/.test(javaVersion)) {
+        return normalizeJavaReleaseVersion(javaVersion);
+    }
+    throw new Error(`Unable to determine the installed Java version from '${releasePath}'.`);
+}
+function normalizeJavaReleaseVersion(version) {
+    const [numericVersion, buildVersion] = version.split('+', 2);
+    const components = numericVersion.split('.');
+    while (components.length < 3) {
+        components.push('0');
+    }
+    const mainVersion = components.slice(0, 3).join('.');
+    const build = [
+        ...components.slice(3),
+        ...(buildVersion ? [buildVersion] : [])
+    ];
+    return build.length > 0 ? `${mainVersion}+${build.join('.')}` : mainVersion;
+}
 function getToolcacheDestination(toolName, version, architecture) {
    const toolcacheRoot = process.env['RUNNER_TOOL_CACHE'];
    if (!toolcacheRoot) {
@@ -31195,6 +31235,38 @@ function convertVersionToSemver(version) {
    }
    return mainVersion;
 }
+/**
+ * Builds a validator for the bytes currently served by a URL from the response
+ * headers of a HEAD request. A vendor's `/latest/` URL never changes, so this
+ * is what lets a republished artifact be told apart from the previous one when
+ * no checksum is published alongside it.
+ *
+ * Returns `undefined` when the response carries no usable validator, in which
+ * case the caller must not treat the URL as a stable identity.
+ */
+function getArtifactFingerprint(headers) {
+    const readHeader = (name) => {
+        const value = headers?.[name];
+        const resolved = Array.isArray(value) ? value[0] : value;
+        return typeof resolved === 'string' && resolved.trim()
+            ? resolved.trim()
+            : undefined;
+    };
+    // A strong or weak ETag already identifies a specific representation.
+    const etag = readHeader('etag');
+    if (etag) {
+        return `etag:${etag}`;
+    }
+    // Otherwise combine the two validators a static file server reliably sends.
+    // Neither alone is sufficient: `last-modified` has one-second granularity and
+    // `content-length` is unchanged by a same-size rebuild.
+    const lastModified = readHeader('last-modified');
+    const contentLength = readHeader('content-length');
+    if (lastModified && contentLength) {
+        return `mtime:${lastModified};length:${contentLength}`;
+    }
+    return undefined;
+}
 function getGitHubHttpHeaders() {
    const resolvedToken = core.getInput('token') || process.env.GITHUB_TOKEN;
    const auth = !resolvedToken ? undefined : `token ${resolvedToken}`;
@@ -38,9 +38,15 @@ class OracleDistribution extends _base_installer_js__WEBPACK_IMPORTED_MODULE_3__
        const extractedJavaPath = await (0,_util_js__WEBPACK_IMPORTED_MODULE_4__/* .extractJdkFile */ .PE)(javaArchivePath, extension);
        const archiveName = fs__WEBPACK_IMPORTED_MODULE_1___default().readdirSync(extractedJavaPath)[0];
        const archivePath = path__WEBPACK_IMPORTED_MODULE_2___default().join(extractedJavaPath, archiveName);
-        const version = this.getToolcacheVersionName(javaRelease.version);
+        const installedVersion = javaRelease.floating
+            ? (0,_util_js__WEBPACK_IMPORTED_MODULE_4__/* .getJavaVersionFromReleaseFile */ .C4)(archivePath)
+            : javaRelease.version;
+        const version = this.getToolcacheVersionName(installedVersion);
        const javaPath = await (0,_util_js__WEBPACK_IMPORTED_MODULE_4__/* .cacheJdkDir */ .Vj)(archivePath, this.toolcacheFolderName, version, this.architecture);
-        return { version: javaRelease.version, path: javaPath };
+        return { version: installedVersion, path: javaPath };
+    }
+    requiresRemoteResolution() {
+        return this.stable && !this.version.includes('.');
    }
    async findPackageForDownload(range) {
        const arch = this.distributionArchitecture();
@@ -83,11 +89,15 @@ class OracleDistribution extends _base_installer_js__WEBPACK_IMPORTED_MODULE_3__
        for (const url of possibleUrls) {
