Initial plan

* Updated microsoft openjdk setup-java action

* Update generated distribution

* Potential fix for pull request finding

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

* Applied new fixes from npm run check

* Update generated distribution

---------

Co-authored-by: Copilot Autofix powered by AI <175728472+Copilot@users.noreply.github.com>

.gitattributes

@@ -0,0 +1,4 @@
+* text=auto eol=lf
+dist/index.js    -diff -merge
+dist/index.js    linguist-generated=true
+.licenses/** -diff linguist-generated=true

.github/CODEOWNERS

@@ -0,0 +1 @@
+* @actions/setup-actions-team

.github/ISSUE_TEMPLATE/bug_report.md

@@ -0,0 +1,32 @@
+---
+name: Bug report
+about: Create a bug report
+title: ''
+labels: bug, needs triage
+assignees: ''
+
+---
+
+**Description:**
+A clear and concise description of what the bug is.
+
+**Task version:**
+Specify the task version
+
+**Platform:**
+- [ ] Ubuntu
+- [ ] macOS
+- [ ] Windows
+
+**Runner type:**
+- [ ] Hosted
+- [ ] Self-hosted
+
+**Repro steps:**  
+A description with steps to reproduce the issue. If your have a public example or repo to share, please provide the link.
+
+**Expected behavior:**
+A description of what you expected to happen.
+
+**Actual behavior:**
+A description of what is actually happening.

.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1 @@
+blank_issues_enabled: false

.github/ISSUE_TEMPLATE/feature_request.md

@@ -0,0 +1,16 @@
+---
+name: Feature request
+about: Suggest an idea for this project
+title: ''
+labels: feature request, needs triage
+assignees: ''
+---
+
+**Description:**
+Describe your proposal.
+
+**Justification:**
+Justification or a use case for your proposal.
+
+**Are you willing to submit a PR?**
+<!--- We accept contributions! -->

.github/ISSUE_TEMPLATE/new_distribution_request.md

@@ -0,0 +1,22 @@
+---
+name: New Java distribution template
+about: Suggest a new Java distribution
+title: ''
+labels: feature request, needs triage
+assignees: ''
+---
+
+**Description:**
+Describe your proposal.
+
+**Justification:**
+Justification or a use case for your proposal.
+
+**Download URL:**
+Download URL for the new distribution.
+
+**License:**
+Link to the license for the new distribution.
+
+**Are you willing to submit a PR?**
+<!--- We accept contributions! -->

.github/PULL_REQUEST_TEMPLATE/new_distribution_pull_request_template.md

@@ -0,0 +1,16 @@
+**Description:**
+Describe your changes.
+
+**Related issue:**
+Add link to the related issue.
+
+**Download URL:**
+Download URL for the new distribution.
+
+**License:**
+Link to the license for the new distribution.
+
+**Check list:**
+- [ ] Mark if documentation changes are required.
+- [ ] Mark if tests were added or updated to cover the changes.
+- [ ] Mark if new distribution is being added.

.github/dependabot.yml

@@ -0,0 +1,22 @@
+# To get started with Dependabot version updates, you'll need to specify which
+# package ecosystems to update and where the package manifests are located.
+# Please see the documentation for all configuration options:
+# https://docs.github.com/code-security/dependabot/dependabot-version-updates/configuration-options-for-the-dependabot.yml-file
+
+version: 2
+updates:
+  # Enable version updates for npm
+  - package-ecosystem: 'npm'
+    # Look for `package.json` and `lock` files in the `root` directory
+    directory: '/'
+    # Check the npm registry for updates every day (weekdays)
+    schedule:
+      interval: 'weekly'
+
+  # Enable version updates for GitHub Actions
+  - package-ecosystem: 'github-actions'
+    # Workflow files stored in the default location of `.github/workflows`
+    # You don't need to specify `/.github/workflows` for `directory`. You can use `directory: "/"`.
+    directory: '/'
+    schedule:
+      interval: 'weekly'

.github/java.json

@@ -9,6 +9,31 @@
                     "message": 3
                 }
             ]
+        },
+        {
+            "owner": "javac",
+            "pattern": [
+                {
+                    "regexp": "^([^:]+):(\\d+): (warning|error): (.+?)$",
+                    "file": 1,
+                    "line": 2,
+                    "severity": 3,
+                    "message": 4
+                }
+            ]
+        },
+        {
+            "owner": "maven-javac",
+            "pattern": [
+                {
+                    "regexp": "^\\[(WARNING|ERROR)\\]\\s+(.+?\\.java):\\[(\\d+),(\\d+)\\]\\s+(.+)$",
+                    "severity": 1,
+                    "file": 2,
+                    "line": 3,
+                    "column": 4,
+                    "message": 5
+                }
+            ]
         }
     ]
-}
+}

.github/pull_request_template.md

@@ -0,0 +1,10 @@
+**Description:**
+Describe your changes.
+
+**Related issue:**
+Add link to the related issue.
+
+**Check list:**
+- [ ] Ran `npm run check` locally (format, lint, build, test) and all checks pass.
+- [ ] Mark if documentation changes are required.
+- [ ] Mark if tests were added or updated to cover the changes.

.github/workflows/basic-validation.yml

@@ -0,0 +1,22 @@
+name: Basic validation
+
+on:
+  push:
+    branches:
+      - main
+      - releases/*
+    paths-ignore:
+      - '**.md'
+  pull_request:
+    paths-ignore:
+      - '**.md'
+
+permissions:
+  contents: read
+
+jobs:
+  call-basic-validation:
+    name: Basic validation
+    uses: actions/reusable-workflows/.github/workflows/basic-validation.yml@main
+    with:
+      node-version: '24.x'

.github/workflows/benchmark-cache-restore.yml

@@ -0,0 +1,209 @@
+name: Benchmark cache restore
+
+on:
+  workflow_dispatch:
+    inputs:
+      baseline-ref:
+        description: Git ref containing the sequential restore implementation
+        required: true
+        default: main
+        type: string
+      candidate-ref:
+        description: Git ref containing the concurrent restore implementation (defaults to the dispatched ref)
+        required: false
+        type: string
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  warm-caches:
+    name: Warm ${{ matrix.tool }} ${{ matrix.profile }} caches (${{ matrix.os }})
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-15-intel, windows-latest, ubuntu-latest]
+        tool: [maven, gradle]
+        profile: [small, large]
+    steps:
+      - name: Checkout benchmark workflow
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Checkout baseline
+        uses: actions/checkout@v7
+        with:
+          path: baseline
+          persist-credentials: false
+          ref: ${{ inputs.baseline-ref }}
+      - name: Checkout candidate
+        uses: actions/checkout@v7
+        with:
+          path: candidate
+          persist-credentials: false
+          ref: ${{ inputs.candidate-ref || github.ref }}
+      - name: Prepare benchmark inputs
+        run: bash __tests__/benchmark-cache-restore.sh prepare "${{ matrix.tool }}" "${{ matrix.profile }}"
+      - name: Prepare cache save
+        uses: ./candidate
+        with:
+          distribution: temurin
+          java-version: '17'
+          cache: ${{ matrix.tool }}
+          cache-dependency-path: benchmark/${{ matrix.tool == 'maven' && 'pom.xml' || 'build.gradle' }}
+      - name: Populate benchmark caches
+        run: |
+          bash __tests__/benchmark-cache-restore.sh reset "${{ matrix.tool }}"
+          bash __tests__/benchmark-cache-restore.sh populate "${{ matrix.tool }}" "${{ matrix.profile }}"
+
+  benchmark:
+    name: Benchmark ${{ matrix.tool }} ${{ matrix.profile }} (${{ matrix.os }})
+    needs: warm-caches
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-15-intel, windows-latest, ubuntu-latest]
+        tool: [maven, gradle]
+        profile: [small, large]
+    steps:
+      - name: Checkout benchmark workflow
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Checkout baseline
+        uses: actions/checkout@v7
+        with:
+          path: baseline
+          persist-credentials: false
+          ref: ${{ inputs.baseline-ref }}
+      - name: Checkout candidate
+        uses: actions/checkout@v7
+        with:
+          path: candidate
+          persist-credentials: false
+          ref: ${{ inputs.candidate-ref || github.ref }}
+      - name: Prepare benchmark inputs
+        run: bash __tests__/benchmark-cache-restore.sh prepare "${{ matrix.tool }}" "${{ matrix.profile }}"
+
+      - name: Reset caches for baseline iteration 1
+        run: bash __tests__/benchmark-cache-restore.sh reset "${{ matrix.tool }}"
+      - name: Start baseline iteration 1 timer
+        run: bash __tests__/benchmark-cache-restore.sh start "${{ matrix.tool }}"
+      - name: Restore with baseline iteration 1
+        id: baseline-1
+        uses: ./baseline
+        with:
+          distribution: temurin
+          java-version: '17'
+          cache: ${{ matrix.tool }}
+          cache-dependency-path: benchmark/${{ matrix.tool == 'maven' && 'pom.xml' || 'build.gradle' }}
+          cache-read-only: true
+      - name: Record baseline iteration 1
+        env:
+          CACHE_HIT: ${{ steps.baseline-1.outputs.cache-hit }}
+        run: bash __tests__/benchmark-cache-restore.sh record "${{ matrix.tool }}" "${{ matrix.os }}" "${{ matrix.profile }}" baseline 1 "$CACHE_HIT"
+
+      - name: Reset caches for candidate iteration 1
+        run: bash __tests__/benchmark-cache-restore.sh reset "${{ matrix.tool }}"
+      - name: Start candidate iteration 1 timer
+        run: bash __tests__/benchmark-cache-restore.sh start "${{ matrix.tool }}"
+      - name: Restore with candidate iteration 1
+        id: candidate-1
+        uses: ./candidate
+        with:
+          distribution: temurin
+          java-version: '17'
+          cache: ${{ matrix.tool }}
+          cache-dependency-path: benchmark/${{ matrix.tool == 'maven' && 'pom.xml' || 'build.gradle' }}
+          cache-read-only: true
+      - name: Record candidate iteration 1
+        env:
+          CACHE_HIT: ${{ steps.candidate-1.outputs.cache-hit }}
+        run: bash __tests__/benchmark-cache-restore.sh record "${{ matrix.tool }}" "${{ matrix.os }}" "${{ matrix.profile }}" candidate 1 "$CACHE_HIT"
+
+      - name: Reset caches for candidate iteration 2
+        run: bash __tests__/benchmark-cache-restore.sh reset "${{ matrix.tool }}"
+      - name: Start candidate iteration 2 timer
+        run: bash __tests__/benchmark-cache-restore.sh start "${{ matrix.tool }}"
+      - name: Restore with candidate iteration 2
+        id: candidate-2
+        uses: ./candidate
+        with:
+          distribution: temurin
+          java-version: '17'
+          cache: ${{ matrix.tool }}
+          cache-dependency-path: benchmark/${{ matrix.tool == 'maven' && 'pom.xml' || 'build.gradle' }}
+          cache-read-only: true
+      - name: Record candidate iteration 2
+        env:
+          CACHE_HIT: ${{ steps.candidate-2.outputs.cache-hit }}
+        run: bash __tests__/benchmark-cache-restore.sh record "${{ matrix.tool }}" "${{ matrix.os }}" "${{ matrix.profile }}" candidate 2 "$CACHE_HIT"
+
+      - name: Reset caches for baseline iteration 2
+        run: bash __tests__/benchmark-cache-restore.sh reset "${{ matrix.tool }}"
+      - name: Start baseline iteration 2 timer
+        run: bash __tests__/benchmark-cache-restore.sh start "${{ matrix.tool }}"
+      - name: Restore with baseline iteration 2
+        id: baseline-2
+        uses: ./baseline
+        with:
+          distribution: temurin
+          java-version: '17'
+          cache: ${{ matrix.tool }}
+          cache-dependency-path: benchmark/${{ matrix.tool == 'maven' && 'pom.xml' || 'build.gradle' }}
+          cache-read-only: true
+      - name: Record baseline iteration 2
+        env:
+          CACHE_HIT: ${{ steps.baseline-2.outputs.cache-hit }}
+        run: bash __tests__/benchmark-cache-restore.sh record "${{ matrix.tool }}" "${{ matrix.os }}" "${{ matrix.profile }}" baseline 2 "$CACHE_HIT"
+
+      - name: Reset caches for baseline iteration 3
+        run: bash __tests__/benchmark-cache-restore.sh reset "${{ matrix.tool }}"
+      - name: Start baseline iteration 3 timer
+        run: bash __tests__/benchmark-cache-restore.sh start "${{ matrix.tool }}"
+      - name: Restore with baseline iteration 3
+        id: baseline-3
+        uses: ./baseline
+        with:
+          distribution: temurin
+          java-version: '17'
+          cache: ${{ matrix.tool }}
+          cache-dependency-path: benchmark/${{ matrix.tool == 'maven' && 'pom.xml' || 'build.gradle' }}
+          cache-read-only: true
+      - name: Record baseline iteration 3
+        env:
+          CACHE_HIT: ${{ steps.baseline-3.outputs.cache-hit }}
+        run: bash __tests__/benchmark-cache-restore.sh record "${{ matrix.tool }}" "${{ matrix.os }}" "${{ matrix.profile }}" baseline 3 "$CACHE_HIT"
+
+      - name: Reset caches for candidate iteration 3
+        run: bash __tests__/benchmark-cache-restore.sh reset "${{ matrix.tool }}"
+      - name: Start candidate iteration 3 timer
+        run: bash __tests__/benchmark-cache-restore.sh start "${{ matrix.tool }}"
+      - name: Restore with candidate iteration 3
+        id: candidate-3
+        uses: ./candidate
+        with:
+          distribution: temurin
+          java-version: '17'
+          cache: ${{ matrix.tool }}
+          cache-dependency-path: benchmark/${{ matrix.tool == 'maven' && 'pom.xml' || 'build.gradle' }}
+          cache-read-only: true
+      - name: Record candidate iteration 3
+        env:
+          CACHE_HIT: ${{ steps.candidate-3.outputs.cache-hit }}
+        run: bash __tests__/benchmark-cache-restore.sh record "${{ matrix.tool }}" "${{ matrix.os }}" "${{ matrix.profile }}" candidate 3 "$CACHE_HIT"
+
+      - name: Summarize benchmark
+        run: bash __tests__/benchmark-cache-restore.sh summarize "${{ matrix.tool }}" "$GITHUB_STEP_SUMMARY"
+      - name: Upload raw timings
+        uses: actions/upload-artifact@v7
+        with:
+          name: cache-restore-${{ matrix.os }}-${{ matrix.tool }}-${{ matrix.profile }}
+          path: .benchmark-results/timings.csv
+          if-no-files-found: error

.github/workflows/check-dist.yml

@@ -0,0 +1,22 @@
+name: Check dist/
+
+on:
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - '**.md'
+  pull_request:
+    paths-ignore:
+      - '**.md'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  call-check-dist:
+    name: Check dist/
+    uses: actions/reusable-workflows/.github/workflows/check-dist.yml@main
+    with:
+      node-version: '24.x'

.github/workflows/codeql-analysis.yml

@@ -0,0 +1,20 @@
+name: CodeQL analysis
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '0 3 * * 0'
+
+permissions: {}
+
+jobs:
+  call-codeQL-analysis:
+    permissions:
+      actions: read
+      contents: read
+      security-events: write
+    name: CodeQL analysis
+    uses: actions/reusable-workflows/.github/workflows/codeql-analysis.yml@main

