Deprecate setup-java v4 (#1194)

Add a deprecation message to the v4 action metadata and emit a runtime warning that v4 will no longer receive updates, directing users to migrate to setup-java v5.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>

Copilot-Session: c8931f2e-fb40-497a-b529-be37cb97a0ae

.github/dependabot.yml

@@ -0,0 +1,22 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  # Enable version updates for npm
+  - package-ecosystem: 'npm'
+    # Look for `package.json` and `lock` files in the `root` directory
+    directory: '/'
+    # Check the npm registry for updates every day (weekdays)
+    schedule:
+      interval: 'weekly'
+
+  # Enable version updates for GitHub Actions
+  - package-ecosystem: 'github-actions'
+    # Workflow files stored in the default location of `.github/workflows`
+    # You don't need to specify `/.github/workflows` for `directory`. You can use `directory: "/"`.
+    directory: '/'
+    schedule:
+      interval: 'weekly'

.github/workflows/e2e-cache-dependency-path.yml

@@ -30,7 +30,7 @@ jobs:
         id: setup-java
         with:
           distribution: 'adopt'
-          java-version: '11'
+          java-version: '17'
           cache: gradle
           cache-dependency-path: __tests__/cache/gradle1/*.gradle*
       - name: Create files to cache
@@ -57,7 +57,7 @@ jobs:
         id: setup-java
         with:
           distribution: 'adopt'
-          java-version: '11'
+          java-version: '17'
           cache: gradle
           cache-dependency-path: __tests__/cache/gradle1/*.gradle*
       - name: Confirm that ~/.gradle/caches directory has been made
@@ -82,7 +82,7 @@ jobs:
         id: setup-java
         with:
           distribution: 'adopt'
-          java-version: '11'
+          java-version: '17'
           cache: gradle
           cache-dependency-path: __tests__/cache/gradle2/*.gradle*
       - name: Confirm that ~/.gradle/caches directory has not been made

.github/workflows/e2e-cache.yml

@@ -21,7 +21,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-13, windows-latest, ubuntu-latest]
+        os: [macos-15-intel, windows-latest, ubuntu-latest]
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -30,7 +30,7 @@ jobs:
         id: setup-java
         with:
           distribution: 'adopt'
-          java-version: '11'
+          java-version: '17'
           cache: gradle
       - name: Create files to cache
         # Need to avoid using Gradle daemon to stabilize the save process on Windows
@@ -46,7 +46,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-13, windows-latest, ubuntu-latest]
+        os: [macos-15-intel, windows-latest, ubuntu-latest]
     needs: gradle-save
     steps:
       - name: Checkout
@@ -70,7 +70,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-13, windows-latest, ubuntu-latest]
+        os: [macos-15-intel, windows-latest, ubuntu-latest]
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -93,7 +93,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-13, windows-latest, ubuntu-latest]
+        os: [macos-15-intel, windows-latest, ubuntu-latest]
     needs: maven-save
     steps:
       - name: Checkout
@@ -121,7 +121,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-13, windows-latest, ubuntu-22.04]
+        os: [macos-15-intel, windows-latest, ubuntu-22.04]
     steps:
       - name: Checkout
         uses: actions/checkout@v4
@@ -133,7 +133,7 @@ jobs:
           java-version: '11'
           cache: sbt
       - name: Setup SBT
-        if: matrix.os == 'macos-13'
+        if: matrix.os == 'macos-15-intel'
         run: |
           echo ""Installing SBT...""
           brew install sbt
@@ -141,7 +141,7 @@ jobs:
         run: sbt update
 
       - name: Check files to cache on macos-latest
-        if: matrix.os == 'macos-13'
+        if: matrix.os == 'macos-15-intel'
         run: |
           if [ ! -d ~/Library/Caches/Coursier ]; then
             echo "::error::The ~/Library/Caches/Coursier directory does not exist unexpectedly"
@@ -170,7 +170,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-13, windows-latest, ubuntu-22.04]
+        os: [macos-15-intel, windows-latest, ubuntu-22.04]
     needs: sbt-save
     steps:
       - name: Checkout
@@ -184,7 +184,7 @@ jobs:
           cache: sbt
 