            const response = await this.http.head(url);
            if (response.message.statusCode === _actions_http_client__WEBPACK_IMPORTED_MODULE_5__/* .HttpCodes */ .Hv.OK) {
+                const floating = url === floatingUrl;
                return {
                    url,
                    version: range,
                    checksum: await this.fetchChecksum(`${url}.sha256`, 'sha256'),
-                    floating: url === floatingUrl
+                    floating,
+                    fingerprint: floating
+                        ? (0,_util_js__WEBPACK_IMPORTED_MODULE_4__/* .getArtifactFingerprint */ .VX)(response.message.headers)
+                        : undefined
                };
            }
            if (response.message.statusCode !== _actions_http_client__WEBPACK_IMPORTED_MODULE_5__/* .HttpCodes */ .Hv.NotFound) {
@@ -316,31 +316,33 @@ class JavaBase {
            throw new Error(`Input 'verify-signature' is not supported for distribution '${this.distribution}'.`);
        }
        let foundJava = this.forceDownload ? null : this.findInToolcache();
-        if (foundJava && !this.checkLatest && !this.latest) {
+        if (foundJava &&
+            !this.checkLatest &&
+            !this.latest &&
+            !this.requiresRemoteResolution()) {
            core/* info */.pq(`Resolved Java ${foundJava.version} from tool-cache`);
        }
        else {
            core/* info */.pq('Trying to resolve the latest version from remote');
            try {
-                const javaRelease = await this.resolveJavaRelease();
+                let javaRelease = await this.resolveJavaRelease();
                core/* info */.pq(`Resolved latest version as ${javaRelease.version}`);
+                if (javaRelease.floating) {
+                    // A tool-cache entry has no source identity. Even when its concrete
+                    // version matches, only the checksum-bound JDK cache can prove that
+                    // it contains the bytes currently served by the mutable URL.
+                    foundJava = null;
+                }
                if (!this.forceDownload && foundJava?.version === javaRelease.version) {
                    core/* info */.pq(`Resolved Java ${foundJava.version} from tool-cache`);
                }
                else {
-                    let jdkCache;
-                    if (this.cacheJdk) {
-                        const { getJdkVerificationIdentity } = await Promise.all(/* import() */[__webpack_require__.e(824), __webpack_require__.e(971), __webpack_require__.e(779)]).then(__webpack_require__.bind(__webpack_require__, 5779));
-                        jdkCache = {
-                            distribution: this.distribution,
-                            packageType: this.packageType,
-                            architecture: this.architecture,
-                            version: javaRelease.version,
-                            source: this.getJdkReleaseIdentity(javaRelease),
-                            verification: getJdkVerificationIdentity(this.verifySignature, this.verifySignaturePublicKey),
-                            path: this.getJdkCachePath(javaRelease.version)
-                        };
-                    }
+                    let jdkCache = this.cacheJdk &&
+                        (!javaRelease.floating ||
+                            (this.hasStableReleaseIdentity(javaRelease) &&
+                                semver_default().valid(javaRelease.version)))
+                        ? await this.createJdkCache(javaRelease)
+                        : undefined;
                    if (!this.forceDownload && jdkCache) {
                        const { restoreJdk } = await Promise.all(/* import() */[__webpack_require__.e(824), __webpack_require__.e(971), __webpack_require__.e(779)]).then(__webpack_require__.bind(__webpack_require__, 5779));
                        const restored = await restoreJdk(jdkCache);