.github/workflows/e2e-cache.yml

@@ -0,0 +1,497 @@
+name: Validate cache
+
+on:
+  push:
+    branches:
+      - main
+      - releases/*
+    paths-ignore:
+      - '**.md'
+  pull_request:
+    paths-ignore:
+      - '**.md'
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  gradle-save:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-15-intel, windows-latest, ubuntu-latest]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Run setup-java with the cache for gradle
+        uses: ./
+        id: setup-java
+        with:
+          distribution: 'temurin'
+          java-version: '17'
+          cache: gradle
+      - name: Create files to cache
+        # Need to avoid using Gradle daemon to stabilize the save process on Windows
+        # https://github.com/actions/cache/issues/454#issuecomment-840493935
+        run: |
+          gradle downloadDependencies --no-daemon -p __tests__/cache/gradle1
+          mkdir -p "$HOME/.gradle/wrapper/dists/setup-java-e2e"
+          echo "gradle wrapper cache" > "$HOME/.gradle/wrapper/dists/setup-java-e2e/payload"
+          bash __tests__/check-dir.sh "$HOME/.gradle/caches"
+          bash __tests__/check-dir.sh "$HOME/.gradle/wrapper/dists"
+  gradle-restore:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-15-intel, windows-latest, ubuntu-latest]
+    needs: gradle-save
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Run setup-java with the cache for gradle
+        uses: ./
+        id: setup-java
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+          cache: gradle
+          cache-read-only: true
+      - name: Confirm that ~/.gradle/caches directory has been made
+        run: bash __tests__/check-dir.sh "$HOME/.gradle/caches"
+      - name: Confirm that the Gradle Wrapper cache has been restored
+        run: bash __tests__/check-dir.sh "$HOME/.gradle/wrapper/dists"
+  maven-save:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-15-intel, windows-latest, ubuntu-latest]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Run setup-java with the cache for maven
+        uses: ./
+        id: setup-java
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+          cache: maven
+      - name: Create files to cache
+        run: |
+          mvn verify -f __tests__/cache/maven/pom.xml
+          mkdir -p "$HOME/.m2/wrapper/dists/setup-java-e2e"
+          echo "maven wrapper cache" > "$HOME/.m2/wrapper/dists/setup-java-e2e/payload"
+          bash __tests__/check-dir.sh "$HOME/.m2/repository"
+          bash __tests__/check-dir.sh "$HOME/.m2/wrapper/dists"
+  maven-restore:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-15-intel, windows-latest, ubuntu-latest]
+    needs: maven-save
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Run setup-java with the cache for maven
+        uses: ./
+        id: setup-java
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+          cache: maven
+          cache-read-only: true
+      - name: Confirm that ~/.m2/repository directory has been made
+        run: bash __tests__/check-dir.sh "$HOME/.m2/repository"
+      - name: Confirm that the Maven Wrapper cache has been restored
+        run: bash __tests__/check-dir.sh "$HOME/.m2/wrapper/dists"
+  sbt-save:
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: bash
+        working-directory: __tests__/cache/sbt
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-15-intel, windows-latest, ubuntu-22.04]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Run setup-java with the cache for sbt
+        uses: ./
+        id: setup-java
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+          cache: sbt
+      - name: Setup SBT
+        if: matrix.os == 'macos-15-intel'
+        run: |
+          echo ""Installing SBT...""
+          brew install sbt
+      - name: Create files to cache
+        run: sbt update
+
+      - name: Check files to cache on macos-latest
+        if: matrix.os == 'macos-15-intel'
+        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/Library/Caches/Coursier"
+      - name: Check files to cache on windows-latest
+        if: matrix.os == 'windows-latest'
+        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/AppData/Local/Coursier/Cache"
+      - name: Check files to cache on ubuntu-latest
+        if: matrix.os == 'ubuntu-22.04'
+        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/.cache/coursier"
+  sbt-restore:
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: bash
+        working-directory: __tests__/cache/sbt
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-15-intel, windows-latest, ubuntu-22.04]
+    needs: sbt-save
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Run setup-java with the cache for sbt
+        uses: ./
+        id: setup-java
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+          cache: sbt
+          cache-read-only: true
+
+      - name: Confirm that ~/Library/Caches/Coursier directory has been made
+        if: matrix.os == 'macos-15-intel'
+        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/Library/Caches/Coursier"
+      - name: Confirm that ~/AppData/Local/Coursier/Cache directory has been made
+        if: matrix.os == 'windows-latest'
+        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/AppData/Local/Coursier/Cache"
+      - name: Confirm that ~/.cache/coursier directory has been made
+        if: matrix.os == 'ubuntu-22.04'
+        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/.cache/coursier"
+  gradle1-save:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, windows-latest, ubuntu-latest]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Run setup-java with the cache for gradle
+        uses: ./
+        id: setup-java
+        with:
+          distribution: 'temurin'
+          java-version: '17'
+          cache: gradle
+          cache-dependency-path: __tests__/cache/gradle1/*.gradle*
+      - name: Create files to cache
+        # Need to avoid using Gradle daemon to stabilize the save process on Windows
+        # https://github.com/actions/cache/issues/454#issuecomment-840493935
+        run: |
+          gradle downloadDependencies --no-daemon -p __tests__/cache/gradle1
+          mkdir -p "$HOME/.gradle/wrapper/dists/setup-java-e2e-gradle1"
+          echo "gradle wrapper cache gradle1" > "$HOME/.gradle/wrapper/dists/setup-java-e2e-gradle1/payload"
+          bash __tests__/check-dir.sh "$HOME/.gradle/caches"
+          bash __tests__/check-dir.sh "$HOME/.gradle/wrapper/dists"
+  gradle1-restore:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, windows-latest, ubuntu-latest]
+    needs: gradle1-save
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Run setup-java with the cache for gradle
+        uses: ./
+        id: setup-java
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+          cache: gradle
+          cache-dependency-path: __tests__/cache/gradle1/*.gradle*
+      - name: Confirm that ~/.gradle/caches directory has been made
+        run: bash __tests__/check-dir.sh "$HOME/.gradle/caches"
+      - name: Confirm that the Gradle Wrapper cache has been restored
+        run: bash __tests__/check-dir.sh "$HOME/.gradle/wrapper/dists"
+  gradle2-restore:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, windows-latest, ubuntu-latest]
+    needs: gradle1-save
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Run setup-java with the cache for gradle
+        uses: ./
+        id: setup-java
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+          cache: gradle
+          cache-dependency-path: __tests__/cache/gradle2/*.gradle*
+      - name: Confirm that ~/.gradle/caches directory has not been made
+        run: bash __tests__/check-dir.sh "$HOME/.gradle/caches" absent
+  maven1-save:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-15-intel, windows-latest, ubuntu-latest]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Run setup-java with the cache for maven
+        uses: ./
+        id: setup-java
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+          cache: maven
+          cache-dependency-path: __tests__/cache/maven/pom.xml
+      - name: Create files to cache
+        run: |
+          mvn verify -f __tests__/cache/maven/pom.xml
+          mkdir -p "$HOME/.m2/wrapper/dists/setup-java-e2e-maven1"
+          echo "maven wrapper cache maven1" > "$HOME/.m2/wrapper/dists/setup-java-e2e-maven1/payload"
+          bash __tests__/check-dir.sh "$HOME/.m2/repository"
+          bash __tests__/check-dir.sh "$HOME/.m2/wrapper/dists"
+  maven1-restore:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-15-intel, windows-latest, ubuntu-latest]
+    needs: maven1-save
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Run setup-java with the cache for maven
+        uses: ./
+        id: setup-java
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+          cache: maven
+          cache-dependency-path: __tests__/cache/maven/pom.xml
+      - name: Confirm that ~/.m2/repository directory has been made
+        run: bash __tests__/check-dir.sh "$HOME/.m2/repository"
+      - name: Confirm that the Maven Wrapper cache has been restored
+        run: bash __tests__/check-dir.sh "$HOME/.m2/wrapper/dists"
+  maven2-restore:
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-15-intel, windows-latest, ubuntu-latest]
+    needs: maven1-save
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Run setup-java with the cache for maven
+        uses: ./
+        id: setup-java
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+          cache: maven
+          cache-dependency-path: |
+            __tests__/cache/maven2/pom.xml
+            README.md
+      - name: Confirm that ~/.m2/repository directory has not been made
+        run: bash __tests__/check-dir.sh "$HOME/.m2/repository" absent
+  sbt1-save:
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: bash
+        working-directory: __tests__/cache/sbt
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-15-intel, windows-latest, ubuntu-22.04]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Run setup-java with the cache for sbt
+        uses: ./
+        id: setup-java
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+          cache: sbt
+          cache-dependency-path: __tests__/cache/sbt/*.sbt
+      - name: Setup SBT
+        if: matrix.os == 'macos-15-intel'
+        run: |
+          echo ""Installing SBT...""
+          brew install sbt
+      - name: Create files to cache
+        run: sbt update
+
+      - name: Check files to cache on macos-latest
+        if: matrix.os == 'macos-15-intel'
+        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/Library/Caches/Coursier"
+      - name: Check files to cache on windows-latest
+        if: matrix.os == 'windows-latest'
+        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/AppData/Local/Coursier/Cache"
+      - name: Check files to cache on ubuntu-latest
+        if: matrix.os == 'ubuntu-22.04'
+        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/.cache/coursier"
+  sbt1-restore:
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: bash
+        working-directory: __tests__/cache/sbt
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-15-intel, windows-latest, ubuntu-22.04]
+    needs: sbt1-save
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Run setup-java with the cache for sbt
+        uses: ./
+        id: setup-java
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+          cache: sbt
+          cache-dependency-path: __tests__/cache/sbt/*.sbt
+
+      - name: Confirm that ~/Library/Caches/Coursier directory has been made
+        if: matrix.os == 'macos-15-intel'
+        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/Library/Caches/Coursier"
+      - name: Confirm that ~/AppData/Local/Coursier/Cache directory has been made
+        if: matrix.os == 'windows-latest'
+        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/AppData/Local/Coursier/Cache"
+      - name: Confirm that ~/.cache/coursier directory has been made
+        if: matrix.os == 'ubuntu-22.04'
+        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/.cache/coursier"
+  sbt2-restore:
+    runs-on: ${{ matrix.os }}
+    defaults:
+      run:
+        shell: bash
+        working-directory: __tests__/cache/sbt2
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-15-intel, windows-latest, ubuntu-22.04]
+    needs: sbt1-save
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Run setup-java with the cache for sbt
+        uses: ./
+        id: setup-java
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+          cache: sbt
+          cache-dependency-path: __tests__/cache/sbt2/*.sbt
+
+      - name: Confirm that ~/Library/Caches/Coursier directory has not been made
+        if: matrix.os == 'macos-15-intel'
+        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/Library/Caches/Coursier" absent
+      - name: Confirm that ~/AppData/Local/Coursier/Cache directory has not been made
+        if: matrix.os == 'windows-latest'
+        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/AppData/Local/Coursier/Cache" absent
+      - name: Confirm that ~/.cache/coursier directory has not been made
+        if: matrix.os == 'ubuntu-22.04'
+        run: bash "$GITHUB_WORKSPACE/__tests__/check-dir.sh" "$HOME/.cache/coursier" absent
+  custom-maven-path-save:
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Run setup-java with a custom Maven cache path
+        uses: ./
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+          cache: maven
+          cache-dependency-path: |
+            __tests__/cache/maven2/pom.xml
+            .github/workflows/e2e-cache.yml
+          cache-path: |
+            ${{ runner.temp }}/setup-java-custom-maven-repository
+            !${{ runner.temp }}/setup-java-custom-maven-repository/**/*.lastUpdated
+      - name: Populate the custom Maven repository
+        run: |
+          mvn -Dmaven.repo.local="$RUNNER_TEMP/setup-java-custom-maven-repository" verify -f __tests__/cache/maven2/pom.xml
+          touch "$RUNNER_TEMP/setup-java-custom-maven-repository/setup-java-cache-path-marker"
+          bash __tests__/check-dir.sh "$RUNNER_TEMP/setup-java-custom-maven-repository"
+  custom-maven-path-restore:
+    runs-on: ubuntu-latest
+    needs: custom-maven-path-save
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Run setup-java with a custom Maven cache path
+        uses: ./
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+          cache: maven
+          cache-dependency-path: |
+            __tests__/cache/maven2/pom.xml
+            .github/workflows/e2e-cache.yml
+          cache-path: |
+            ${{ runner.temp }}/setup-java-custom-maven-repository
+            !${{ runner.temp }}/setup-java-custom-maven-repository/**/*.lastUpdated
+          cache-read-only: true
+      - name: Confirm that the custom Maven repository has been restored
+        run: test -f "$RUNNER_TEMP/setup-java-custom-maven-repository/setup-java-cache-path-marker"

.github/workflows/e2e-local-file.yml

@@ -0,0 +1,99 @@
+name: Validate local file
+
+on:
+  push:
+    branches:
+      - main
+      - releases/*
+    paths-ignore:
+      - '**.md'
+  pull_request:
+    paths-ignore:
+      - '**.md'
+
+permissions:
+  contents: read
+
+jobs:
+  setup-java-local-file-zulu:
+    name: Validate installation from local file Zulu
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, windows-latest, ubuntu-latest]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Download Zulu OpenJDK file
+        run: |
+          if ($IsLinux) {
+            $downloadUrl = "https://cdn.azul.com/zulu/bin/zulu11.2.3-jdk11.0.1-linux_x64.tar.gz"
+            $localFilename = "java_package.tar.gz"
+          } elseif ($IsMacOS) {
+            $downloadUrl = "https://cdn.azul.com/zulu/bin/zulu11.2.3-jdk11.0.1-macosx_x64.tar.gz"
+            $localFilename = "java_package.tar.gz"
+          } elseif ($IsWindows) {
+            $downloadUrl = "https://cdn.azul.com/zulu/bin/zulu11.45.27-ca-jdk11.0.10-win_x64.zip"
+            $localFilename = "java_package.zip"
+          }
+          echo "LocalFilename=$localFilename" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+          (New-Object System.Net.WebClient).DownloadFile($downloadUrl, "$env:RUNNER_TEMP/$localFilename")
+        shell: pwsh
+      - name: setup-java
+        uses: ./
+        id: setup-java
+        with:
+          distribution: 'jdkfile'
+          jdk-file: ${{ runner.temp }}/${{ env.LocalFilename }}
+          java-version: '11.0.0-ea'
+          architecture: x64
+      - name: Verify Java version
+        env:
+          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
+        run: bash __tests__/verify-java.sh "11.0" "$JAVA_PATH"
+        shell: bash
+
+  setup-java-local-file-temurin:
+    name: Validate installation from local file Eclipse Temurin
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, windows-latest, ubuntu-latest]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Download Eclipse Temurin file
+        run: |
+          if ($IsLinux) {
+            $downloadUrl = "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.12%2B7/OpenJDK11U-jdk_x64_linux_hotspot_11.0.12_7.tar.gz"
+            $localFilename = "java_package.tar.gz"
+          } elseif ($IsMacOS) {
+            $downloadUrl = "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.12%2B7/OpenJDK11U-jdk_x64_mac_hotspot_11.0.12_7.tar.gz"
+            $localFilename = "java_package.tar.gz"
+          } elseif ($IsWindows) {
+            $downloadUrl = "https://github.com/adoptium/temurin11-binaries/releases/download/jdk-11.0.12%2B7/OpenJDK11U-jdk_x64_windows_hotspot_11.0.12_7.zip"
+            $localFilename = "java_package.zip"
+          }
+          echo "LocalFilename=$localFilename" | Out-File -FilePath $env:GITHUB_ENV -Encoding utf8 -Append
+          (New-Object System.Net.WebClient).DownloadFile($downloadUrl, "$env:RUNNER_TEMP/$localFilename")
+        shell: pwsh
+      - name: setup-java
+        uses: ./
+        id: setup-java
+        with:
+          distribution: 'jdkfile'
+          # Intentionally uses the deprecated `jdkFile` alias to keep it covered.
+          jdkFile: ${{ runner.temp }}/${{ env.LocalFilename }}
+          java-version: '11.0.0-ea'
+          architecture: x64
+      - name: Verify Java version
+        env:
+          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
+        run: bash __tests__/verify-java.sh "11.0.12" "$JAVA_PATH"
+        shell: bash