       - name: Confirm that ~/Library/Caches/Coursier directory has been made
-        if: matrix.os == 'macos-13'
+        if: matrix.os == 'macos-15-intel'
         run: |
           if [ ! -d ~/Library/Caches/Coursier ]; then
             echo "::error::The ~/Library/Caches/Coursier directory does not exist unexpectedly"

.github/workflows/e2e-versions.yml

@@ -20,7 +20,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-13, windows-latest, ubuntu-latest]
+        os: [macos-15-intel, windows-latest, ubuntu-latest]
         distribution: [
             'temurin',
             'adopt',
@@ -39,10 +39,10 @@ jobs:
           - distribution: microsoft
             version: 8
           - distribution: dragonwell
-            os: macos-13
+            os: macos-15-intel
         include:
           - distribution: oracle
-            os: macos-13
+            os: macos-15-intel
             version: 17
           - distribution: oracle
             os: windows-latest
@@ -220,7 +220,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-13, windows-latest, ubuntu-latest]
+        os: [macos-15-intel, windows-latest, ubuntu-latest]
         version: ['17-ea', '15.0.0-ea.14']
     steps:
       - name: Checkout
@@ -286,7 +286,7 @@ jobs:
     strategy:
       fail-fast: false
       matrix:
-        os: [macos-13, windows-latest, ubuntu-latest]
+        os: [macos-15-intel, windows-latest, ubuntu-latest]
         distribution:
           ['temurin', 'zulu', 'liberica', 'semeru', 'sapmachine', 'jetbrains']
         java-package: ['jre']

.github/workflows/publish-immutable-actions.yml

@@ -17,4 +17,4 @@ jobs:
         uses: actions/checkout@v4
       - name: Publish
         id: publish
-        uses: actions/publish-immutable-action@0.0.3
+        uses: actions/publish-immutable-action@v0.0.4

README.md

@@ -100,8 +100,8 @@ Currently, the following distributions are supported:
 |-|-|-|-|
 | `temurin` | Eclipse Temurin | [Link](https://adoptium.net/) | [Link](https://adoptium.net/about.html)
 | `zulu` | Azul Zulu OpenJDK | [Link](https://www.azul.com/downloads/zulu-community/?package=jdk) | [Link](https://www.azul.com/products/zulu-and-zulu-enterprise/zulu-terms-of-use/) |
-| `adopt` or `adopt-hotspot` | AdoptOpenJDK Hotspot | [Link](https://adoptopenjdk.net/) | [Link](https://adoptopenjdk.net/about.html) |
-| `adopt-openj9` | AdoptOpenJDK OpenJ9 | [Link](https://adoptopenjdk.net/) | [Link](https://adoptopenjdk.net/about.html) |
+| `adopt` or `adopt-hotspot` (deprecated; use `temurin`) | AdoptOpenJDK Hotspot | [Link](https://adoptopenjdk.net/) | [Link](https://adoptopenjdk.net/about.html) |
+| `adopt-openj9` (deprecated; use `semeru`) | AdoptOpenJDK OpenJ9 | [Link](https://adoptopenjdk.net/) | [Link](https://adoptopenjdk.net/about.html) |
 | `liberica` | Liberica JDK | [Link](https://bell-sw.com/) | [Link](https://bell-sw.com/liberica_eula/) |
 | `microsoft` | Microsoft Build of OpenJDK | [Link](https://www.microsoft.com/openjdk) | [Link](https://docs.microsoft.com/java/openjdk/faq)
 | `corretto` | Amazon Corretto Build of OpenJDK | [Link](https://aws.amazon.com/corretto/) | [Link](https://aws.amazon.com/corretto/faqs/)
@@ -114,10 +114,12 @@ Currently, the following distributions are supported:
 
 **NOTE:** The different distributors can provide discrepant list of available versions / supported configurations. Please refer to the official documentation to see the list of supported versions.
 