@@ -358,6 +360,18 @@ class JavaBase {
                        core/* info */.pq('Trying to download...');
                        foundJava = await this.downloadTool(javaRelease);
                        core/* info */.pq(`Java ${foundJava.version} was downloaded`);
+                        if (javaRelease.floating) {
+                            if (!semver_default().valid(foundJava.version) ||
+                                !(0,util/* isVersionSatisfies */.y)(this.version, foundJava.version)) {
+                                throw new Error(`The downloaded ${this.distribution} artifact reported Java ${foundJava.version}, which does not satisfy '${this.version}'.`);
+                            }
+                            javaRelease = { ...javaRelease, version: foundJava.version };
+                            await this.registerFloatingResolution(javaRelease);
+                            jdkCache =
+                                this.cacheJdk && this.hasStableReleaseIdentity(javaRelease)
+                                    ? await this.createJdkCache(javaRelease)
+                                    : undefined;
+                        }
                        if (jdkCache) {
                            // Register after the installation exists so its identity is
                            // captured; the post-job save refuses to upload a path whose
@@ -406,8 +420,10 @@ class JavaBase {
        if (!this.cacheJdk ||
            this.checkLatest ||
            this.latest ||
-            this.forceDownload) {
-            return this.findPackageForDownload(this.version);
+            this.forceDownload ||
+            this.requiresRemoteResolution()) {
+            const release = await this.findPackageForDownload(this.version);
+            return this.restoreFloatingResolution(release);
        }
        const { restoreJdkResolution, registerJdkResolution } = await Promise.all(/* import() */[__webpack_require__.e(824), __webpack_require__.e(971), __webpack_require__.e(348)]).then(__webpack_require__.bind(__webpack_require__, 967));
        const request = {
@@ -427,7 +443,7 @@ class JavaBase {
            if (!javaRelease.floating) {
                registerJdkResolution(request, javaRelease);
            }
-            return javaRelease;
+            return this.restoreFloatingResolution(javaRelease);
        }
        catch (error) {
            if (!restored) {
@@ -440,6 +456,60 @@ class JavaBase {
            return restored.release;
        }
    }
+    requiresRemoteResolution() {
+        return false;
+    }
+    async createJdkCache(javaRelease) {
+        const { getJdkVerificationIdentity } = await Promise.all(/* import() */[__webpack_require__.e(824), __webpack_require__.e(971), __webpack_require__.e(779)]).then(__webpack_require__.bind(__webpack_require__, 5779));
+        return {
+            distribution: this.distribution,
+            packageType: this.packageType,
+            architecture: this.architecture,
+            version: javaRelease.version,
+            source: this.getJdkReleaseIdentity(javaRelease),
+            verification: getJdkVerificationIdentity(this.verifySignature, this.verifySignaturePublicKey),
+            path: this.getJdkCachePath(javaRelease.version)
+        };
+    }
+    async restoreFloatingResolution(javaRelease) {
+        if (!javaRelease.floating ||
+            !this.hasStableReleaseIdentity(javaRelease) ||
+            !this.cacheJdk ||
+            this.forceDownload) {
+            return javaRelease;
+        }
+        const { restoreJdkResolution } = await Promise.all(/* import() */[__webpack_require__.e(824), __webpack_require__.e(971), __webpack_require__.e(348)]).then(__webpack_require__.bind(__webpack_require__, 967));
+        const restored = await restoreJdkResolution(this.getFloatingResolutionRequest(javaRelease));
+        if (!restored) {
+            return javaRelease;