.github/workflows/e2e-publishing.yml

@@ -0,0 +1,176 @@
+name: Validate publishing functionality
+
+on:
+  push:
+    branches:
+      - main
+      - releases/*
+    paths-ignore:
+      - '**.md'
+  pull_request:
+    paths-ignore:
+      - '**.md'
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: pwsh
+
+jobs:
+  setup-java-publishing:
+    name: Validate settings.xml
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, windows-latest, ubuntu-latest]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: setup-java
+        uses: ./
+        id: setup-java
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+          server-id: maven
+          server-username-env-var: MAVEN_USERNAME
+          server-password-env-var: MAVEN_CENTRAL_TOKEN
+          gpg-passphrase-env-var: MAVEN_GPG_PASSPHRASE
+      - name: Validate settings.xml
+        run: |
+          $xmlPath = Join-Path $HOME ".m2" "settings.xml"
+          Get-Content $xmlPath | ForEach-Object { Write-Host $_ }
+
+          $content = [System.IO.File]::ReadAllText($xmlPath)
+          $expected = @(
+            '<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"'
+            '  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"'
+            '  xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 https://maven.apache.org/xsd/settings-1.0.0.xsd">'
+            '  <interactiveMode>false</interactiveMode>'
+            '  <servers>'
+            '    <server>'
+            '      <id>maven</id>'
+            '      <username>${env.MAVEN_USERNAME}</username>'
+            '      <password>${env.MAVEN_CENTRAL_TOKEN}</password>'
+            '    </server>'
+            '  </servers>'
+            '</settings>'
+          ) -join "`n"
+
+          if ($content -ne $expected) {
+            Write-Host "Expected settings.xml:"
+            $expected -split "`n" | ForEach-Object { Write-Host $_ }
+            throw "Generated XML file is incorrect"
+          }
+
+  test-publishing-overwrite:
+    name: settings.xml is overwritten if flag is true
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, windows-latest, ubuntu-latest]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Create fake settings.xml
+        run: |
+          $xmlDirectory = Join-Path $HOME ".m2"
+          $xmlPath = Join-Path $xmlDirectory "settings.xml"
+          New-Item -Path $xmlDirectory -ItemType Directory
+          Set-Content -Path $xmlPath -Value "Fake_XML"
+      - name: setup-java
+        uses: ./
+        id: setup-java
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+          server-id: maven
+          server-username-env-var: MAVEN_USERNAME
+          server-password-env-var: MAVEN_CENTRAL_TOKEN
+          gpg-passphrase-env-var: MAVEN_GPG_PASSPHRASE
+      - name: Validate settings.xml is overwritten
+        run: |
+          $xmlPath = Join-Path $HOME ".m2" "settings.xml"
+          Get-Content $xmlPath | ForEach-Object { Write-Host $_ }
+
+          $content = Get-Content $xmlPath -Raw
+          if ($content -notlike '*maven*') {
+            throw "settings.xml file is not overwritten"
+          }
+
+  test-publishing-skip-overwrite:
+    name: settings.xml is not overwritten if flag is false
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, windows-latest, ubuntu-latest]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Create fake settings.xml
+        run: |
+          $xmlDirectory = Join-Path $HOME ".m2"
+          $xmlPath = Join-Path $xmlDirectory "settings.xml"
+          New-Item -Path $xmlDirectory -ItemType Directory
+          Set-Content -Path $xmlPath -Value "Fake_XML"
+      - name: setup-java
+        uses: ./
+        id: setup-java
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+          server-id: maven
+          server-username-env-var: MAVEN_USERNAME
+          server-password-env-var: MAVEN_CENTRAL_TOKEN
+          overwrite-settings: false
+          gpg-passphrase-env-var: MAVEN_GPG_PASSPHRASE
+      - name: Validate that settings.xml is not overwritten
+        run: |
+          $xmlPath = Join-Path $HOME ".m2" "settings.xml"
+          $content = Get-Content -Path $xmlPath -Raw
+          Write-Host $content
+
+          if ($content -notlike "*Fake_XML*") {
+            throw "settings.xml file was overwritten but it should not be"
+          }
+
+  test-publishing-custom-location:
+    name: settings.xml in custom location
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-latest, windows-latest, ubuntu-latest]
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: setup-java
+        uses: ./
+        id: setup-java
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+          server-id: maven
+          server-username-env-var: MAVEN_USERNAME
+          server-password-env-var: MAVEN_CENTRAL_TOKEN
+          gpg-passphrase-env-var: MAVEN_GPG_PASSPHRASE
+          settings-path: ${{ runner.temp }}
+      - name: Validate settings.xml location
+        run: |
+          $path = Join-Path $env:RUNNER_TEMP "settings.xml"
+          if (-not (Test-Path $path)) {
+            throw "settings.xml file is not found in expected location"
+          }

.github/workflows/e2e-smoke.yml

@@ -0,0 +1,87 @@
+name: Validate Java e2e smoke
+
+on:
+  push:
+    branches:
+      - main
+    paths-ignore:
+      - '**.md'
+  pull_request:
+    paths-ignore:
+      - '**.md'
+
+permissions:
+  contents: read
+
+jobs:
+  setup-java:
+    name: ${{ matrix.distribution }} ${{ matrix.version }} (${{ matrix.java-package }}) - ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - os: macos-latest
+            distribution: temurin
+            version: '11'
+            java-package: jdk
+          - os: windows-latest
+            distribution: temurin
+            version: '17'
+            java-package: jdk
+          - os: ubuntu-latest
+            distribution: temurin
+            version: '21'
+            java-package: jdk
+          - os: macos-latest
+            distribution: temurin
+            version: '25'
+            java-package: jdk
+          - os: windows-latest
+            distribution: temurin
+            version: '25'
+            java-package: jdk
+          - os: ubuntu-latest
+            distribution: temurin
+            version: '25'
+            java-package: jdk
+          - os: macos-latest
+            distribution: microsoft
+            version: '25'
+            java-package: jdk
+          - os: windows-latest
+            distribution: microsoft
+            version: '25'
+            java-package: jdk
+          - os: ubuntu-latest
+            distribution: microsoft
+            version: '25'
+            java-package: jdk
+          - os: ubuntu-latest
+            distribution: zulu
+            version: '17'
+            java-package: jre
+          - os: ubuntu-latest
+            distribution: liberica
+            version: '21'
+            java-package: jdk+fx
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: setup-java
+        uses: ./
+        id: setup-java
+        with:
+          java-version: ${{ matrix.version }}
+          java-package: ${{ matrix.java-package }}
+          distribution: ${{ matrix.distribution }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Verify Java
+        env:
+          JAVA_VERSION: ${{ matrix.version }}
+          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
+        run: bash __tests__/verify-java.sh "$JAVA_VERSION" "$JAVA_PATH"
+        shell: bash

.github/workflows/e2e-versions.yml

@@ -0,0 +1,716 @@
+name: Validate Java e2e
+
+on:
+  push:
+    branches:
+      - releases/*
+    paths-ignore:
+      - '**.md'
+  schedule:
+    - cron: '0 */12 * * *'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  setup-java-major-versions:
+    name: ${{ matrix.distribution }} ${{ matrix.version }} (jdk-${{ contains(matrix.os, 'macos') && !contains(matrix.os, 'intel') && 'arm64' || 'x64' }}) - ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-15-intel, windows-latest, ubuntu-latest]
+        distribution:
+          [
+            'temurin',
+            'zulu',
+            'liberica',
+            'microsoft',
+            'semeru',
+            'corretto',
+            'dragonwell',
+            'sapmachine',
+            'jetbrains',
+            'kona',
+            'liberica-nik'
+          ]
+        version: ['21', '11', '17']
+        exclude:
+          - distribution: microsoft
+            version: 8
+          - distribution: dragonwell
+            os: macos-15-intel
+        include:
+          - distribution: microsoft
+            os: windows-latest
+            version: 25
+          - distribution: microsoft
+            os: ubuntu-latest
+            version: 25
+          - distribution: microsoft
+            os: macos-latest
+            version: 25
+          - distribution: kona
+            os: windows-latest
+            version: 25
+          - distribution: kona
+            os: ubuntu-latest
+            version: 25
+          - distribution: kona
+            os: macos-latest
+            version: 25
+          - distribution: liberica-nik
+            os: windows-latest
+            version: 25
+          - distribution: liberica-nik
+            os: ubuntu-latest
+            version: 25
+          - distribution: liberica-nik
+            os: macos-latest
+            version: 25
+          - distribution: oracle
+            os: macos-15-intel
+            version: 17
+          - distribution: oracle
+            os: windows-latest
+            version: 21
+          - distribution: oracle
+            os: ubuntu-latest
+            version: 21
+          - distribution: oracle-openjdk
+            os: macos-15-intel
+            version: 21
+          - distribution: oracle-openjdk
+            os: windows-latest
+            version: 21
+          - distribution: oracle-openjdk
+            os: ubuntu-latest
+            version: 21
+          - distribution: graalvm
+            os: macos-latest
+            version: 17.0.12
+          - distribution: graalvm
+            os: windows-latest
+            version: 21
+          - distribution: graalvm
+            os: ubuntu-latest
+            version: 21
+          - distribution: graalvm
+            os: ubuntu-latest
+            version: '24-ea'
+    steps:
+      - &checkout_step
+        name: Checkout
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: setup-java
+        uses: ./
+        id: setup-java
+        with:
+          java-version: ${{ matrix.version }}
+          distribution: ${{ matrix.distribution }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Verify Java
+        env:
+          JAVA_VERSION: ${{ matrix.version }}
+          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
+          SETUP_JAVA_VERSION: ${{ steps.setup-java.outputs.version }}
+          REQUIRE_CONCRETE_VERSION: ${{ (matrix.distribution == 'oracle' || matrix.distribution == 'graalvm') && !contains(matrix.version, '.') && !contains(matrix.version, '-ea') }}
+        run: bash __tests__/verify-java.sh "$JAVA_VERSION" "$JAVA_PATH" "$SETUP_JAVA_VERSION" "$REQUIRE_CONCRETE_VERSION"
+        shell: bash
+
+  setup-java-checksum-verification:
+    name: Corretto checksum verification - ubuntu-latest
+    runs-on: ubuntu-latest
+    steps:
+      - *checkout_step
+      - name: setup-java with forced download
+        uses: ./
+        id: setup-java
+        with:
+          java-version: '21'
+          distribution: corretto
+          force-download: true
+      - name: Verify Java
+        env:
+          JAVA_VERSION: '21'
+          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
+        run: bash __tests__/verify-java.sh "$JAVA_VERSION" "$JAVA_PATH"
+        shell: bash
+
+  setup-java-alpine-linux:
+    name: ${{ matrix.distribution }} ${{ matrix.version }} (jdk-${{ contains(matrix.os, 'macos') && !contains(matrix.os, 'intel') && 'arm64' || 'x64' }}) - alpine-linux - ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    container:
+      image: alpine:3.21
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest]
+        distribution: ['temurin', 'sapmachine']
+        version: ['21', '17']
+    steps:
+      - *checkout_step
+      - name: Install bash
+        run: apk add --no-cache bash
+      - name: setup-java
+        uses: ./
+        id: setup-java
+        with:
+          java-version: ${{ matrix.version }}
+          distribution: ${{ matrix.distribution }}
+      - name: Verify Java
+        env:
+          JAVA_VERSION: ${{ matrix.version }}
+          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
+        run: bash __tests__/verify-java.sh "$JAVA_VERSION" "$JAVA_PATH"
+        shell: bash
+
+  setup-java-major-minor-versions:
+    name: ${{ matrix.distribution }} ${{ matrix.version }} (jdk-${{ contains(matrix.os, 'macos') && !contains(matrix.os, 'intel') && 'arm64' || 'x64' }}) - ${{ matrix.os }}
+    needs: setup-java-major-versions
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: &default_os [macos-latest, windows-latest, ubuntu-latest]
+        distribution: ['temurin', 'zulu', 'liberica']
+        version:
+          - '11.0'
+          - '21.0'
+          - '17.0.7+7'
+        include:
+          - distribution: oracle
+            os: ubuntu-latest
+            version: '21.0.4'
+          - distribution: graalvm
+            os: ubuntu-latest
+            version: '21.0.4'
+          - distribution: dragonwell
+            os: ubuntu-latest
+            version: '11.0'
+          - distribution: dragonwell
+            os: ubuntu-latest
+            version: '11.0.13+9'
+          - distribution: sapmachine
+            os: ubuntu-latest
+            version: '17.0.7'
+          - distribution: jetbrains
+            os: ubuntu-latest
+            version: '11.0.11'
+          - distribution: jetbrains
+            os: ubuntu-latest
+            version: '17.0.7'
+    steps:
+      - *checkout_step
+      - name: setup-java
+        uses: ./
+        id: setup-java
+        with:
+          java-version: ${{ matrix.version }}
+          distribution: ${{ matrix.distribution }}
+      - name: Verify Java
+        env:
+          JAVA_VERSION: ${{ matrix.version }}
+          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: bash __tests__/verify-java.sh "$JAVA_VERSION" "$JAVA_PATH"
+        shell: bash
+
+  setup-java-check-latest:
+    name: ${{ matrix.distribution }} ${{ matrix.version }} - check-latest flag - ${{ matrix.os }}
+    needs: setup-java-major-versions
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: *default_os
+        distribution:
+          [
+            'temurin',
+            'zulu',
+            'liberica',
+            'dragonwell',
+            'sapmachine',
+            'jetbrains'
+          ]
+        exclude:
+          - distribution: dragonwell
+            os: macos-latest
+    steps:
+      - *checkout_step
+      - name: setup-java
+        uses: ./
+        id: setup-java
+        with:
+          distribution: ${{ matrix.distribution }}
+          java-version: 11
+          check-latest: true
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Verify Java
+        env:
+          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
+        run: bash __tests__/verify-java.sh "11" "$JAVA_PATH"
+        shell: bash
+
+  setup-java-multiple-jdks:
+    name: ${{ matrix.distribution }} ${{ matrix.version }} - multiple jdks - ${{ matrix.os }}
+    needs: setup-java-major-versions
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: *default_os
+        distribution:
+          [
+            'temurin',
+            'zulu',
+            'liberica',
+            'dragonwell',
+            'sapmachine',
+            'jetbrains'
+          ]
+        exclude:
+          - distribution: dragonwell
+            os: macos-latest
+    steps:
+      - *checkout_step
+      - name: setup-java
+        uses: ./
+        id: setup-java
+        with:
+          distribution: ${{ matrix.distribution }}
+          java-version: |
+            11
+            17
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Verify Java env variables
+        run: |
+          $javaArch = if ($env:RUNNER_ARCH -eq "ARM64") { "AARCH64" } else { $env:RUNNER_ARCH }
+          $versionsArr = "11","17"
+          foreach ($version in $versionsArr)
+          {
+            $envName = "JAVA_HOME_${version}_${javaArch}"
+            $JavaVersionPath = [Environment]::GetEnvironmentVariable($envName)
+            if (-not (Test-Path "$JavaVersionPath")) {
+              Write-Host "$envName is not found"
+              exit 1
+            }
+          }
+        shell: pwsh
+      - name: Verify Java
+        env:
+          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
+        run: bash __tests__/verify-java.sh "17" "$JAVA_PATH"
+        shell: bash
+
+  setup-java-ea-versions:
+    name: ${{ matrix.distribution }} ${{ matrix.version }} (jdk-${{ contains(matrix.os, 'macos') && !contains(matrix.os, 'intel') && 'arm64' || 'x64' }}) - ${{ matrix.os }}
+    needs: setup-java-major-minor-versions
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        include:
+          - {os: macos-15-intel, version: '17-ea', distribution: zulu}
+          - {os: windows-latest, version: '17-ea', distribution: zulu}
+          - {os: ubuntu-latest, version: '17-ea', distribution: zulu}
+          - {os: macos-15-intel, version: '15.0.0-ea.14', distribution: zulu}
+          - {os: windows-latest, version: '15.0.0-ea.14', distribution: zulu}
+          - {os: ubuntu-latest, version: '15.0.0-ea.14', distribution: zulu}
+          - {os: macos-latest, version: '17-ea', distribution: temurin}
+          - {os: windows-latest, version: '17-ea', distribution: temurin}
+          - {os: ubuntu-latest, version: '17-ea', distribution: temurin}
+          - {os: macos-latest, version: '17-ea', distribution: sapmachine}
+          - {os: windows-latest, version: '17-ea', distribution: sapmachine}
+          - {os: ubuntu-latest, version: '17-ea', distribution: sapmachine}
+          - {os: macos-latest, version: '21-ea', distribution: sapmachine}
+          - {os: windows-latest, version: '21-ea', distribution: sapmachine}
+          - {os: ubuntu-latest, version: '21-ea', distribution: sapmachine}
+    steps:
+      - *checkout_step
+      - name: setup-java
+        uses: ./
+        id: setup-java
+        with:
+          java-version: ${{ matrix.version }}
+          distribution: ${{ matrix.distribution }}
+      - name: Verify Java
+        env:
+          JAVA_VERSION: ${{ matrix.version }}
+          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
+        run: bash __tests__/verify-java.sh "$JAVA_VERSION" "$JAVA_PATH"
+        shell: bash
+
+  setup-java-signature-verification:
+    name: ${{ matrix.distribution }} ${{ matrix.version }} signature verification - ${{ matrix.os }}
+    needs: setup-java-major-minor-versions
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: *default_os
+        version: ['21', '17']
+        distribution: [temurin, microsoft]
+    steps:
+      - *checkout_step
+      - name: setup-java with signature verification
+        uses: ./
+        id: setup-java
+        with:
+          java-version: ${{ matrix.version }}
+          distribution: ${{ matrix.distribution }}
+          verify-signature: true
+      - name: Verify Java
+        env:
+          JAVA_VERSION: ${{ matrix.version }}
+          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
+        run: bash __tests__/verify-java.sh "$JAVA_VERSION" "$JAVA_PATH"
+        shell: bash
+
+  setup-java-custom-package-type:
+    name: ${{ matrix.distribution }} ${{ matrix.version }} (${{ matrix.java-package }}-x64) - ${{ matrix.os }}
+    needs: setup-java-major-minor-versions
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [macos-15-intel, windows-latest, ubuntu-latest]
+        distribution:
+          ['temurin', 'zulu', 'liberica', 'semeru', 'sapmachine', 'jetbrains']
+        java-package: ['jre']
+        version: ['17.0']
+        include:
+          - distribution: 'zulu'
+            java-package: jre+fx
+            version: '21'
+            os: ubuntu-latest
+          - distribution: 'zulu'
+            java-package: jdk+fx
+            version: '21.0'
+            os: ubuntu-latest
+          - distribution: 'liberica'
+            java-package: jdk+fx
+            version: '21'
+            os: ubuntu-latest
+          - distribution: 'liberica'
+            java-package: jre+fx
+            version: '11'
+            os: ubuntu-latest
+          - distribution: 'liberica-nik'
+            java-package: jdk+fx
+            version: '21'
+            os: ubuntu-latest
+          - distribution: 'corretto'
+            java-package: jre
+            version: '8'
+            os: windows-latest
+          - distribution: 'jetbrains'
+            java-package: jdk+jcef
+            version: '11'
+            os: ubuntu-latest
+          - distribution: 'jetbrains'
+            java-package: jdk+jcef
+            version: '17'
+            os: ubuntu-latest
+          - distribution: 'jetbrains'
+            java-package: jdk+jcef
+            version: '21'
+            os: ubuntu-latest
+          - distribution: 'jetbrains'
+            java-package: jre+jcef
+            version: '11'
+            os: ubuntu-latest
+          - distribution: 'jetbrains'
+            java-package: jre+jcef
+            version: '17'
+            os: ubuntu-latest
+          - distribution: 'jetbrains'
+            java-package: jre+jcef
+            version: '21'
+            os: ubuntu-latest
+          - distribution: 'jetbrains'
+            java-package: jdk+ft
+            version: '17'
+            os: ubuntu-latest
+          - distribution: 'jetbrains'
+            java-package: jdk+ft
+            version: '21'
+            os: ubuntu-latest
+          - distribution: 'jetbrains'
+            java-package: jre+ft
+            version: '17'
+            os: ubuntu-latest
+          - distribution: 'jetbrains'
+            java-package: jre+ft
+            version: '21'
+            os: ubuntu-latest
+
+    steps:
+      - *checkout_step
+      - name: setup-java
+        uses: ./
+        id: setup-java
+        with:
+          java-version: ${{ matrix.version }}
+          java-package: ${{ matrix.java-package }}
+          distribution: ${{ matrix.distribution }}
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Verify Java
+        env:
+          JAVA_VERSION: ${{ matrix.version }}
+          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
+        run: bash __tests__/verify-java.sh "$JAVA_VERSION" "$JAVA_PATH"
+        shell: bash
+
+  # Only Liberica and Zulu provide x86
+  setup-java-x86:
+    name: ${{ matrix.distribution }} ${{ matrix.version }} (jdk-${{ matrix.architecture }}) - ${{ matrix.os }}
+    needs: setup-java-major-minor-versions
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        # x86 is not supported on macOS
+        os: [windows-latest, ubuntu-22.04]
+        distribution: ['liberica', 'zulu', 'corretto']
+        version: ['11']
+    steps:
+      - *checkout_step
+      - name: setup-java
+        uses: ./
+        id: setup-java
+        with:
+          distribution: ${{ matrix.distribution }}
+          java-version: ${{ matrix.version }}
+          architecture: 'x86'
+      - name: Verify Java
+        env:
+          JAVA_VERSION: ${{ matrix.version }}
+          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
+        run: bash __tests__/verify-java.sh "$JAVA_VERSION" "$JAVA_PATH"
+        shell: bash
+
+  setup-java-unsupported-platform:
+    name: Reject unsupported Oracle x86 on Linux
+    runs-on: ubuntu-latest
+    steps:
+      - *checkout_step
+      - name: Attempt unsupported setup
+        id: unsupported-setup
+        continue-on-error: true
+        uses: ./
+        with:
+          distribution: oracle
+          java-version: '21'
+          architecture: x86
+      - name: Verify setup was rejected
+        if: always()
+        env:
+          SETUP_OUTCOME: ${{ steps.unsupported-setup.outcome }}
+        run: test "$SETUP_OUTCOME" = failure
+
+  setup-java-version-both-version-inputs-presents:
+    name: ${{ matrix.distribution }} version (should be from input) - ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: *default_os
+        distribution: ['temurin', 'microsoft', 'corretto']
+        java-version-file: ['.java-version', '.tool-versions']
+    steps:
+      - *checkout_step
+      - name: Create .java-version file
+        shell: bash
+        run: echo "17" > .java-version
+      - name: Create .tool-versions file
+        shell: bash
+        run: echo "java 17" > .tool-versions
+      - name: setup-java
+        uses: ./
+        id: setup-java
+        with:
+          distribution: ${{ matrix.distribution }}
+          java-version: 11
+          java-version-file: ${{matrix.java-version-file }}
+      - name: Verify Java
+        env:
+          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
+        run: bash __tests__/verify-java.sh "11" "$JAVA_PATH"
+        shell: bash
+
+  setup-java-version-from-file-major-notation:
+    name: ${{ matrix.distribution }} version from file X - ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: *default_os
+        distribution: ['temurin', 'zulu', 'liberica', 'microsoft', 'corretto']
+        java-version-file: ['.java-version', '.tool-versions']
+    steps:
+      - *checkout_step
+      - name: Create .java-version file
+        shell: bash
+        run: echo "11" > .java-version
+      - name: Create .tool-versions file
+        shell: bash
+        run: echo "java 11" > .tool-versions
+      - name: setup-java
+        uses: ./
+        id: setup-java
+        with:
+          distribution: ${{ matrix.distribution }}
+          java-version-file: ${{matrix.java-version-file }}
+      - name: Verify Java
+        env:
+          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
+        run: bash __tests__/verify-java.sh "11" "$JAVA_PATH"
+        shell: bash
+
+  setup-java-version-from-file-major-minor-patch-notation:
+    name: ${{ matrix.distribution }} version from file X.Y.Z - ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: *default_os
+        distribution: ['temurin', 'zulu']
+        java-version-file: ['.java-version', '.tool-versions']
+    steps:
+      - *checkout_step
+      - name: Create .java-version file
+        shell: bash
+        run: echo "17.0.10" > .java-version
+      - name: Create .tool-versions file
+        shell: bash
+        run: echo "java 17.0.10" > .tool-versions
+      - name: setup-java
+        uses: ./
+        id: setup-java
+        with:
+          distribution: ${{ matrix.distribution }}
+          java-version-file: ${{matrix.java-version-file }}
+      - name: Verify Java
+        env:
+          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
+        run: bash __tests__/verify-java.sh "17.0.10" "$JAVA_PATH"
+        shell: bash
+
+  setup-java-version-from-file-major-minor-patch-with-dist:
+    name: ${{ matrix.distribution }} version from file '${{ matrix.java-version-file }}' - ${{ matrix.os }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: *default_os
+        distribution: ['temurin', 'zulu', 'liberica']
+        java-version-file: ['.java-version', '.tool-versions', '.sdkmanrc']
+    steps:
+      - *checkout_step
+      - name: Create .java-version file
+        shell: bash
+        run: echo "openjdk64-17.0.10" > .java-version
+      - name: Create .tool-versions file
+        shell: bash
+        run: echo "java openjdk64-17.0.10" > .tool-versions
+      - name: Create .sdkmanrc file
+        shell: bash
+        run: echo "java=17.0.10-tem" > .sdkmanrc
+      - name: setup-java
+        uses: ./
+        id: setup-java
+        with:
+          distribution: ${{ matrix.distribution }}
+          java-version-file: ${{matrix.java-version-file }}
+      - name: Verify Java
+        env:
+          JAVA_PATH: ${{ steps.setup-java.outputs.path }}
+        run: bash __tests__/verify-java.sh "17.0.10" "$JAVA_PATH"
+        shell: bash
+
+  setup-java-set-default:
+    name: set-default option - ${{ matrix.os }}
+    needs: setup-java-major-versions
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: *default_os
+    steps:
+      - *checkout_step
+      - name: Setup Java 17 as default
+        uses: ./
+        id: setup-java-17
+        with:
+          distribution: 'temurin'
+          java-version: '17'
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Setup Java 21 without setting as default
+        uses: ./
+        id: setup-java-21
+        with:
+          distribution: 'temurin'
+          java-version: '21'
+          set-default: false
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+      - name: Verify JAVA_HOME still points to Java 17
+        env:
+          JAVA_17_PATH: ${{ steps.setup-java-17.outputs.path }}
+        run: |
+          echo "JAVA_HOME=$JAVA_HOME"
+          echo "Java 17 path=$JAVA_17_PATH"
+          if [ "$JAVA_HOME" != "$JAVA_17_PATH" ]; then
+            echo "JAVA_HOME should still point to Java 17"
+            exit 1
+          fi
+        shell: bash
+      - name: Verify java -version reports Java 17
+        run: |
+          JAVA_VERSION=$(java -version 2>&1 | head -1)
+          echo "java -version: $JAVA_VERSION"
+          if ! echo "$JAVA_VERSION" | grep -q "17"; then
+            echo "Default java should still be version 17"
+            exit 1
+          fi
+        shell: bash
+      - name: Verify JAVA_HOME_21 env var is set
+        run: |
+          $javaArch = if ($env:RUNNER_ARCH -eq "ARM64") { "AARCH64" } else { $env:RUNNER_ARCH }
+          $envName = "JAVA_HOME_21_${javaArch}"
+          $JavaVersionPath = [Environment]::GetEnvironmentVariable($envName)
+          if (-not $JavaVersionPath) {
+            Write-Host "$envName is not set"
+            exit 1
+          }
+          if (-not (Test-Path "$JavaVersionPath")) {
+            Write-Host "$envName path does not exist: $JavaVersionPath"
+            exit 1
+          }
+          Write-Host "$envName=$JavaVersionPath"
+        shell: pwsh
+      - name: Verify Java 21 outputs are set
+        env:
+          JAVA_21_PATH: ${{ steps.setup-java-21.outputs.path }}
+          JAVA_21_VERSION: ${{ steps.setup-java-21.outputs.version }}
+        run: |
+          echo "Java 21 path=$JAVA_21_PATH"
+          echo "Java 21 version=$JAVA_21_VERSION"
+          if [ -z "$JAVA_21_PATH" ]; then
+            echo "Java 21 path output should be set"
+            exit 1
+          fi
+          if [ -z "$JAVA_21_VERSION" ]; then
+            echo "Java 21 version output should be set"
+            exit 1
+          fi
+        shell: bash