-**NOTE:** AdoptOpenJDK got moved to Eclipse Temurin and won't be updated anymore. It is highly recommended to migrate workflows from `adopt` and `adopt-openj9`, to `temurin` and `semeru` respectively, to keep receiving software and security updates. See more details in the [Good-bye AdoptOpenJDK post](https://blog.adoptopenjdk.net/2021/08/goodbye-adoptopenjdk-hello-adoptium/).
+**NOTE:** The legacy AdoptOpenJDK distributions are deprecated and will be removed in setup-java v6. Migrate `adopt` and `adopt-hotspot` to `temurin`, and `adopt-openj9` to `semeru`, to keep receiving software and security updates. See more details in the [Good-bye AdoptOpenJDK post](https://blog.adoptopenjdk.net/2021/08/goodbye-adoptopenjdk-hello-adoptium/).
 
 **NOTE:** For Azul Zulu OpenJDK architectures x64 and arm64 are mapped to x86 / arm with proper hw_bitness.
 
+**NOTE:** To comply with the GraalVM Free Terms and Conditions (GFTC) license, it is recommended to use GraalVM JDK 17 version 17.0.12, as this is the only version of GraalVM JDK 17 available under the GFTC license. Additionally, it is encouraged to consider upgrading to GraalVM JDK 21, which offers the latest features and improvements.
+
 ### Caching packages dependencies
 The action has a built-in functionality for caching and restoring dependencies. It uses [toolkit/cache](https://github.com/actions/toolkit/tree/main/packages/cache) under hood for caching dependencies but requires less configuration settings. Supported package managers are gradle, maven and sbt. The format of the used cache key is `setup-java-${{ platform }}-${{ packageManager }}-${{ fileHash }}`, where the hash is based on the following files:
 
@@ -273,6 +275,15 @@ In the example above multiple JDKs are installed for the same job. The result af
 - [Modifying Maven Toolchains](docs/advanced-usage.md#Modifying-Maven-Toolchains)
 - [Java Version File](docs/advanced-usage.md#Java-version-file)
 
+## Recommended permissions
+
+When using the `setup-java` action in your GitHub Actions workflow, it is recommended to set the following permissions to ensure proper functionality:
+
+```yaml
+permissions:
+  contents: read # access to check out code and install dependencies
+```
+
 ## License
 
 The scripts and documentation in this project are released under the [MIT License](LICENSE).

__tests__/distributors/distribution-factory.test.ts

@@ -0,0 +1,51 @@
+import * as core from '@actions/core';
+import {
+  AdoptDistribution,
+  AdoptImplementation
+} from '../../src/distributions/adopt/installer';
+import {JavaInstallerOptions} from '../../src/distributions/base-models';
+import {getJavaDistribution} from '../../src/distributions/distribution-factory';
+
+describe('getJavaDistribution', () => {
+  const installerOptions: JavaInstallerOptions = {
+    version: '11',
+    architecture: 'x64',
+    packageType: 'jdk',
+    checkLatest: false
+  };
+
+  afterEach(() => {
+    jest.restoreAllMocks();
+  });
+
+  it.each([
+    ['adopt', AdoptImplementation.Hotspot, 'temurin'],
+    ['adopt-hotspot', AdoptImplementation.Hotspot, 'temurin'],
+    ['adopt-openj9', AdoptImplementation.OpenJ9, 'semeru']
+  ])(
+    'warns that %s is deprecated while preserving its installer',
+    (
+      distributionName: string,
+      implementation: AdoptImplementation,
+      replacement: string
+    ) => {
+      const warningSpy = jest
+        .spyOn(core, 'warning')
+        .mockImplementation(() => {});
+
+      const distribution = getJavaDistribution(
+        distributionName,
+        installerOptions
+      );
+
+      expect(distribution).toBeInstanceOf(AdoptDistribution);
+      if (!(distribution instanceof AdoptDistribution)) {
+        throw new Error(`Expected an Adopt installer for ${distributionName}`);
+      }
+      expect(distribution['jvmImpl']).toBe(implementation);
+      expect(warningSpy).toHaveBeenCalledWith(
+        `The '${distributionName}' legacy AdoptOpenJDK distribution is deprecated and will be removed in setup-java v6. Please migrate to the '${replacement}' distribution.`
+      );
+    }
+  );
+});