+        }
+        if (!semver_default().valid(restored.release.version) ||
+            !(0,util/* isVersionSatisfies */.y)(this.version, restored.release.version)) {
+            core/* debug */.Yz(`Ignoring the cached concrete version '${restored.release.version}' for ${this.distribution} ${this.version}.`);
+            return javaRelease;
+        }
+        core/* info */.pq(`Resolved ${this.distribution} ${restored.release.version} for the current floating artifact`);
+        return { ...javaRelease, version: restored.release.version };
+    }
+    async registerFloatingResolution(javaRelease) {
+        if (!this.hasStableReleaseIdentity(javaRelease) ||
+            !this.cacheJdk ||
+            this.forceDownload) {
+            return;
+        }
+        const { registerJdkResolution } = await Promise.all(/* import() */[__webpack_require__.e(824), __webpack_require__.e(971), __webpack_require__.e(348)]).then(__webpack_require__.bind(__webpack_require__, 967));
+        registerJdkResolution(this.getFloatingResolutionRequest(javaRelease), javaRelease);
+    }
+    getFloatingResolutionRequest(javaRelease) {
+        return {
+            distribution: this.distribution,
+            packageType: this.packageType,
+            architecture: this.architecture,
+            versionSpec: this.version,
+            stable: this.stable,
+            source: this.getJdkReleaseIdentity(javaRelease)
+        };
+    }
    logSetupError(error) {
        const httpStatusCode = error instanceof tool_cache/* HTTPError */.Hl
            ? error.httpStatusCode
@@ -543,6 +613,9 @@ class JavaBase {
        if (javaRelease.checksum) {
            return `${javaRelease.checksum.algorithm}:${javaRelease.checksum.value}`;
        }
+        if (javaRelease.fingerprint) {
+            return javaRelease.fingerprint;
+        }
        try {
            const url = new URL(javaRelease.url);
            return `${url.origin}${url.pathname}`;
@@ -551,6 +624,15 @@ class JavaBase {
            return javaRelease.url;
        }
    }
+    /**
+     * Whether the release identity pins the exact bytes behind `url`. A floating
+     * URL is a constant string, so it only becomes a safe cache identity once a
+     * checksum or a response validator distinguishes one published build from the
+     * next.
+     */
+    hasStableReleaseIdentity(javaRelease) {
+        return Boolean(javaRelease.checksum ?? javaRelease.fingerprint);
+    }
    findInToolcache() {
        // we can't use tc.find directly because firstly, we need to filter versions by stability flag
        // if *-ea is provided, take only ea versions from toolcache, otherwise - only stable versions
@@ -149,7 +149,8 @@ function getResolutionIdentity(request) {
        packageType: request.packageType.toLowerCase(),
        architecture: request.architecture.toLowerCase(),
        versionSpec: request.versionSpec,
-        stable: request.stable
+        stable: request.stable,
+        source: request.source
    });
    return (0,crypto__WEBPACK_IMPORTED_MODULE_0__.createHash)('sha256').update(identity).digest('hex');
 }
@@ -191,6 +192,7 @@ function parseResolvedRelease(contents) {
    const version = candidate['version'];
    const url = candidate['url'];
    const signatureUrl = candidate['signatureUrl'];
+    const floating = candidate['floating'];
    if (typeof version !== 'string' || !version) {
        throw new Error('The cached resolution has no version.');
    }
@@ -198,6 +200,9 @@ function parseResolvedRelease(contents) {
    if (signatureUrl !== undefined) {
        assertHttpsUrl(signatureUrl, 'signatureUrl');
    }
+    if (floating !== undefined && typeof floating !== 'boolean') {
+        throw new Error('The cached resolution has an invalid floating flag.');
+    }
    const release = {
        version,
        url: url
@@ -205,6 +210,9 @@ function parseResolvedRelease(contents) {
    if (signatureUrl !== undefined) {
