Report concrete versions for floating Oracle JDK downloads (#1213)

* Fix floating Oracle JDK version resolution Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Update generated distribution bundles Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Harden floating artifact cache identity Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Regenerate setup bundle after cache hardening Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Temporarily enable hosted full validation Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Export hosted formatting results Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Apply repository formatting Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Run hosted validation after formatting Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Correct floating version regression tests Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Remove temporary validation wiring Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> * Cache checksum-less floating artifacts by their response fingerprint Oracle and Oracle GraalVM do not always publish a `.sha256` sibling next to a `/latest/` artifact. Those floating releases were excluded from both the resolution cache and the JDK cache, so `cache-jdk` users lost caching entirely for them. A floating URL is a constant string, so it cannot serve as a cache identity on its own — a stale entry would be reused forever. Instead, derive a validator from the headers of the HEAD request that already resolves the artifact: the ETag when present, otherwise `Last-Modified` combined with `Content-Length`. Republishing changes the validator, which changes the cache key, so a new build is downloaded rather than masked. `getJdkReleaseIdentity` now falls back to that fingerprint before the URL, and the floating cache gates ask whether the release has a stable identity (checksum or fingerprint) rather than a checksum specifically. A floating release with neither is still left uncached. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> --------- Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Co-authored-by: Bruno Borges <brborges@microsoft.com>
2026-08-07 02:31:20 +00:00 · 2026-08-05 17:57:27 +02:00
parent ab597f914a
commit f4bfb3ddea
20 changed files with 1037 additions and 66 deletions
@@ -173,33 +173,34 @@ export abstract class JavaBase {
    }

    let foundJava = this.forceDownload ? null : this.findInToolcache();
-    if (foundJava && !this.checkLatest && !this.latest) {
+    if (
+      foundJava &&
+      !this.checkLatest &&
+      !this.latest &&
+      !this.requiresRemoteResolution()
+    ) {
      core.info(`Resolved Java ${foundJava.version} from tool-cache`);
    } else {
      core.info('Trying to resolve the latest version from remote');
      try {
-        const javaRelease = await this.resolveJavaRelease();
+        let javaRelease = await this.resolveJavaRelease();
        core.info(`Resolved latest version as ${javaRelease.version}`);
+        if (javaRelease.floating) {
+          // A tool-cache entry has no source identity. Even when its concrete
+          // version matches, only the checksum-bound JDK cache can prove that
+          // it contains the bytes currently served by the mutable URL.
+          foundJava = null;
+        }
        if (!this.forceDownload && foundJava?.version === javaRelease.version) {
          core.info(`Resolved Java ${foundJava.version} from tool-cache`);
        } else {
-          let jdkCache: JdkCache | undefined;
-          if (this.cacheJdk) {
-            const {getJdkVerificationIdentity} =
-              await import('../jdk-cache.js');
-            jdkCache = {
-              distribution: this.distribution,
-              packageType: this.packageType,
-              architecture: this.architecture,
-              version: javaRelease.version,
-              source: this.getJdkReleaseIdentity(javaRelease),
-              verification: getJdkVerificationIdentity(
-                this.verifySignature,
-                this.verifySignaturePublicKey
-              ),
-              path: this.getJdkCachePath(javaRelease.version)
-            };
-          }
+          let jdkCache =
+            this.cacheJdk &&
+            (!javaRelease.floating ||
+              (this.hasStableReleaseIdentity(javaRelease) &&
+                semver.valid(javaRelease.version)))
+              ? await this.createJdkCache(javaRelease)
+              : undefined;
          if (!this.forceDownload && jdkCache) {
            const {restoreJdk} = await import('../jdk-cache.js');
            const restored = await restoreJdk(jdkCache);
@@ -217,6 +218,22 @@ export abstract class JavaBase {
            core.info('Trying to download...');
            foundJava = await this.downloadTool(javaRelease);
            core.info(`Java ${foundJava.version} was downloaded`);
+            if (javaRelease.floating) {
+              if (
+                !semver.valid(foundJava.version) ||
+                !isVersionSatisfies(this.version, foundJava.version)
+              ) {
+                throw new Error(
+                  `The downloaded ${this.distribution} artifact reported Java ${foundJava.version}, which does not satisfy '${this.version}'.`
+                );
+              }
+              javaRelease = {...javaRelease, version: foundJava.version};
+              await this.registerFloatingResolution(javaRelease);
+              jdkCache =
+                this.cacheJdk && this.hasStableReleaseIdentity(javaRelease)
+                  ? await this.createJdkCache(javaRelease)
+                  : undefined;
+            }
            if (jdkCache) {
              // Register after the installation exists so its identity is
              // captured; the post-job save refuses to upload a path whose
@@ -272,9 +289,11 @@ export abstract class JavaBase {
      !this.cacheJdk ||
      this.checkLatest ||
      this.latest ||
-      this.forceDownload
+      this.forceDownload ||
+      this.requiresRemoteResolution()
    ) {
-      return this.findPackageForDownload(this.version);
+      const release = await this.findPackageForDownload(this.version);
+      return this.restoreFloatingResolution(release);
    }