action.yml

@@ -1,6 +1,7 @@
 name: 'Setup Java JDK'
 description: 'Set up a specific version of the Java JDK and add the
    command-line tools to the PATH'
+deprecationMessage: 'setup-java v4 is deprecated and will no longer receive updates. Please migrate to actions/setup-java@v5.'
 author: 'GitHub'
 inputs:
   java-version:
@@ -8,7 +9,7 @@ inputs:
   java-version-file:
     description: 'The path to the `.java-version` file. See examples of supported syntax in README file'
   distribution:
-    description: 'Java distribution. See the list of supported distributions in README file'
+    description: 'Java distribution. See the list of supported distributions in README file. Legacy AdoptOpenJDK values (adopt, adopt-hotspot, adopt-openj9) are deprecated and will be removed in setup-java v6.'
     required: true
   java-package:
     description: 'The package type (jdk, jre, jdk+fx, jre+fx)'

docs/advanced-usage.md

@@ -40,7 +40,7 @@ steps:
 ```
 
 ### Adopt
-**NOTE:** Adopt OpenJDK got moved to Eclipse Temurin and won't be updated anymore. It is highly recommended to migrate workflows from `adopt` to `temurin` to keep receiving software and security updates. See more details in the [Good-bye AdoptOpenJDK post](https://blog.adoptopenjdk.net/2021/08/goodbye-adoptopenjdk-hello-adoptium/).
+**NOTE:** The legacy `adopt`, `adopt-hotspot`, and `adopt-openj9` distributions are deprecated and will be removed in setup-java v6. Migrate `adopt` and `adopt-hotspot` to `temurin`, and `adopt-openj9` to `semeru`, to keep receiving software and security updates. See more details in the [Good-bye AdoptOpenJDK post](https://blog.adoptopenjdk.net/2021/08/goodbye-adoptopenjdk-hello-adoptium/).
 
 ```yaml
 steps:
@@ -215,20 +215,6 @@ The available package types are:
 - `jdk+ft` - JBRSDK (FreeType)
 - `jre+ft` - JBR (FreeType)
 
-### GraalVM
-**NOTE:** Oracle GraalVM is only available for JDK 17 and later.
-
-```yaml
-steps:
-- uses: actions/checkout@v4
-- uses: actions/setup-java@v4
-  with:
-    distribution: 'graalvm'
-    java-version: '21'
-- run: |
-    java -cp java HelloWorldApp
-    native-image -cp java HelloWorldApp
-```
 