        release.signatureUrl = signatureUrl;
    }
+    if (floating !== undefined) {
+        release.floating = floating;
+    }
    const checksum = candidate['checksum'];
    if (checksum !== undefined) {
        release.checksum = parseChecksum(checksum);
@@ -60,15 +60,23 @@ class GraalVMDistribution extends _base_installer_js__WEBPACK_IMPORTED_MODULE_4_
                throw new Error('Extraction failed: no files found in extracted directory');
            }
            const archivePath = path__WEBPACK_IMPORTED_MODULE_2___default().join(extractedJavaPath, dirContents[0]);
-            const version = this.getToolcacheVersionName(javaRelease.version);
+            const installedVersion = javaRelease.floating
+                ? (0,_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getJavaVersionFromReleaseFile */ .C4)(archivePath)
+                : javaRelease.version;
+            const version = this.getToolcacheVersionName(installedVersion);
            const javaPath = await (0,_util_js__WEBPACK_IMPORTED_MODULE_6__/* .cacheJdkDir */ .Vj)(archivePath, this.toolcacheFolderName, version, this.architecture);
-            return { version: javaRelease.version, path: javaPath };
+            return { version: installedVersion, path: javaPath };
        }
        catch (error) {
            _actions_core__WEBPACK_IMPORTED_MODULE_0__/* .error */ .z3(`Failed to download and extract GraalVM: ${error}`);
            throw error;
        }
    }
+    requiresRemoteResolution() {
+        return (this.distribution === 'GraalVM' &&
+            this.stable &&
+            !this.version.includes('.'));
+    }
    setJavaDefault(version, toolPath) {
        super.setJavaDefault(version, toolPath);
        _actions_core__WEBPACK_IMPORTED_MODULE_0__/* .exportVariable */ .dN('GRAALVM_HOME', toolPath);
@@ -89,13 +97,17 @@ class GraalVMDistribution extends _base_installer_js__WEBPACK_IMPORTED_MODULE_4_
        const fileUrl = this.constructFileUrl(range, major, platform, arch, extension);
        const response = await this.http.head(fileUrl);
        this.handleHttpResponse(response, range);
+        // A major-only range resolves to the vendor's `/latest/` path, whose
+        // contents change when a new build is published.
+        const floating = !range.includes('.');
        return {
            url: fileUrl,
            version: range,
            checksum: await this.fetchChecksum(`${fileUrl}.sha256`, 'sha256'),
-            // A major-only range resolves to the vendor's `/latest/` path, whose
-            // contents change when a new build is published.
-            floating: !range.includes('.')
+            floating,
+            fingerprint: floating
+                ? (0,_util_js__WEBPACK_IMPORTED_MODULE_6__/* .getArtifactFingerprint */ .VX)(response.message.headers)
+                : undefined
        };
    }
    validateVersionRange(range) {
@@ -31235,12 +31235,14 @@ function validateToolchainIds(versions, versionFile, toolchainIds) {
 /***/ ((__unused_webpack_module, __webpack_exports__, __nccwpck_require__) => {

 /* harmony export */ __nccwpck_require__.d(__webpack_exports__, {
+/* harmony export */   C4: () => (/* binding */ getJavaVersionFromReleaseFile),
 /* harmony export */   G4: () => (/* binding */ getTempDir),
 /* harmony export */   OS: () => (/* binding */ getVersionFromFileContent),
 /* harmony export */   PE: () => (/* binding */ extractJdkFile),
 /* harmony export */   SA: () => (/* binding */ validatePaginationUrl),
 /* harmony export */   Tp: () => (/* binding */ MAX_PAGINATION_PAGES),
 /* harmony export */   U_: () => (/* binding */ getGitHubHttpHeaders),
+/* harmony export */   VX: () => (/* binding */ getArtifactFingerprint),
 /* harmony export */   Vj: () => (/* binding */ cacheJdkDir),
 /* harmony export */   Vt: () => (/* binding */ getBooleanInput),
 /* harmony export */   ZY: () => (/* binding */ convertVersionToSemver),