.github/workflows/licensed.yml

@@ -0,0 +1,18 @@
+name: Licensed
+
+on:
+  push:
+    branches:
+      - main
+  pull_request:
+    branches:
+      - main
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  call-licensed:
+    name: Licensed
+    uses: actions/reusable-workflows/.github/workflows/licensed.yml@main

.github/workflows/publish-immutable-actions.yml

@@ -0,0 +1,25 @@
+name: 'Publish Immutable Action Version'
+
+on:
+  release:
+    types: [released]
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  publish:
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      id-token: write
+      packages: write
+
+    steps:
+      - name: Checking out
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Publish
+        id: publish
+        uses: actions/publish-immutable-action@v0.0.4

.github/workflows/release-new-action-version.yml

@@ -0,0 +1,29 @@
+name: Release new action version
+
+on:
+  release:
+    types: [released]
+  workflow_dispatch:
+    inputs:
+      TAG_NAME:
+        description: 'Tag name that the major tag will point to'
+        required: true
+
+env:
+  TAG_NAME: ${{ github.event.inputs.TAG_NAME || github.event.release.tag_name }}
+permissions:
+  contents: write
+
+jobs:
+  update_tag:
+    name: Update the major tag to include the ${{ github.event.inputs.TAG_NAME || github.event.release.tag_name }} changes
+    environment:
+      name: releaseNewActionVersion
+    runs-on: ubuntu-latest
+    steps:
+      - name: Update the ${{ env.TAG_NAME }} tag
+        id: update-major-tag
+        uses: actions/publish-action@v0.4.0
+        with:
+          source-tag: ${{ env.TAG_NAME }}
+          slack-webhook: ${{ secrets.SLACK_WEBHOOK }}

.github/workflows/update-config-files.yml

@@ -0,0 +1,16 @@
+name: Update configuration files
+
+on:
+  schedule:
+    - cron: '0 3 * * 0'
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  call-update-configuration-files:
+    name: Update configuration files
+    permissions:
+      contents: write # to push the branch with updated configuration files
+      pull-requests: write # to open/update the configuration update PR
+    uses: actions/reusable-workflows/.github/workflows/update-config-files.yml@main

.github/workflows/workflow.yml

@@ -1,26 +0,0 @@
-name: Main workflow
-on: [push]
-jobs:
-  run:
-    name: Run
-    runs-on: ${{ matrix.operating-system }}
-    strategy:
-      matrix:
-        operating-system: [ubuntu-latest, windows-latest]
-    steps:
-    - name: Checkout
-      uses: actions/checkout@master
-
-    - name: Set Node.js 10.x
-      uses: actions/setup-node@master
-      with:
-        version: 10.x
-
-    - name: npm install
-      run: npm install
-
-    - name: Lint
-      run: npm run format-check
-
-    - name: npm test
-      run: npm test

.github/workflows/zizmor.yml

@@ -0,0 +1,48 @@
+name: Security analysis with zizmor
+
+on:
+  push:
+    branches:
+      - main
+      - releases/*
+    paths-ignore:
+      - '**.md'
+  pull_request:
+    paths-ignore:
+      - '**.md'
+  workflow_dispatch:
+
+permissions: {}
+
+jobs:
+  zizmor:
+    name: Analyze workflows with zizmor
+    runs-on: ubuntu-latest
+    permissions:
+      contents: read
+      security-events: write # to upload SARIF results to code scanning
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+
+      - name: Set up Python
+        uses: actions/setup-python@v7
+        with:
+          python-version: '3.x'
+
+      - name: Install zizmor
+        run: pip install zizmor
+
+      - name: Run zizmor
+        run: zizmor --format sarif .github/workflows/ > zizmor.sarif
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+
+      - name: Upload SARIF results to code scanning
+        if: always() && (github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository)
+        uses: github/codeql-action/upload-sarif@v4
+        with:
+          sarif_file: zizmor.sarif
+          category: zizmor

.github/zizmor.yml

@@ -0,0 +1,11 @@
+# Configuration for zizmor (https://docs.zizmor.sh)
+rules:
+  unpinned-uses:
+    config:
+      # First-party GitHub-maintained actions are trusted and referenced by
+      # major-version tags (the convention used across the actions org).
+      # Any third-party action must be pinned to a full commit SHA.
+      policies:
+        actions/*: ref-pin
+        github/*: ref-pin
+        '*': hash-pin

.gitignore

@@ -1,7 +1,10 @@
-# Explicitly not ignoring node_modules so that they are included in package downloaded by runner
-!node_modules/
+# Ignore node_modules, ncc is used to compile nodejs modules into a single file
+node_modules/
 __tests__/runner/*
 
+# Ignore js files that are transpiled from ts files in src/
+lib/
+
 # Rest of the file pulled from https://github.com/github/gitignore/blob/master/Node.gitignore
 # Logs
 logs
@@ -90,3 +93,7 @@ typings/
 
 # DynamoDB Local files
 .dynamodb/
+.vscode/
+
+# IntelliJ / WebStorm
+/.idea/

.husky/pre-commit

@@ -0,0 +1 @@
+npx lint-staged

.husky/pre-push

@@ -0,0 +1 @@
+npm run build && npm test

.licensed.yml

@@ -0,0 +1,20 @@
+sources:
+  npm: true
+
+allowed:
+  - apache-2.0
+  - 0bsd
+  - bsd-2-clause
+  - bsd-3-clause
+  - isc
+  - mit
+  - cc0-1.0
+  - unlicense
+  - blueoak-1.0.0
+
+reviewed:
+  npm:
+    - "@actions/http-client" # MIT (license text present), but detected as "other"
+    - "argparse" # Python Software Foundation License (PSF), but detected as "other"
+    - "balanced-match"
+    - "brace-expansion"

.prettierignore

@@ -0,0 +1,7 @@
+# Ignore list
+/*
+
+# Do not ignore these folders:
+!__tests__/
+!.github/
+!src/

.prettierrc.json

@@ -1,11 +1,10 @@
 {
-    "printWidth": 80,
-    "tabWidth": 2,
-    "useTabs": false,
-    "semi": true,
-    "singleQuote": true,
-    "trailingComma": "none",
-    "bracketSpacing": false,
-    "arrowParens": "avoid",
-    "parser": "typescript"
-  }
+  "printWidth": 80,
+  "tabWidth": 2,
+  "useTabs": false,
+  "semi": true,
+  "singleQuote": true,
+  "trailingComma": "none",
+  "bracketSpacing": false,
+  "arrowParens": "avoid"
+}