 ## Installing custom Java package type
 ```yaml

package.json

@@ -8,8 +8,8 @@
     "build": "ncc build -o dist/setup src/setup-java.ts && ncc build -o dist/cleanup src/cleanup-java.ts",
     "format": "prettier --no-error-on-unmatched-pattern --config ./.prettierrc.js --write \"**/*.{ts,yml,yaml}\"",
     "format-check": "prettier --no-error-on-unmatched-pattern --config ./.prettierrc.js --check \"**/*.{ts,yml,yaml}\"",
-    "lint": "eslint --config ./.eslintrc.js \"**/*.ts\"",
-    "lint:fix": "eslint --config ./.eslintrc.js \"**/*.ts\" --fix",
+    "lint": "eslint --config ./.eslintrc.js --ext .ts .",
+    "lint:fix": "eslint --config ./.eslintrc.js --ext .ts . --fix",
     "prerelease": "npm run-script build",
     "release": "git add -f dist/setup/index.js dist/cleanup/index.js",
     "test": "jest"
@@ -26,18 +26,26 @@
   "author": "GitHub",
   "license": "MIT",
   "dependencies": {
-    "@actions/cache": "^4.0.0",
-    "@actions/core": "^1.11.0",
+    "@actions/cache": "^4.0.3",
+    "@actions/core": "^1.10.0",
     "@actions/exec": "^1.0.4",
-    "@actions/glob": "^0.4.0",
-    "@actions/http-client": "^2.2.1",
+    "@actions/glob": "^0.5.0",
+    "@actions/http-client": "^3.0.2",
     "@actions/io": "^1.0.2",
-    "@actions/tool-cache": "^2.0.1",
+    "@actions/tool-cache": "^2.0.2",
     "semver": "^7.6.0",
     "xmlbuilder2": "^2.4.0"
   },
+  "overrides": {
+    "@actions/http-client": "$@actions/http-client",
+    "minimatch": "10.2.6",
+    "test-exclude": "7.0.2",
+    "xmlbuilder2": {
+      "js-yaml": "3.15.0"
+    }
+  },
   "devDependencies": {
-    "@types/jest": "^29.5.12",
+    "@types/jest": "^29.5.14",
     "@types/node": "^20.11.24",
     "@types/semver": "^7.5.8",
     "@typescript-eslint/eslint-plugin": "^5.54.0",
@@ -50,7 +58,7 @@
     "jest": "^29.7.0",
     "jest-circus": "^29.7.0",
     "prettier": "^2.8.4",
-    "ts-jest": "^29.1.2",
+    "ts-jest": "^29.3.0",
     "typescript": "^5.3.3"
   },
   "bugs": {

src/distributions/distribution-factory.ts

@@ -1,3 +1,4 @@
+import * as core from '@actions/core';
 import {JavaBase} from './base-installer';
 import {JavaInstallerOptions} from './base-models';
 import {LocalDistribution} from './local/installer';
@@ -42,11 +43,13 @@ export function getJavaDistribution(
       return new LocalDistribution(installerOptions, jdkFile);
     case JavaDistribution.Adopt:
     case JavaDistribution.AdoptHotspot:
+      warnIfAdoptDistributionIsDeprecated(distributionName, 'temurin');
       return new AdoptDistribution(
         installerOptions,
         AdoptImplementation.Hotspot
       );
     case JavaDistribution.AdoptOpenJ9:
+      warnIfAdoptDistributionIsDeprecated(distributionName, 'semeru');
       return new AdoptDistribution(
         installerOptions,
         AdoptImplementation.OpenJ9
@@ -80,3 +83,12 @@ export function getJavaDistribution(
       return null;
   }
 }
+
+function warnIfAdoptDistributionIsDeprecated(
+  distributionName: string,
+  replacement: string
+): void {
+  core.warning(
+    `The '${distributionName}' legacy AdoptOpenJDK distribution is deprecated and will be removed in setup-java v6. Please migrate to the '${replacement}' distribution.`
+  );
+}

src/distributions/sapmachine/installer.ts

@@ -8,7 +8,6 @@ import {
   convertVersionToSemver,
   extractJdkFile,
   getDownloadArchiveExtension,
-  getGitHubHttpHeaders,
   isVersionSatisfies,
   renameWinArchive
 } from '../../util';
@@ -64,13 +63,12 @@ export class SapMachineDistribution extends JavaBase {
     const arch = this.distributionArchitecture();
 
     let fetchedReleasesJson = await this.fetchReleasesFromUrl(
-      'https://sap.github.io/SapMachine/assets/data/sapmachine-releases-all.json'
+      'https://sapmachine.io/assets/data/sapmachine-releases-all.json'
     );
 
     if (!fetchedReleasesJson) {
       fetchedReleasesJson = await this.fetchReleasesFromUrl(
-        'https://api.github.com/repos/SAP/SapMachine/contents/assets/data/sapmachine-releases-all.json?ref=gh-pages',
-        getGitHubHttpHeaders()
+        'https://sap.github.io/SapMachine/assets/data/sapmachine-releases-all.json'
       );
     }
 

src/setup-java.ts

@@ -13,8 +13,13 @@ import * as path from 'path';
 import {getJavaDistribution} from './distributions/distribution-factory';
 import {JavaInstallerOptions} from './distributions/base-models';
 
+const DEPRECATION_WARNING =
+  'setup-java v4 is deprecated and will no longer receive updates. Please migrate to actions/setup-java@v5.';
+
 async function run() {
   try {
+    core.warning(DEPRECATION_WARNING);
+
     const versions = core.getMultilineInput(constants.INPUT_JAVA_VERSION);
     const distributionName = core.getInput(constants.INPUT_DISTRIBUTION, {
       required: true