@@ -31418,6 +31420,46 @@ async function cacheJdkDir(sourceDir, toolName, version, architecture) {
    }
    return await _actions_tool_cache__WEBPACK_IMPORTED_MODULE_5__/* .cacheDir */ .e8(sourceDir, toolName, version, architecture);
 }
+function getJavaVersionFromReleaseFile(javaHome) {
+    const releasePaths = [
+        path__WEBPACK_IMPORTED_MODULE_1___default().join(javaHome, 'release'),
+        path__WEBPACK_IMPORTED_MODULE_1___default().join(javaHome, 'Contents', 'Home', 'release')
+    ];
+    const releasePath = releasePaths.find(candidate => fs__WEBPACK_IMPORTED_MODULE_2__.existsSync(candidate));
+    if (!releasePath) {
+        throw new Error(`Unable to determine the installed Java version: no release file found under '${javaHome}'.`);
+    }
+    const properties = new Map();
+    for (const line of fs__WEBPACK_IMPORTED_MODULE_2__.readFileSync(releasePath, 'utf8').split(/\r?\n/)) {
+        const match = line.match(/^([A-Z0-9_]+)="(.*)"$/);
+        if (match) {
+            properties.set(match[1], match[2]);
+        }
+    }
+    const runtimeVersion = properties.get('JAVA_RUNTIME_VERSION');
+    const runtimeMatch = runtimeVersion?.match(/^(\d+(?:\.\d+)*(?:\+\d+(?:\.\d+)*)?)/);
+    if (runtimeMatch) {
+        return normalizeJavaReleaseVersion(runtimeMatch[1]);
+    }
+    const javaVersion = properties.get('JAVA_VERSION');
+    if (javaVersion && /^\d+(?:\.\d+)*$/.test(javaVersion)) {
+        return normalizeJavaReleaseVersion(javaVersion);
+    }
+    throw new Error(`Unable to determine the installed Java version from '${releasePath}'.`);
+}
+function normalizeJavaReleaseVersion(version) {
+    const [numericVersion, buildVersion] = version.split('+', 2);
+    const components = numericVersion.split('.');
+    while (components.length < 3) {
+        components.push('0');
+    }
+    const mainVersion = components.slice(0, 3).join('.');
+    const build = [
+        ...components.slice(3),
+        ...(buildVersion ? [buildVersion] : [])
+    ];
+    return build.length > 0 ? `${mainVersion}+${build.join('.')}` : mainVersion;
+}
 function getToolcacheDestination(toolName, version, architecture) {
    const toolcacheRoot = process.env['RUNNER_TOOL_CACHE'];
    if (!toolcacheRoot) {
@@ -31608,6 +31650,38 @@ function convertVersionToSemver(version) {
    }
    return mainVersion;
 }
+/**
+ * Builds a validator for the bytes currently served by a URL from the response
+ * headers of a HEAD request. A vendor's `/latest/` URL never changes, so this
+ * is what lets a republished artifact be told apart from the previous one when
+ * no checksum is published alongside it.
+ *
+ * Returns `undefined` when the response carries no usable validator, in which
+ * case the caller must not treat the URL as a stable identity.
+ */
+function getArtifactFingerprint(headers) {
+    const readHeader = (name) => {
+        const value = headers?.[name];
+        const resolved = Array.isArray(value) ? value[0] : value;
+        return typeof resolved === 'string' && resolved.trim()
+            ? resolved.trim()
+            : undefined;
+    };
+    // A strong or weak ETag already identifies a specific representation.
+    const etag = readHeader('etag');
+    if (etag) {
+        return `etag:${etag}`;
+    }
+    // Otherwise combine the two validators a static file server reliably sends.
+    // Neither alone is sufficient: `last-modified` has one-second granularity and
+    // `content-length` is unchanged by a same-size rebuild.
+    const lastModified = readHeader('last-modified');
+    const contentLength = readHeader('content-length');
+    if (lastModified && contentLength) {
+        return `mtime:${lastModified};length:${contentLength}`;
+    }
+    return undefined;
+}
 function getGitHubHttpHeaders() {
    const resolvedToken = _actions_core__WEBPACK_IMPORTED_MODULE_4__/* .getInput */ .V4('token') || process.env.GITHUB_TOKEN;
    const auth = !resolvedToken ? undefined : `token ${resolvedToken}`;