CODE_OF_CONDUCT.md

@@ -0,0 +1,76 @@
+# Contributor Covenant Code of Conduct
+
+## Our Pledge
+
+In the interest of fostering an open and welcoming environment, we as
+contributors and maintainers pledge to make participation in our project and
+our community a harassment-free experience for everyone, regardless of age, body
+size, disability, ethnicity, sex characteristics, gender identity and expression,
+level of experience, education, socio-economic status, nationality, personal
+appearance, race, religion, or sexual identity and orientation.
+
+## Our Standards
+
+Examples of behavior that contributes to creating a positive environment
+include:
+
+* Using welcoming and inclusive language
+* Being respectful of differing viewpoints and experiences
+* Gracefully accepting constructive criticism
+* Focusing on what is best for the community
+* Showing empathy towards other community members
+
+Examples of unacceptable behavior by participants include:
+
+* The use of sexualized language or imagery and unwelcome sexual attention or
+  advances
+* Trolling, insulting/derogatory comments, and personal or political attacks
+* Public or private harassment
+* Publishing others' private information, such as a physical or electronic
+  address, without explicit permission
+* Other conduct which could reasonably be considered inappropriate in a
+  professional setting
+
+## Our Responsibilities
+
+Project maintainers are responsible for clarifying the standards of acceptable
+behavior and are expected to take appropriate and fair corrective action in
+response to any instances of unacceptable behavior.
+
+Project maintainers have the right and responsibility to remove, edit, or
+reject comments, commits, code, wiki edits, issues, and other contributions
+that are not aligned to this Code of Conduct, or to ban temporarily or
+permanently any contributor for other behaviors that they deem inappropriate,
+threatening, offensive, or harmful.
+
+## Scope
+
+This Code of Conduct applies within all project spaces, and it also applies when
+an individual is representing the project or its community in public spaces.
+Examples of representing a project or community include using an official
+project e-mail address, posting via an official social media account, or acting
+as an appointed representative at an online or offline event. Representation of
+a project may be further defined and clarified by project maintainers.
+
+## Enforcement
+
+Instances of abusive, harassing, or otherwise unacceptable behavior may be
+reported by contacting the project team at opensource+actions/setup-java@github.com. All
+complaints will be reviewed and investigated and will result in a response that
+is deemed necessary and appropriate to the circumstances. The project team is
+obligated to maintain confidentiality with regard to the reporter of an incident.
+Further details of specific enforcement policies may be posted separately.
+
+Project maintainers who do not follow or enforce the Code of Conduct in good
+faith may face temporary or permanent repercussions as determined by other
+members of the project's leadership.
+
+## Attribution
+
+This Code of Conduct is adapted from the [Contributor Covenant][homepage], version 1.4,
+available at https://www.contributor-covenant.org/version/1/4/code-of-conduct.html
+
+[homepage]: https://www.contributor-covenant.org
+
+For answers to common questions about this code of conduct, see
+https://www.contributor-covenant.org/faq

README.md

@@ -1,64 +1,519 @@
-# setup-java
+# Setup Java
 
-<p align="left">
-  <a href="https://github.com/actions/setup-java"><img alt="GitHub Actions status" src="https://github.com/actions/setup-java/workflows/Main%20workflow/badge.svg"></a>
-</p>
+[![Basic validation](https://github.com/actions/setup-java/actions/workflows/basic-validation.yml/badge.svg?branch=main)](https://github.com/actions/setup-java/actions/workflows/basic-validation.yml)
+[![Validate Java e2e](https://github.com/actions/setup-java/actions/workflows/e2e-versions.yml/badge.svg?branch=main)](https://github.com/actions/setup-java/actions/workflows/e2e-versions.yml)
+[![Validate cache](https://github.com/actions/setup-java/actions/workflows/e2e-cache.yml/badge.svg?branch=main)](https://github.com/actions/setup-java/actions/workflows/e2e-cache.yml)
 
-This action sets up a java environment for use in actions by:
+Set up Java for GitHub Actions workflows. `setup-java` installs a requested Java distribution, adds it to `PATH`, configures `JAVA_HOME`, and can optionally cache build dependencies for Apache Maven, Gradle, and sbt; generate Maven publishing configuration, verify JDK package signatures, manage multiple JDKs, and manage Maven toolchains.
 
-- optionally downloading and caching a version of java by version and adding to PATH. Downloads from [Azul's Zulu distribution](http://static.azul.com/zulu/bin/).
-- registering problem matchers for error output
-
-# Usage
-
-See [action.yml](action.yml)
-
-Basic:
 ```yaml
 steps:
-- uses: actions/checkout@latest
-- uses: actions/setup-java@v1
-  with:
-    java-version: '9.0.4' // The JDK version to make available on the path. Takes a whole or semver Jdk version, or 1.x syntax (e.g. 1.8 => Jdk 8.x)
-    architecture: x64 // (x64 or x86) - defaults to x64
-- run: java -cp java HelloWorldApp
+  - uses: actions/checkout@v7
+  - uses: actions/setup-java@v5
+    with:
+      distribution: temurin
+      java-version: '25'
+  - run: java --version
 ```
 
-From local file:
+> [!NOTE]
+> V6 is still in development on the `main` branch and is not yet recommended for production workflows. To use it, you must explicitly reference the `main` branch in your workflow, as in 
+>
+> ```yaml
+> - uses: actions/setup-java@main
+> ```
+> 
+> For production workflows, it is recommended to use the latest stable release `v5`.
+
+## Contents
+
+- [What it does](#what-it-does)
+- [What's new](#whats-new)
+- [Usage](#usage)
+- [Inputs](#inputs)
+- [Supported distributions](#supported-distributions)
+- [Supported version syntax](#supported-version-syntax)
+- [Caching](#caching)
+- [Multiple JDKs and Maven toolchains](#multiple-jdks-and-maven-toolchains)
+- [Publishing packages](#publishing-packages)
+- [Advanced usage](#advanced-usage)
+
+## What it does
+
+- Downloads and installs Java from a supported distribution.
+- Uses a requested Java version, a version file, or the `latest` stable release alias.
+- Extracts and caches a custom JDK archive from a local file.
+- Configures Maven `settings.xml`, Maven Toolchains, Maven GPG signing inputs, and environment-variable based credentials for publishing workflows.
+- Registers Java problem matchers for compiler diagnostics and uncaught exceptions.
+- Caches dependencies for Maven, Gradle, and sbt.
+- Caches downloaded JDK installations between jobs.
+- Verifies downloaded archive checksums when a distribution publishes authoritative checksums.
+- Optionally verifies package signatures for supported distributions.
+
+`setup-java` works with Java, Scala, Kotlin, Gradle, Maven, and sbt projects.
+
+## What's new
+
+### V6 (in development)
+
+- Migrated the action implementation to ESM to support the latest `@actions/*` packages.
+- Added the `oracle-openjdk` distribution for OpenJDK builds from Oracle.
+- Added `java-version: latest` to resolve the newest stable GA release from the distribution's remote metadata.
+- JDK downloads now automatically verify authoritative checksums for [supported distributions](#download-integrity-and-signatures).
+- Added `force-download: true` to bypass the tool cache and perform a reproducible fresh install.
+- Dependency caching now supports custom paths with `cache-path` and restore-only operation with `cache-read-only: true`.
+- Downloaded JDKs are now [cached](#caching-jdk-installations) automatically when `cache` is set; use `cache-jdk` to enable or disable it independently.
+- Set `problem-matcher: false` to disable Java compiler and uncaught-exception annotations.
+- GraalVM distributions now set `GRAALVM_HOME` in addition to `JAVA_HOME`.
+- Invalid boolean values, unsupported distribution/package/platform combinations, and mismatched Maven toolchain ID counts now fail with targeted errors.
+- Renamed environment-variable-name inputs so they are not mistaken for secret values:
+  - `server-username` -> `server-username-env-var`
+  - `server-password` -> `server-password-env-var`
+  - `gpg-passphrase` -> `gpg-passphrase-env-var`
+- Deprecated aliases still work, but emit warnings.
+- Maven GPG passphrases are now passed through `gpg.passphraseEnvName` instead of a deprecated `gpg.passphrase` server entry in `settings.xml`. This requires `maven-gpg-plugin` 3.2.0 or newer. See [GPG](docs/advanced-usage.md#gpg).
+- Legacy AdoptOpenJDK distributions were removed. Use `temurin` instead of `adopt` or `adopt-hotspot`, and `semeru` instead of `adopt-openj9`.
+
+### V5
+
+- Upgraded the action runtime from Node 20 to Node 24. Self-hosted runners must use version `v2.327.1` or later. See the [runner release notes](https://github.com/actions/runner/releases/tag/v2.327.1).
+- Added support for [GraalVM Community](#supported-distributions) and [Tencent Kona](#supported-distributions).
+- Expanded `java-version-file` support with `.sdkmanrc` files and automatic distribution detection from SDKMAN and asdf vendor identifiers.
+- Added optional package-signature verification for Eclipse Temurin and Microsoft Build of OpenJDK downloads.
+- Added `set-default: false` for installing a JDK without changing `JAVA_HOME` or `PATH`.
+- Improved dependency caching with separate Maven and Gradle wrapper caches, Maven extension-aware cache keys, and the `cache-primary-key` output.
+- Improved Maven and Java build behavior by preserving toolchain entries across repeated action invocations, suppressing transfer progress by default, generating non-interactive Maven settings, and matching `javac` compiler errors.
+- Renamed the `jdkFile` input to `jdk-file`; the old name remains available as a deprecated alias.
+- See the [complete V5 release history](https://github.com/actions/setup-java/releases?q=v5&expanded=true) for enhancements and fixes across all V5 releases.
+
+### Older versions
+
+> [!WARNING]
+> `actions/setup-java` versions `v1` through `v4` are deprecated. Upgrade workflows to `actions/setup-java@v5`, the latest stable release.
+
+## Usage
+
+### Install Eclipse Temurin
+
 ```yaml
 steps:
-- uses: actions/checkout@master
-- uses: actions/setup-java@v1
-  with:
-    java-version: '4.0.0'
-    architecture: x64
-    jdkFile: <path to jdkFile> # Optional - jdkFile to install java from. Useful for versions not supported by Azul
-- run: java -cp java HelloWorldApp
+  - uses: actions/checkout@v7
+  - uses: actions/setup-java@v5
+    with:
+      distribution: temurin
+      java-version: '25'
+  - run: java --version
 ```
 