    const {restoreJdkResolution, registerJdkResolution} =
@@ -300,7 +319,7 @@ export abstract class JavaBase {
      if (!javaRelease.floating) {
        registerJdkResolution(request, javaRelease);
      }
-      return javaRelease;
+      return this.restoreFloatingResolution(javaRelease);
    } catch (error) {
      if (!restored) {
        throw error;
@@ -317,6 +336,92 @@ export abstract class JavaBase {
    }
  }

+  protected requiresRemoteResolution(): boolean {
+    return false;
+  }
+
+  private async createJdkCache(
+    javaRelease: JavaDownloadRelease
+  ): Promise<JdkCache> {
+    const {getJdkVerificationIdentity} = await import('../jdk-cache.js');
+    return {
+      distribution: this.distribution,
+      packageType: this.packageType,
+      architecture: this.architecture,
+      version: javaRelease.version,
+      source: this.getJdkReleaseIdentity(javaRelease),
+      verification: getJdkVerificationIdentity(
+        this.verifySignature,
+        this.verifySignaturePublicKey
+      ),
+      path: this.getJdkCachePath(javaRelease.version)
+    };
+  }
+
+  private async restoreFloatingResolution(
+    javaRelease: JavaDownloadRelease
+  ): Promise<JavaDownloadRelease> {
+    if (
+      !javaRelease.floating ||
+      !this.hasStableReleaseIdentity(javaRelease) ||
+      !this.cacheJdk ||
+      this.forceDownload
+    ) {
+      return javaRelease;
+    }
+
+    const {restoreJdkResolution} = await import('../jdk-resolution-cache.js');
+    const restored = await restoreJdkResolution(
+      this.getFloatingResolutionRequest(javaRelease)
+    );
+    if (!restored) {
+      return javaRelease;
+    }
+    if (
+      !semver.valid(restored.release.version) ||
+      !isVersionSatisfies(this.version, restored.release.version)
+    ) {
+      core.debug(
+        `Ignoring the cached concrete version '${restored.release.version}' for ${this.distribution} ${this.version}.`
+      );
+      return javaRelease;
+    }
+
+    core.info(
+      `Resolved ${this.distribution} ${restored.release.version} for the current floating artifact`
+    );
+    return {...javaRelease, version: restored.release.version};
+  }
+
+  private async registerFloatingResolution(
+    javaRelease: JavaDownloadRelease
+  ): Promise<void> {
+    if (
+      !this.hasStableReleaseIdentity(javaRelease) ||
+      !this.cacheJdk ||
+      this.forceDownload
+    ) {
+      return;
+    }
+
+    const {registerJdkResolution} = await import('../jdk-resolution-cache.js');
+    registerJdkResolution(
+      this.getFloatingResolutionRequest(javaRelease),
+      javaRelease
+    );
+  }
+
+  private getFloatingResolutionRequest(javaRelease: JavaDownloadRelease) {
+    return {
+      distribution: this.distribution,
+      packageType: this.packageType,
+      architecture: this.architecture,
+      versionSpec: this.version,
+      stable: this.stable,
+      source: this.getJdkReleaseIdentity(javaRelease)
+    };
+  }
+
  private logSetupError(error: any): void {
    const httpStatusCode =
      error instanceof tc.HTTPError
@@ -430,6 +535,9 @@ export abstract class JavaBase {
    if (javaRelease.checksum) {
      return `${javaRelease.checksum.algorithm}:${javaRelease.checksum.value}`;
    }
+    if (javaRelease.fingerprint) {
+      return javaRelease.fingerprint;
+    }
    try {
      const url = new URL(javaRelease.url);
      return `${url.origin}${url.pathname}`;
@@ -438,6 +546,16 @@ export abstract class JavaBase {
    }
  }

+  /**
+   * Whether the release identity pins the exact bytes behind `url`. A floating
+   * URL is a constant string, so it only becomes a safe cache identity once a
+   * checksum or a response validator distinguishes one published build from the
+   * next.
+   */
+  private hasStableReleaseIdentity(javaRelease: JavaDownloadRelease): boolean {
+    return Boolean(javaRelease.checksum ?? javaRelease.fingerprint);
+  }
+
  protected findInToolcache(): JavaInstallerResults | null {
    // we can't use tc.find directly because firstly, we need to filter versions by stability flag
    // if *-ea is provided, take only ea versions from toolcache, otherwise - only stable versions