-Matrix Testing:
+### Install Microsoft Build of OpenJDK
+
+```yaml
+steps:
+  - uses: actions/checkout@v7
+  - uses: actions/setup-java@v5
+    with:
+      distribution: microsoft
+      java-version: '25'
+  - run: java --version
+```
+
+### Read the version from a file
+
+```yaml
+steps:
+  - uses: actions/checkout@v7
+  - uses: actions/setup-java@v5
+    with:
+      distribution: temurin
+      java-version-file: .java-version
+  - run: java --version
+```
+
+Supported version files are `.java-version`, `.tool-versions`, and `.sdkmanrc`. A `.sdkmanrc` file can also provide the distribution when it contains a recognized suffix, such as `java=21.0.5-tem`.
+
+### Use the newest stable Java
+
+```yaml
+steps:
+  - uses: actions/checkout@v7
+  - uses: actions/setup-java@v5
+    with:
+      distribution: temurin
+      java-version: latest
+  - run: java --version
+```
+
+`latest` resolves the newest stable GA release from remote metadata rather than from the runner tool cache. Distributions that do not publish a release listing (such as `oracle` and `graalvm`) resolve the newest GA feature version from the Adoptium available-releases API and then request that version from their own catalog. `latest` is not supported with `java-version-file`, early-access versions, or `distribution: jdkfile`.
+
+## Inputs
+
+| Input | Description | Default |
+| --- | --- | --- |
+| `java-version` | Java version to install. Supports whole versions, semver ranges, early-access versions, and `latest`. Required unless `java-version-file` is set. | |
+| `java-version-file` | Path to `.java-version`, `.tool-versions`, or `.sdkmanrc`. Used when `java-version` is not set. | |
+| `distribution` | Java distribution keyword. Values are case-sensitive and must match one of the supported keywords below. Required unless `java-version-file` points to `.sdkmanrc` with a recognized distribution suffix. | |
+| `java-package` | Package variant such as `jdk`, `jre`, `jdk+fx`, `jre+fx`, `jdk+crac`, `jre+crac`, `jdk+jmods`, `jdk+jcef`, `jre+jcef`, `jdk+ft`, or `jre+ft`. Support varies by distribution. | `jdk` |
+| `architecture` | Package architecture. Canonical values are `x86`, `x64`, `armv7`, `aarch64`, `ppc64le`, `ppc64`, and `s390x`. Aliases `ia32`, `amd64`, `arm`, and `arm64` are normalized. | Runner architecture |
+| `jdk-file` | Local compressed JDK archive. Requires `distribution: jdkfile`. | |
+| `check-latest` | Check remote metadata for the latest version satisfying the version spec before using the runner tool cache. | `false` |
+| `force-download` | Always download Java and replace any matching version in the tool cache. | `false` |
+| `set-default` | Add Java to `PATH` and set `JAVA_HOME`. When `false`, only version-specific `JAVA_HOME_<major>_<arch>` variables are set. | `true` |
+| `problem-matcher` | Register Java compiler and uncaught exception problem matchers. | `true` |
+| `verify-signature` | Verify downloaded Java package signatures when supported. Currently supported for `temurin` and `microsoft`. | `false` |
+| `verify-signature-public-key` | ASCII-armored GPG public key to use for signature verification. Overrides the bundled key. | |
+| `token` | Token for fetching GitHub.com-hosted version manifests, useful on GitHub Enterprise Server when unauthenticated requests are rate-limited. | `${{ github.token }}` on GitHub.com; empty string on GHES |
+| `cache` | Enable dependency caching for `maven`, `gradle`, or `sbt`. | |
+| `cache-jdk` | Cache downloaded JDK installations between jobs. When omitted, JDK caching is enabled only if `cache` is set. Set explicitly to `true` or `false` to override. | Enabled when `cache` is set |
+| `cache-dependency-path` | Dependency file paths used for cache key hashing. Supports globs and multiline values. | Auto-detected by package manager |
+| `cache-path` | Cache paths to use instead of the package manager's default dependency cache path. Supports multiline values and exclusions. | |
+| `cache-read-only` | Restore dependency, wrapper, and JDK caches without saving changes in the post step. | `false` |
+| `server-id` | Maven repository ID used in generated `settings.xml`. | `github` |
+| `server-username-env-var` | Environment variable name for Maven repository username. | `GITHUB_ACTOR` |
+| `server-password-env-var` | Environment variable name for Maven repository password or token. | `GITHUB_TOKEN` |
+| `settings-path` | Directory where `settings.xml` is written. | `~/.m2` |
+| `overwrite-settings` | Overwrite an existing `settings.xml`. | `true` |
+| `gpg-private-key` | GPG private key to import into an isolated temporary keyring. | |
+| `gpg-passphrase-env-var` | Environment variable name for the GPG private key passphrase. | `GPG_PASSPHRASE` when a key is set |
+| `mvn-toolchain-id` | Maven Toolchain ID. When multiple Java versions are installed, the number of IDs must match the number of versions. | `${mvn-toolchain-vendor}_${java-version}` |
+| `mvn-toolchain-vendor` | Maven Toolchain vendor value. | `${distribution}` |
+| `show-download-progress` | Keep Maven artifact download and transfer progress in logs. When `false`, the action adds `-ntp` to `MAVEN_ARGS`. | `false` |
+
+- `java-package`: Supported package types are `jdk`, `jre`, `jdk+fx`, `jre+fx`, `jdk+crac`, `jre+crac`, `jdk+jmods`, `jdk+jcef`, `jre+jcef`, `jdk+ft`, and `jre+ft`. Availability varies by distribution.
+
+Deprecated aliases `jdkFile`, `server-username`, `server-password`, and `gpg-passphrase` remain accepted for compatibility, but should be replaced with the current input names.
+
+## Outputs
+
+| Output | Description |
+| --- | --- |
+| `distribution` | Distribution that was installed. |
+| `version` | Actual Java version that was installed. |
+| `path` | Installation path, also used for `JAVA_HOME` when `set-default` is enabled. |
+| `cache-hit` | Whether an exact dependency cache match was restored. |
+| `cache-primary-key` | Primary cache key computed for the selected package manager. Empty when caching is disabled or skipped. |
+
+## Supported distributions
+
+| Keyword | Distribution | License |
+| --- | --- | --- |
+| `corretto` | [Amazon Corretto](https://aws.amazon.com/corretto/) | [License](https://aws.amazon.com/corretto/faqs/) |
+| `dragonwell` | [Alibaba Dragonwell JDK](https://dragonwell-jdk.io/) | [License](https://www.aliyun.com/product/dragonwell/) |
+| `graalvm` | [Oracle GraalVM](https://www.graalvm.org/) | [License](https://www.oracle.com/downloads/licenses/graal-free-license.html) |
+| `graalvm-community` | [GraalVM Community](https://github.com/graalvm/graalvm-ce-builds/releases) | [License](https://github.com/oracle/graal/blob/master/LICENSE) |
+| `jetbrains` | [JetBrains Runtime](https://github.com/JetBrains/JetBrainsRuntime/) | [License](https://github.com/JetBrains/JetBrainsRuntime/blob/main/LICENSE) |
+| `kona` | [Tencent Kona JDK](https://tencent.github.io/konajdk/) | [License](https://tencent.github.io/konajdk/LICENSE.txt) |
+| `liberica` | [Liberica JDK](https://bell-sw.com/) | [License](https://bell-sw.com/liberica_eula/) |
+| `liberica-nik` | [Liberica Native Image Kit](https://bell-sw.com/pages/downloads/native-image-kit/) | [License](https://bell-sw.com/liberica_nik_eula/) |
+| `microsoft` | [Microsoft Build of OpenJDK](https://www.microsoft.com/openjdk) | [License](https://docs.microsoft.com/java/openjdk/faq) |
+| `oracle` | [Oracle JDK](https://www.oracle.com/java/technologies/downloads/) | [License](https://java.com/freeuselicense) |
+| `oracle-openjdk` | [Oracle OpenJDK](https://jdk.java.net/) | [License](https://openjdk.org/legal/gplv2+ce.html) |
+| `sapmachine` | [SAP SapMachine JDK/JRE](https://sapmachine.io/) | [License](https://github.com/SAP/SapMachine/blob/sapmachine/LICENSE) |
+| `semeru` | [IBM Semeru Runtime Open Edition](https://developer.ibm.com/languages/java/semeru-runtimes/downloads/) | [License](https://openjdk.java.net/legal/gplv2+ce.html) |
+| `temurin` | [Eclipse Temurin](https://adoptium.net/) | [License](https://adoptium.net/about.html) |
+| `zulu` | [Azul Zulu OpenJDK](https://www.azul.com/downloads/zulu-community/?package=jdk) | [License](https://www.azul.com/products/zulu-and-zulu-enterprise/zulu-terms-of-use/) |
+| `jdkfile` | Custom JDK archive | |
+
+> [!NOTE]
+> Distribution availability, package variants, architectures, and version metadata differ by vendor. Check the vendor documentation when a specific version or platform matters.
+
+Additional distribution notes:
+
+- Oracle OpenJDK builds are archived after a limited number of releases and no longer receive security updates. To continue receiving security patches, use Oracle JDK or another vendor.
+- Azul Zulu maps `arm64` to `aarch64` when querying the Azul Metadata API.
+- GraalVM Community is available as `distribution: graalvm-community` for stable JDK 17 and later releases.
+- On Ubuntu runners, commands executed with `sudo` do not inherit the `JAVA_HOME` and `PATH` set by `setup-java` and may fall back to the system-default JDK.
+
+## Supported version syntax
+
+`java-version` accepts exact versions, version ranges, early-access versions, and `latest`.
+
+| Syntax | Examples |
+| --- | --- |
+| Major version | `8`, `11`, `17`, `21`, `25` |
+| Specific feature or patch version | `11.0`, `11.0.4`, `17.0`, `8.0.282+8` |
+| JEP 322 multi-field versions | `11.0.9.1`, `18.0.1.1` |
+| Early access | `15-ea`, `15.0.0-ea`, `27-ea` |
+| Latest stable GA release | `latest` |
+
+When `check-latest` is `false`, the action first tries the runner tool cache for the requested distribution, package type, architecture, and version range. It downloads Java only when no matching cached version is found. When `check-latest` is `true`, the action checks remote metadata first and downloads if the cached version is not current.
+
+GitHub-hosted runners primarily pre-cache Eclipse Temurin JDKs. See the installed Java versions for [Ubuntu](https://github.com/actions/runner-images/blob/main/images/ubuntu/Ubuntu2404-Readme.md#java), [Windows](https://github.com/actions/runner-images/blob/main/images/windows/Windows2025-Readme.md#java), and [macOS](https://github.com/actions/runner-images/blob/main/images/macos/macos-15-Readme.md#java). On a fresh GitHub-hosted runner, requests for other distributions usually miss the tool cache and resolve from remote metadata. For broad version ranges such as a major version (`21`, `25`), this often behaves similarly to `check-latest: true` because the action downloads the latest available release that satisfies the range.
+
+## Download integrity and signatures
+
+`setup-java` automatically verifies downloaded archive checksums when a selected distribution publishes an authoritative checksum. Automatic checksum verification currently applies to `temurin`, `semeru`, `corretto`, `dragonwell`, `kona`, `sapmachine`, `graalvm`, `graalvm-community`, `zulu`, `oracle`, `oracle-openjdk`, `microsoft`, and `jetbrains`.
+
+Distributions or individual releases without an authoritative checksum continue to install normally, with the omission reported in debug logs. Installations resolved directly from the runner tool cache — including JDKs preinstalled on the runner image and JDKs installed by an earlier step of the same job — are not downloaded again and are not reverified, even when `verify-signature: true` is set. Use `force-download: true` to always download and verify the archive.
+
+Use `verify-signature: true` to verify package signatures for distributions that support it. Currently supported distributions are `temurin` and `microsoft`; setting it for an unsupported distribution fails the workflow.
+
+## Caching
+
+`setup-java` manages three kinds of caches. Each one is restored and saved as a separate cache entry.
+
+| Cache | What it stores | Key based on | How it is enabled |
+| --- | --- | --- | --- |
+| Dependency cache | Downloaded dependencies, such as `~/.m2/repository`, `~/.gradle/caches`, or the sbt cache paths | Runner OS, architecture, package manager, and a hash of the dependency files | Set `cache` to `maven`, `gradle`, or `sbt` |
+| Wrapper caches | Maven and Gradle wrapper distributions (`~/.m2/wrapper/dists`, `~/.gradle/wrapper`) | Runner OS, architecture, wrapper cache name, and a hash of the wrapper properties | Set `cache` to `maven` or `gradle` |
+| JDK cache | The downloaded JDK installation | Runner OS, architecture, distribution, package type, resolved version, release identity, and signature-verification identity | Enabled implicitly whenever `cache` is set, or explicitly with `cache-jdk: true`. Opt out with `cache-jdk: false` |
+
+Set `cache` to `maven`, `gradle`, or `sbt` to cache dependencies with minimal configuration.
+
+```yaml
+steps:
+  - uses: actions/checkout@v7
+  - uses: actions/setup-java@v5
+    with:
+      distribution: temurin
+      java-version: '25'
+      cache: maven
+  - run: mvn verify
+```
+
+The primary dependency cache key is `setup-java-<runner-os>-<node-arch>-<package-manager>-<file-hash>`, where `<node-arch>` is the runner's Node.js process architecture. The primary cache stores dependency directories such as `~/.m2/repository`, `~/.gradle/caches`, or the sbt cache paths. Its file hash is based on these files by default:
+
+| Package manager | Files used for the primary dependency-cache key |
+| --- | --- |
+| Gradle | `**/*.gradle*`, `**/gradle.properties`, `**/gradle-wrapper.properties`, `buildSrc/**/Versions.kt`, `buildSrc/**/Dependencies.kt`, `gradle/*.versions.toml`, `**/versions.properties` |
+| Maven | `**/pom.xml`, `**/.mvn/wrapper/maven-wrapper.properties`, `**/.mvn/extensions.xml` |
+| sbt | `**/*.sbt`, `**/project/build.properties`, `**/project/**.scala`, `**/project/**.sbt` |
+
+Use `cache-dependency-path` to override the files used for key hashing, especially in monorepos:
+
+```yaml
+- uses: actions/setup-java@v5
+  with:
+    distribution: temurin
+    java-version: '25'
+    cache: gradle
+    cache-dependency-path: |
+      sub-project/*.gradle*
+      sub-project/**/gradle-wrapper.properties
+```
+
+Use `cache-path` when the build tool stores dependencies outside the default location:
+
+```yaml
+- uses: actions/setup-java@v5
+  with:
+    distribution: temurin
+    java-version: '25'
+    cache: maven
+    cache-path: |
+      /custom/maven/repository
+      !/custom/maven/repository/**/*.lastUpdated
+- run: mvn -Dmaven.repo.local=/custom/maven/repository verify
+```
+
+`cache-path` changes what is restored and saved, but not the cache key. Jobs that should share a cache key must use the same OS, architecture, package manager, dependency files, and cache paths.
+
+### Wrapper caches
+
+Maven and Gradle wrapper distributions are restored and saved as additional cache entries, separate from the primary dependency cache. These entries have their own keys in the form `setup-java-<runner-os>-<node-arch>-<wrapper-cache-name>-<file-hash>`.
+
+| Package manager | Wrapper cache name | Cached path | Files used for wrapper-cache key |
+| --- | --- | --- | --- |
+| Maven | `maven-wrapper` | `~/.m2/wrapper/dists` | `**/.mvn/wrapper/maven-wrapper.properties` |
+| Gradle | `gradle-wrapper` | `~/.gradle/wrapper` | `**/gradle-wrapper.properties` |
+
+These wrapper caches are independent from dependency caches, so they remain useful even when dependency files change frequently. The wrapper properties are also part of the Maven and Gradle primary dependency-cache key because wrapper changes can affect how dependencies are resolved, but the wrapper distribution files themselves are stored in the separate wrapper cache entries above.
+
+For advanced Gradle caching features such as build output caching, configuration cache support, encrypted cache storage, cleanup, and fine-grained cache control, consider [`gradle/actions/setup-gradle`](https://github.com/gradle/actions/tree/main/setup-gradle).
+
+### Caching JDK installations
+
+The JDK cache stores the downloaded JDK installation so later runs skip the download. It is enabled implicitly whenever dependency `cache` is set, so most workflows that cache dependencies are already caching the JDK. Set `cache-jdk: true` to enable it without dependency caching, or `cache-jdk: false` to opt out while keeping dependency caching. With neither `cache` nor `cache-jdk` set, nothing is cached.
+
+> [!IMPORTANT]
+> Because JDK caching is on by default whenever `cache` is set, review [Caching JDK installations](docs/advanced-usage.md#caching-jdk-installations)
+> for the full `cache`/`cache-jdk` matrix, cache identity and storage impact.
+
+### Read-only caches
+
+Set `cache-read-only: true` to restore dependency, wrapper, and JDK caches without saving changes in the post action. This is useful for pull requests, merge queues, short-lived branches, and matrix fan-out jobs that should only consume caches produced elsewhere.
+
+```yaml
+- uses: actions/setup-java@v5
+  with:
+    distribution: temurin
+    java-version: '25'
+    cache: maven
+    cache-read-only: ${{ github.ref != 'refs/heads/main' }}
+```
+
+For matrix fan-out, seed the cache once and make matrix jobs read-only consumers:
+
+```yaml
+jobs:
+  seed-cache:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: '25'
+          cache: maven
+      - run: mvn dependency:go-offline dependency:resolve-plugins
+
+  build:
+    needs: seed-cache
+    runs-on: ubuntu-latest
+    strategy:
+      matrix:
+        goal: [test, verify, package]
+    steps:
+      - uses: actions/checkout@v7
+      - uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: '25'
+          cache: maven
+          cache-read-only: true
+      - run: mvn ${{ matrix.goal }}
+```
+
+### Cache segment restore timeout
+
+Cache downloads are split into segments. To reduce the chance of a stuck segment blocking a workflow, set `SEGMENT_DOWNLOAD_TIMEOUT_MINS`:
+
+```yaml
+env:
+  SEGMENT_DOWNLOAD_TIMEOUT_MINS: '5'
+steps:
+  - uses: actions/checkout@v7
+  - uses: actions/setup-java@v5
+    with:
+      distribution: temurin
+      java-version: '25'
+      cache: gradle
+  - run: ./gradlew build --no-daemon
+```
+
+## Multiple JDKs and Maven toolchains
+
+Install multiple Java versions by providing a multiline `java-version` value. All configured JDKs are installed. The last one added to `PATH` becomes the default.
+
+```yaml
+steps:
+  - uses: actions/setup-java@v5
+    with:
+      distribution: temurin
+      java-version: |
+        8
+        11
+        17
+        21
+        25
+```
+
+Other installed JDKs are available through version-specific variables such as `JAVA_HOME_17_X64`. To use a specific version later in the job, set `JAVA_HOME` and prepend its `bin` directory to `PATH`.
+
+`setup-java` writes a Maven Toolchains declaration for each installed JDK. When multiple JDKs are installed, the declaration contains all of them. Customize the generated toolchain values with `mvn-toolchain-id` and `mvn-toolchain-vendor`.
+
+## Testing with a Java matrix
+
 ```yaml
 jobs:
   build:
-    runs-on: ubuntu-16.04
+    runs-on: ubuntu-latest
     strategy:
       matrix:
-        java: [ '1.6', '9.0.x', '12.0.2' ]
-    name: Java ${{ matrix.java }} sample
+        java: ['8', '11', '17', '21', '25']
+    name: Java ${{ matrix.java }}
     steps:
-      - uses: actions/checkout@master
-      - name: Setup java
-        uses: actions/setup-java@v1
+      - uses: actions/checkout@v7
+      - uses: actions/setup-java@v5
         with:
+          distribution: temurin
           java-version: ${{ matrix.java }}
-          architecture: x64
-      - run: java -cp java HelloWorldApp
+      - run: java --version
+      - run: mvn verify
 ```
 
-# License
+## Publishing packages
 
-The scripts and documentation in this project are released under the [MIT License](LICENSE)
+`setup-java` generates Maven `settings.xml` and Maven Toolchains configuration. For Gradle publishing, it installs Java for the workflow; the Gradle build file remains responsible for reading credentials from environment variables.
 
-# Contributions
+### Maven
 
-Contributions are welcome!  See [Contributor's Guide](docs/contributors.md)
+```yaml
+steps:
+  - uses: actions/checkout@v7
+  - uses: actions/setup-java@v5
+    with:
+      distribution: temurin
+      java-version: '25'
+      server-id: github
+      server-username-env-var: GITHUB_ACTOR
+      server-password-env-var: GITHUB_TOKEN
+  - run: mvn --batch-mode deploy
+    env:
+      GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+```
+
+### GPG signing
+
+```yaml
+steps:
+  - uses: actions/checkout@v7
+  - uses: actions/setup-java@v5
+    with:
+      distribution: temurin
+      java-version: '25'
+      gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
+      gpg-passphrase-env-var: GPG_PASSPHRASE
+  - run: mvn --batch-mode deploy
+    env:
+      GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+```
+
+Maven GPG signing requires `maven-gpg-plugin` 3.2.0 or newer because `setup-java` passes the passphrase through `gpg.passphraseEnvName`.
+
+## Recommended permissions
+
+When using the `setup-java` action in your GitHub Actions workflow, it is recommended to set the following permissions to ensure proper functionality:
+
+```yaml
+permissions:
+  contents: read # access to check out code and install dependencies
+```
+
+Publishing workflows may require additional permissions depending on the target registry.
+
+## Advanced usage
+
+See [advanced usage](docs/advanced-usage.md) for detailed examples:
+
+- [Selecting a Java distribution](docs/advanced-usage.md#selecting-a-java-distribution)
+- [Installing custom Java package types](docs/advanced-usage.md#installing-custom-java-package-type)
+- [Package compatibility](docs/advanced-usage.md#package-compatibility)
+- [Ensuring the Maven cache is complete](docs/advanced-usage.md#ensuring-the-maven-cache-is-complete-plugin-dependencies)
+- [Caching JDK installations](docs/advanced-usage.md#caching-jdk-installations)
+- [Platform and architecture compatibility](docs/advanced-usage.md#platform-and-architecture-compatibility)
+- [Installing custom Java architecture](docs/advanced-usage.md#installing-custom-java-architecture)
+- [Installing a JDK without setting it as default](docs/advanced-usage.md#installing-jdk-without-setting-as-default)
+- [Installing Java from a local file](docs/advanced-usage.md#installing-java-from-local-file)
+- [Testing against different Java distributions](docs/advanced-usage.md#testing-against-different-java-distributions)
+- [Testing against different platforms](docs/advanced-usage.md#testing-against-different-platforms)
+- [Publishing using Apache Maven](docs/advanced-usage.md#publishing-using-apache-maven)
+- [Apache Maven with a settings path](docs/advanced-usage.md#apache-maven-with-a-settings-path)
+- [Maven transfer progress](docs/advanced-usage.md#maven-transfer-progress-download-logs)
+- [Java problem matcher](docs/advanced-usage.md#java-problem-matcher-compiler-annotations)
+- [Publishing using Gradle](docs/advanced-usage.md#publishing-using-gradle)
+- [Hosted tool cache](docs/advanced-usage.md#hosted-tool-cache)
+- [Modifying Maven Toolchains](docs/advanced-usage.md#modifying-maven-toolchains)
+- [Java version files](docs/advanced-usage.md#java-version-file)
+- [Self-signed certificates and internal CAs on GitHub Enterprise](docs/advanced-usage.md#self-signed-certificates-and-internal-cas-github-enterprise)
+
+## License
+
+The scripts and documentation in this project are released under the [MIT License](LICENSE).
+
+## Contributions
+
+Contributions are welcome. See our [Contributor's Guide](docs/contributors.md).
+
+## Code of Conduct
+
+:wave: Be nice. See [our code of conduct](CODE_OF_CONDUCT.md)

__tests__/auth.test.ts

@@ -0,0 +1,423 @@
+import {
+  jest,
+  describe,
+  it,
+  expect,
+  beforeEach,
+  afterEach,
+  beforeAll,
+  afterAll
+} from '@jest/globals';
+import {fileURLToPath} from 'url';
+import * as io from '@actions/io';
+import * as fs from 'fs';
+import * as path from 'path';
+import os from 'os';
+import {XMLParser} from 'fast-xml-parser';
+
+// Mock @actions/core before importing source modules that depend on it
+jest.unstable_mockModule('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
+
+jest.unstable_mockModule('../src/gpg.js', () => ({
+  importKey: jest.fn(),
+  removeGpgHome: jest.fn(),
+  toGpgPath: jest.fn()
+}));
+
+// Dynamic imports after mocking
+const core = await import('@actions/core');
+const gpg = await import('../src/gpg.js');
+const auth = await import('../src/auth.js');
+const {M2_DIR, MVN_SETTINGS_FILE, STATE_GPG_HOME} =
+  await import('../src/constants.js');
+
+const __dirname = path.dirname(fileURLToPath(import.meta.url));
+const m2Dir = path.join(__dirname, M2_DIR);
+const settingsFile = path.join(m2Dir, MVN_SETTINGS_FILE);
+
+describe('auth tests', () => {
+  let spyOSHomedir: any;
+  let spyInfo: any;
+
+  beforeEach(async () => {
+    await io.rmRF(m2Dir);
+    spyOSHomedir = jest.spyOn(os, 'homedir');
+    spyOSHomedir.mockReturnValue(__dirname);
+    spyInfo = core.info as jest.Mock;
+    spyInfo.mockImplementation(() => null);
+    (gpg.toGpgPath as jest.Mock<any>).mockImplementation((p: string) => p);
+  }, 300000);
+
+  afterEach(() => {
+    (core.getInput as jest.Mock).mockReset();
+    (core.exportVariable as jest.Mock).mockReset();
+    (gpg.importKey as jest.Mock).mockReset();
+    (gpg.removeGpgHome as jest.Mock).mockReset();
+    (gpg.toGpgPath as jest.Mock).mockReset();
+  });
+
+  afterAll(async () => {
+    try {
+      await io.rmRF(m2Dir);
+    } catch {
+      console.log('Failed to remove test directories');
+    }
+    jest.resetAllMocks();
+    jest.clearAllMocks();
+    jest.restoreAllMocks();
+  }, 100000);
+
+  it('creates settings.xml in alternate locations', async () => {
+    const id = 'packages';
+    const username = 'UNAMI';
+    const password = 'TOLKIEN';
+
+    const altHome = path.join(__dirname, 'runner', 'settings');
+    const altSettingsFile = path.join(altHome, MVN_SETTINGS_FILE);
+    await io.rmRF(altHome); // ensure it doesn't already exist
+
+    await auth.createAuthenticationSettings(
+      id,
+      username,
+      password,
+      altHome,
+      true
+    );
+
+    expect(fs.existsSync(m2Dir)).toBe(false);
+    expect(fs.existsSync(settingsFile)).toBe(false);
+
+    expect(fs.existsSync(altHome)).toBe(true);
+    expect(fs.existsSync(altSettingsFile)).toBe(true);
+    expect(fs.readFileSync(altSettingsFile, 'utf-8')).toEqual(
+      auth.generate(id, username, password)
+    );
+
+    await io.rmRF(altHome);
+  }, 100000);
+
+  it('creates settings.xml with minimal configuration', async () => {
+    const id = 'packages';
+    const username = 'UNAME';
+    const password = 'TOKEN';
+
+    await auth.createAuthenticationSettings(
+      id,
+      username,
+      password,
+      m2Dir,
+      true
+    );
+
+    expect(fs.existsSync(m2Dir)).toBe(true);
+    expect(fs.existsSync(settingsFile)).toBe(true);
+    expect(fs.readFileSync(settingsFile, 'utf-8')).toEqual(
+      auth.generate(id, username, password)
+    );
+  }, 100000);
+
+  it('creates settings.xml with additional configuration', async () => {
+    const id = 'packages';
+    const username = 'UNAME';
+    const password = 'TOKEN';
+    const gpgPassphrase = 'GPG';
+
+    await auth.createAuthenticationSettings(
+      id,
+      username,
+      password,
+      m2Dir,
+      true,
+      gpgPassphrase
+    );
+
+    expect(fs.existsSync(m2Dir)).toBe(true);
+    expect(fs.existsSync(settingsFile)).toBe(true);
+    expect(fs.readFileSync(settingsFile, 'utf-8')).toEqual(
+      auth.generate(id, username, password, gpgPassphrase)
+    );
+  }, 100000);
+
+  it('exports a GPG-compatible path and persists the native GPG home', async () => {
+    const gpgHome = 'D:\\a\\_temp\\setup-java-gpg-1';
+    const exportedGpgHome = '/d/a/_temp/setup-java-gpg-1';
+    (gpg.importKey as jest.Mock<any>).mockResolvedValue(gpgHome);
+    (gpg.toGpgPath as jest.Mock<any>).mockReturnValue(exportedGpgHome);
+    (core.getInput as jest.Mock<any>).mockImplementation((name: string) => {
+      const inputs: Record<string, string> = {
+        'server-id': 'packages',
+        'server-username-env-var': 'USERNAME',
+        'server-password-env-var': 'PASSWORD',
+        'settings-path': m2Dir,
+        'gpg-private-key': 'KEY ONE\nKEY TWO'
+      };
+      return inputs[name] ?? '';
+    });
+
+    await auth.configureAuthentication();
+
+    expect(gpg.importKey).toHaveBeenCalledWith('KEY ONE\nKEY TWO');
+    expect(core.saveState).toHaveBeenCalledWith(STATE_GPG_HOME, gpgHome);
+    expect(gpg.toGpgPath).toHaveBeenCalledWith(gpgHome);
+    expect(core.exportVariable).toHaveBeenCalledWith(
+      'GNUPGHOME',
+      exportedGpgHome
+    );
+  });
+
+  it('removes the isolated GPG home when environment export fails', async () => {
+    const gpgHome = path.join(__dirname, 'runner', 'temp', 'setup-java-gpg-2');
+    (gpg.importKey as jest.Mock<any>).mockResolvedValue(gpgHome);
+    (core.exportVariable as jest.Mock<any>).mockImplementation(() => {
+      throw new Error('environment file unavailable');
+    });
+    (core.getInput as jest.Mock<any>).mockImplementation((name: string) => {
+      if (name === 'gpg-private-key') return 'KEY CONTENTS';
+      if (name === 'settings-path') return m2Dir;
+      return '';
+    });
+
+    await expect(auth.configureAuthentication()).rejects.toThrow(
+      'environment file unavailable'
+    );
+
+    expect(gpg.removeGpgHome).toHaveBeenCalledWith(gpgHome);
+  });
+
+  it('overwrites existing settings.xml files', async () => {
+    const id = 'packages';
+    const username = 'USERNAME';
+    const password = 'PASSWORD';
+
+    fs.mkdirSync(m2Dir, {recursive: true});
+    fs.writeFileSync(settingsFile, 'FAKE FILE');
+    expect(fs.existsSync(m2Dir)).toBe(true);
+    expect(fs.existsSync(settingsFile)).toBe(true);
+
+    await auth.createAuthenticationSettings(
+      id,
+      username,
+      password,
+      m2Dir,
+      true
+    );
+
+    expect(fs.existsSync(m2Dir)).toBe(true);
+    expect(fs.existsSync(settingsFile)).toBe(true);
+    expect(fs.readFileSync(settingsFile, 'utf-8')).toEqual(
+      auth.generate(id, username, password)
+    );
+  }, 100000);
+
+  it('does not overwrite existing settings.xml files', async () => {
+    const id = 'packages';
+    const username = 'USERNAME';
+    const password = 'PASSWORD';
+
+    fs.mkdirSync(m2Dir, {recursive: true});
+    fs.writeFileSync(settingsFile, 'FAKE FILE');
+    expect(fs.existsSync(m2Dir)).toBe(true);
+    expect(fs.existsSync(settingsFile)).toBe(true);
+
+    await auth.createAuthenticationSettings(
+      id,
+      username,
+      password,
+      m2Dir,
+      false
+    );
+
+    expect(fs.existsSync(m2Dir)).toBe(true);
+    expect(fs.existsSync(settingsFile)).toBe(true);
+    expect(fs.readFileSync(settingsFile, 'utf-8')).toEqual('FAKE FILE');
+  }, 100000);
+
+  it('generates valid settings.xml with minimal configuration', () => {
+    const id = 'packages';
+    const username = 'USER';
+    const password = '&<>"\'\'"><&';
+
+    const expectedSettings = `<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 https://maven.apache.org/xsd/settings-1.0.0.xsd">
+  <interactiveMode>false</interactiveMode>
+  <servers>
+    <server>
+      <id>${id}</id>
+      <username>\${env.${username}}</username>
+      <password>\${env.&amp;&lt;&gt;"''"&gt;&lt;&amp;}</password>
+    </server>
+  </servers>
+</settings>`;
+
+    expect(auth.generate(id, username, password)).toEqual(expectedSettings);
+  });
+
+  it('generates valid settings.xml with additional configuration', () => {
+    const id = 'packages';
+    const username = 'USER';
+    const password = '&<>"\'\'"><&';
+    const gpgPassphrase = 'PASSPHRASE';
+
+    const expectedSettings = `<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 https://maven.apache.org/xsd/settings-1.0.0.xsd">
+  <interactiveMode>false</interactiveMode>
+  <servers>
+    <server>
+      <id>${id}</id>
+      <username>\${env.${username}}</username>
+      <password>\${env.&amp;&lt;&gt;"''"&gt;&lt;&amp;}</password>
+    </server>
+  </servers>
+  <profiles>
+    <profile>
+      <id>setup-java-gpg</id>
+      <properties>
+        <gpg.passphraseEnvName>${gpgPassphrase}</gpg.passphraseEnvName>
+      </properties>
+    </profile>
+  </profiles>
+  <activeProfiles>
+    <activeProfile>setup-java-gpg</activeProfile>
+  </activeProfiles>
+</settings>`;
+
+    expect(auth.generate(id, username, password, gpgPassphrase)).toEqual(
+      expectedSettings
+    );
+  });
+
+  it('does not add a gpg profile when the passphrase env var is the maven-gpg-plugin default', () => {
+    const id = 'packages';
+    const username = 'USER';
+    const password = '&<>"\'\'"><&';
+    const gpgPassphrase = 'MAVEN_GPG_PASSPHRASE';
+
+    const expectedSettings = `<settings xmlns="http://maven.apache.org/SETTINGS/1.0.0"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://maven.apache.org/SETTINGS/1.0.0 https://maven.apache.org/xsd/settings-1.0.0.xsd">
+  <interactiveMode>false</interactiveMode>
+  <servers>
+    <server>
+      <id>${id}</id>
+      <username>\${env.${username}}</username>
+      <password>\${env.&amp;&lt;&gt;"''"&gt;&lt;&amp;}</password>
+    </server>
+  </servers>
+</settings>`;
+
+    expect(auth.generate(id, username, password, gpgPassphrase)).toEqual(
+      expectedSettings
+    );
+  });
+
+  it('escapes settings.xml values while preserving parsed semantics', () => {
+    const id = `packages&<>"'é`;
+    const username = `USER&<>"'é`;
+    const password = `TOKEN&<>"'é`;
+    const gpgPassphrase = `GPG&<>"'é`;
+
+    const xml = auth.generate(id, username, password, gpgPassphrase);
+    const parsed = parseXmlObject(xml) as any;
+
+    expect(parsed.settings.interactiveMode).toBe('false');
+    expect(xmlElementText(xml, 'id')).toBe(id);
+    expect(xmlElementText(xml, 'username')).toBe(`\${env.${username}}`);
+    expect(xmlElementText(xml, 'password')).toBe(`\${env.${password}}`);
+    expect(xmlElementText(xml, 'gpg.passphraseEnvName')).toBe(gpgPassphrase);
+    expect(parsed.settings.activeProfiles.activeProfile).toBe('setup-java-gpg');
+  });
+
+  function xmlElementText(xml: string, tagName: string): string {
+    const match = new RegExp(`<${tagName}>([\\s\\S]*?)</${tagName}>`).exec(xml);
+    expect(match).not.toBeNull();
+    return (parseXmlObject(`<value>${match?.[1]}</value>`) as {value: string})
+      .value;
+  }
+
+  function parseXmlObject(xml: string): unknown {
+    const parser = new XMLParser({
+      ignoreAttributes: false,
+      attributeNamePrefix: '@',
+      parseAttributeValue: false,
+      parseTagValue: false,
+      trimValues: true
+    });
+    return parser.parse(xml);
+  }
+
+  it('uses deprecated input aliases and warns', () => {
+    const mockGetInput = core.getInput as jest.MockedFunction<
+      typeof core.getInput
+    >;
+    const mockWarning = core.warning as jest.MockedFunction<
+      typeof core.warning
+    >;
+    mockGetInput.mockImplementation(name =>
+      name === 'server-username' ? 'LEGACY_USERNAME' : ''
+    );
+
+    expect(
+      auth.getInputWithDeprecatedAlias(
+        'server-username-env-var',
+        'server-username',
+        'GITHUB_ACTOR'
+      )
+    ).toBe('LEGACY_USERNAME');
+    expect(mockWarning).toHaveBeenCalledWith(
+      "The 'server-username' input is deprecated and may be removed in a future release. Please use 'server-username-env-var' instead."
+    );
+
+    mockGetInput.mockReset();
+    mockWarning.mockReset();
+  });
+
+  it('prefers the replacement input over its deprecated alias', () => {
+    const mockGetInput = core.getInput as jest.MockedFunction<
+      typeof core.getInput
+    >;
+    mockGetInput.mockImplementation(name => {
+      const inputs: Record<string, string> = {
+        'server-password-env-var': 'NEW_PASSWORD',
+        'server-password': 'LEGACY_PASSWORD'
+      };
+      return inputs[name] || '';
+    });
+
+    expect(
+      auth.getInputWithDeprecatedAlias(
+        'server-password-env-var',
+        'server-password',
+        'GITHUB_TOKEN'
+      )
+    ).toBe('NEW_PASSWORD');
+    expect(core.warning).toHaveBeenCalled();
+
+    mockGetInput.mockReset();
+    (core.warning as jest.Mock).mockReset();
+  });
+});

__tests__/benchmark-cache-restore.sh

@@ -0,0 +1,135 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+command=${1:?command is required}
+tool=${2:?tool is required}
+
+case "$tool" in
+  maven)
+    dependency_cache="$HOME/.m2/repository"
+    wrapper_cache="$HOME/.m2/wrapper/dists"
+    dependency_file="benchmark/pom.xml"
+    wrapper_file="benchmark/.mvn/wrapper/maven-wrapper.properties"
+    ;;
+  gradle)
+    dependency_cache="$HOME/.gradle/caches"
+    wrapper_cache="$HOME/.gradle/wrapper"
+    dependency_file="benchmark/build.gradle"
+    wrapper_file="benchmark/gradle/wrapper/gradle-wrapper.properties"
+    ;;
+  *)
+    echo "Unsupported tool: $tool" >&2
+    exit 1
+    ;;
+esac
+
+case "$command" in
+  prepare)
+    profile=${3:?profile is required}
+    mkdir -p "$(dirname "$dependency_file")" "$(dirname "$wrapper_file")"
+    printf '// setup-java cache benchmark v1: %s\n' "$profile" > "$dependency_file"
+    printf '# setup-java cache benchmark v1: %s\n' "$profile" > "$wrapper_file"
+    ;;
+  reset)
+    rm -rf "$dependency_cache" "$wrapper_cache"
+    ;;
+  populate)
+    profile=${3:?profile is required}
+    case "$profile" in
+      small)
+        dependency_megabytes=8
+        wrapper_megabytes=2
+        ;;
+      large)
+        dependency_megabytes=128
+        wrapper_megabytes=32
+        ;;
+      *)
+        echo "Unsupported profile: $profile" >&2
+        exit 1
+        ;;
+    esac
+    mkdir -p "$dependency_cache/setup-java-benchmark"
+    mkdir -p "$wrapper_cache/setup-java-benchmark"
+    dd if=/dev/urandom \
+      of="$dependency_cache/setup-java-benchmark/payload" \
+      bs=1048576 count="$dependency_megabytes" 2>/dev/null
+    dd if=/dev/urandom \
+      of="$wrapper_cache/setup-java-benchmark/payload" \
+      bs=1048576 count="$wrapper_megabytes" 2>/dev/null
+    ;;
+  start)
+    node -e "require('fs').writeFileSync('.benchmark-start', String(Date.now()))"
+    ;;
+  record)
+    os=${3:?os is required}
+    profile=${4:?profile is required}
+    implementation=${5:?implementation is required}
+    iteration=${6:?iteration is required}
+    cache_hit=${7:?cache-hit output is required}
+    if [ "$cache_hit" != "true" ]; then
+      echo "Expected an exact dependency-cache hit for $implementation" >&2
+      exit 1
+    fi
+    test -f "$dependency_cache/setup-java-benchmark/payload"
+    started=$(cat .benchmark-start)
+    finished=$(node -e "process.stdout.write(String(Date.now()))")
+    elapsed=$((finished - started))
+    mkdir -p .benchmark-results
+    printf '%s,%s,%s,%s,%s,%s\n' \
+      "$os" "$tool" "$profile" "$implementation" "$iteration" "$elapsed" \
+      >> .benchmark-results/timings.csv
+    ;;
+  summarize)
+    summary_file=${3:?summary file is required}
+    results_file=".benchmark-results/timings.csv"
+    node --input-type=module - "$results_file" "$summary_file" <<'NODE'
+import fs from 'node:fs';
+
+const [, , resultsFile, summaryFile] = process.argv;
+const rows = fs
+  .readFileSync(resultsFile, 'utf8')
+  .trim()
+  .split('\n')
+  .map(line => {
+    const [os, tool, profile, implementation, iteration, elapsed] =
+      line.split(',');
+    return {os, tool, profile, implementation, iteration, elapsed: +elapsed};
+  });
+const average = implementation => {
+  const values = rows
+    .filter(row => row.implementation === implementation)
+    .map(row => row.elapsed);
+  if (values.length === 0) {
+    throw new Error(`No ${implementation} benchmark results were recorded`);
+  }
+  return Math.round(values.reduce((sum, value) => sum + value, 0) / values.length);
+};
+const baseline = average('baseline');
+const candidate = average('candidate');
+const change = (((candidate - baseline) / baseline) * 100).toFixed(1);
+const {os, tool, profile} = rows[0];
+const lines = [
+  `### ${tool} ${profile} cache restore on ${os}`,
+  '',
+  '| Implementation | Iteration | Wall time (ms) |',
+  '| --- | ---: | ---: |',
+  ...rows.map(
+    row =>
+      `| ${row.implementation} | ${row.iteration} | ${row.elapsed} |`
+  ),
+  `| **baseline average** | | **${baseline}** |`,
+  `| **candidate average** | | **${candidate}** |`,
+  '',
+  `Candidate change from baseline: **${change}%**`,
+  ''
+];
+fs.appendFileSync(summaryFile, `${lines.join('\n')}\n`);
+NODE
+    ;;
+  *)
+    echo "Unsupported command: $command" >&2
+    exit 1
+    ;;
+esac

__tests__/cache-feature.test.ts

@@ -0,0 +1,80 @@
+import {jest, describe, it, expect, afterEach} from '@jest/globals';
+
+jest.unstable_mockModule('@actions/cache', () => ({
+  isFeatureAvailable: jest.fn()
+}));
+
+jest.unstable_mockModule('@actions/core', () => ({
+  warning: jest.fn(),
+  debug: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  info: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
+
+const cache = await import('@actions/cache');
+const core = await import('@actions/core');
+const {isCacheFeatureAvailable} = await import('../src/cache-feature.js');
+
+describe('isCacheFeatureAvailable', () => {
+  it('is disabled on GHES when cache feature is unavailable', () => {
+    (cache.isFeatureAvailable as jest.Mock<any>).mockImplementation(
+      () => false
+    );
+    const warningMock = core.warning as jest.Mock;
+    const message =
+      'Caching is only supported on GHES version >= 3.5. If you are on a version >= 3.5, please check with your GHES admin if the Actions cache service is enabled or not.';
+
+    try {
+      process.env['GITHUB_SERVER_URL'] = 'http://example.com';
+      expect(isCacheFeatureAvailable()).toBe(false);
+      expect(warningMock).toHaveBeenCalledWith(message);
+    } finally {
+      delete process.env['GITHUB_SERVER_URL'];
+    }
+  });
+
+  it('is disabled on dotcom when cache feature is unavailable', () => {
+    (cache.isFeatureAvailable as jest.Mock<any>).mockImplementation(
+      () => false
+    );
+    const warningMock = core.warning as jest.Mock;
+    const message =
+      'The runner was not able to contact the cache service. Caching will be skipped';
+
+    try {
+      process.env['GITHUB_SERVER_URL'] = 'http://github.com';
+      expect(isCacheFeatureAvailable()).toBe(false);
+      expect(warningMock).toHaveBeenCalledWith(message);
+    } finally {
+      delete process.env['GITHUB_SERVER_URL'];
+    }
+  });
+
+  it('is enabled when cache feature is available', () => {
+    (cache.isFeatureAvailable as jest.Mock<any>).mockImplementation(() => true);
+    expect(isCacheFeatureAvailable()).toBe(true);
+  });
+
+  afterEach(() => {
+    jest.resetAllMocks();
+    jest.clearAllMocks();
+  });
+});

__tests__/cache/gradle1/.gitignore

@@ -0,0 +1,12 @@
+.gradle
+**/build/
+!src/**/build/
+
+# Ignore Gradle GUI config
+gradle-app.setting
+
+# Avoid ignoring Gradle wrapper jar file (.jar files are usually ignored)
+!gradle-wrapper.jar
+
+# Cache of project
+.gradletasknamecache

__tests__/cache/gradle1/build.gradle

@@ -0,0 +1,17 @@
+plugins {
+    id 'java'
+}
+repositories {
+    mavenCentral()
+}
+dependencies {
+    implementation 'org.codehaus.groovy:groovy:1.8.6'
+}
+tasks.register('downloadDependencies') {
+    doLast {
+        def total = configurations.compileClasspath.inject (0) { sum, file ->
+            sum + file.length()
+        }
+        println total
+    }
+}

__tests__/cache/gradle1/gradle/wrapper/gradle-wrapper.properties

@@ -0,0 +1 @@
+distributionUrl=https\://services.gradle.org/distributions/gradle-9.4.1-bin.zip

__tests__/cache/gradle2/.gitignore

@@ -0,0 +1,12 @@
+.gradle
+**/build/
+!src/**/build/
+
+# Ignore Gradle GUI config
+gradle-app.setting
+
+# Avoid ignoring Gradle wrapper jar file (.jar files are usually ignored)
+!gradle-wrapper.jar
+
+# Cache of project
+.gradletasknamecache

__tests__/cache/gradle2/build.gradle

@@ -0,0 +1,17 @@
+plugins {
+    id 'java'
+}
+repositories {
+    mavenCentral()
+}
+dependencies {
+    implementation 'org.junit.jupiter:junit-jupiter-api:5.7.2'
+}
+tasks.register('downloadDependencies') {
+    doLast {
+        def total = configurations.compileClasspath.inject (0) { sum, file ->
+            sum + file.length()
+        }
+        println total
+    }
+}

__tests__/cache/maven/.gitignore

@@ -0,0 +1,11 @@
+target/
+pom.xml.tag
+pom.xml.releaseBackup
+pom.xml.versionsBackup
+pom.xml.next
+release.properties
+dependency-reduced-pom.xml
+buildNumber.properties
+.mvn/timing.properties
+# https://github.com/takari/maven-wrapper#usage-without-binary-jar
+.mvn/wrapper/maven-wrapper.jar

__tests__/cache/maven/.mvn/wrapper/maven-wrapper.properties

@@ -0,0 +1 @@
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.12/apache-maven-3.9.12-bin.zip

__tests__/cache/maven/pom.xml

@@ -0,0 +1,16 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <groupId>io.github.actions</groupId>
+    <artifactId>setup-java-maven-example</artifactId>
+    <version>1.0.0-SNAPSHOT</version>
+    <packaging>jar</packaging>
+    <dependencies>
+        <dependency>
+            <groupId>org.junit.jupiter</groupId>
+            <artifactId>junit-jupiter-api</artifactId>
+            <version>5.7.2</version>
+            <scope>test</scope>
+        </dependency>
+    </dependencies>
+</project>

__tests__/cache/maven2/.gitignore

@@ -0,0 +1,11 @@
+target/
+pom.xml.tag
+pom.xml.releaseBackup
+pom.xml.versionsBackup
+pom.xml.next
+release.properties
+dependency-reduced-pom.xml
+buildNumber.properties
+.mvn/timing.properties
+# https://github.com/takari/maven-wrapper#usage-without-binary-jar
+.mvn/wrapper/maven-wrapper.jar

__tests__/cache/maven2/pom.xml

@@ -0,0 +1,15 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0" xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance" xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+    <groupId>io.github.actions</groupId>
+    <artifactId>setup-java-maven2-example</artifactId>
+    <version>1.0.0-SNAPSHOT</version>
+    <packaging>jar</packaging>
+    <dependencies>
+        <dependency>
+            <groupId>org.apache.commons</groupId>
+            <artifactId>commons-lang3</artifactId>
+            <version>3.12.0</version>
+        </dependency>
+    </dependencies>
+</project>

__tests__/cache/sbt/.gitignore

@@ -0,0 +1 @@
+target/

__tests__/cache/sbt/build.sbt

@@ -0,0 +1,3 @@
+ThisBuild / scalaVersion := "2.12.15"
+
+libraryDependencies += "org.scala-lang.modules" %% "scala-parser-combinators" % "1.1.2"

__tests__/cache/sbt/project/build.properties

@@ -0,0 +1 @@
+sbt.version=1.6.2

__tests__/cache/sbt2/.gitignore

@@ -0,0 +1 @@
+target/

__tests__/cache/sbt2/build.sbt

@@ -0,0 +1,3 @@
+ThisBuild / scalaVersion := "2.12.15"
+
+libraryDependencies += "org.scala-lang.modules" %% "scala-parser-combinators" % "2.1.1"

__tests__/check-dir.sh

@@ -0,0 +1,39 @@
+#!/bin/sh
+# Assert whether a directory exists, for use in the e2e cache workflows.
+#
+# Usage: check-dir.sh <dir> [present|absent]
+#
+#   present (default): fail if <dir> does NOT exist, otherwise list its contents.
+#   absent:            fail if <dir> DOES exist.
+#
+# Call with already-expanded paths (e.g. "$HOME/.gradle/caches") to avoid
+# tilde-expansion pitfalls.
+set -eu
+
+if [ "$#" -lt 1 ]; then
+  echo "Usage: check-dir.sh <dir> [present|absent]" >&2
+  exit 2
+fi
+
+dir=$1
+mode=${2:-present}
+
+case "$mode" in
+  present)
+    if [ ! -d "$dir" ]; then
+      echo "::error::The $dir directory does not exist unexpectedly"
+      exit 1
+    fi
+    ls "$dir"
+    ;;
+  absent)
+    if [ -d "$dir" ]; then
+      echo "::error::The $dir directory exists unexpectedly"
+      exit 1
+    fi
+    ;;
+  *)
+    echo "::error::Unknown mode '$mode' (expected 'present' or 'absent')"
+    exit 1
+    ;;
+esac

__tests__/checksum.test.ts

@@ -0,0 +1,130 @@
+import {afterEach, describe, expect, it, jest} from '@jest/globals';
+import {createHash} from 'crypto';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+
+import {calculateChecksum, verifyChecksum} from '../src/checksum.js';
+import type {ChecksumMetadata} from '../src/distributions/base-models.js';
+
+const temporaryPaths: string[] = [];
+
+async function temporaryFile(contents: string): Promise<string> {
+  const directory = await fs.promises.mkdtemp(
+    path.join(os.tmpdir(), 'setup-java-checksum-')
+  );
+  const file = path.join(directory, 'archive');
+  await fs.promises.writeFile(file, contents);
+  temporaryPaths.push(directory);
+  return file;
+}
+
+afterEach(async () => {
+  await Promise.all(
+    temporaryPaths
+      .splice(0)
+      .map(item => fs.promises.rm(item, {recursive: true, force: true}))
+  );
+  jest.restoreAllMocks();
+});
+
+describe('verifyChecksum', () => {
+  it.each(['sha256', 'sha512'] as const)(
+    'verifies a matching %s digest',
+    async algorithm => {
+      const contents = `jdk archive for ${algorithm}`;
+      const file = await temporaryFile(contents);
+      const value = createHash(algorithm).update(contents).digest('hex');
+
+      await expect(
+        verifyChecksum(
+          file,
+          {algorithm, value: value.toUpperCase()},
+          {distribution: 'Test', version: '21.0.1'}
+        )
+      ).resolves.toBeUndefined();
+    }
+  );
+
+  it('reports mismatch context and both digests', async () => {
+    const file = await temporaryFile('corrupt archive');
+    const expected = 'a'.repeat(64);
+    const actual = await calculateChecksum(file, 'sha256');
+
+    await expect(
+      verifyChecksum(
+        file,
+        {algorithm: 'sha256', value: expected},
+        {distribution: 'Corretto', version: '21.0.8'}
+      )
+    ).rejects.toThrow(
+      `Checksum verification failed for Corretto version 21.0.8: sha256 expected ${expected}, actual ${actual}.`
+    );
+  });
+
+  it('rejects malformed digest metadata before reading the file', async () => {
+    await expect(
+      verifyChecksum(
+        '/missing/archive',
+        {algorithm: 'sha512', value: 'not-a-digest'},
+        {distribution: 'Test', version: '17'}
+      )
+    ).rejects.toThrow(
+      'Malformed sha512 checksum metadata: expected a 128-character hexadecimal digest.'
+    );
+  });
+
+  it.each([undefined, null, 123])(
+    'reports a malformed digest when the value is %p',
+    async value => {
+      const checksum = {
+        algorithm: 'sha256',
+        value
+      } as unknown as ChecksumMetadata;
+
+      await expect(
+        verifyChecksum('/missing/archive', checksum, {
+          distribution: 'Test',
+          version: '17'
+        })
+      ).rejects.toThrow(
+        'Malformed sha256 checksum metadata: expected a 64-character hexadecimal digest.'
+      );
+    }
+  );
+
+  it('rejects unsupported algorithms without leaking source query parameters', async () => {
+    const checksum = {
+      algorithm: 'md5',
+      value: 'a'.repeat(32),
+      source: 'https://vendor.example/checksum.txt?token=secret-value#private'
+    } as unknown as ChecksumMetadata;
+
+    let message = '';
+    try {
+      await verifyChecksum('/missing/archive', checksum, {
+        distribution: 'Test',
+        version: '17'
+      });
+    } catch (error) {
+      message = (error as Error).message;
+    }
+
+    expect(message).toContain(
+      "Unsupported checksum algorithm 'md5' from https://vendor.example/checksum.txt"
+    );
+    expect(message).not.toContain('secret-value');
+    expect(message).not.toContain('token=');
+    expect(message).not.toContain('#private');
+  });
+
+  it('surfaces file read errors', async () => {
+    await expect(
+      verifyChecksum(
+        '/missing/archive',
+        {algorithm: 'sha256', value: 'a'.repeat(64)},
+        {distribution: 'Test', version: '17'}
+      )
+    ).rejects.toMatchObject({code: 'ENOENT'});
+  });
+});

__tests__/cleanup-java.test.ts

@@ -0,0 +1,410 @@
+import {
+  jest,
+  describe,
+  it,
+  expect,
+  beforeEach,
+  afterEach,
+  beforeAll,
+  afterAll
+} from '@jest/globals';
+import fs from 'fs';
+import os from 'os';
+import path from 'path';
+
+// Mock @actions/cache before importing source modules
+const real_cache_module = await import('@actions/cache');
+jest.unstable_mockModule('@actions/cache', () => ({
+  ...real_cache_module,
+  saveCache: jest.fn(),
+  restoreCache: jest.fn()
+}));
+
+// Mock @actions/core before importing source modules that depend on it
+jest.unstable_mockModule('@actions/core', () => ({
+  info: jest.fn(),
+  warning: jest.fn(),
+  debug: jest.fn(),
+  error: jest.fn(),
+  notice: jest.fn(),
+  setFailed: jest.fn(),
+  setOutput: jest.fn(),
+  getInput: jest.fn(),
+  getBooleanInput: jest.fn(),
+  getMultilineInput: jest.fn(),
+  addPath: jest.fn(),
+  exportVariable: jest.fn(),
+  saveState: jest.fn(),
+  getState: jest.fn(),
+  setSecret: jest.fn(),
+  isDebug: jest.fn(() => false),
+  startGroup: jest.fn(),
+  endGroup: jest.fn(),
+  group: jest.fn((_name: string, fn: () => Promise<unknown>) => fn()),
+  toPlatformPath: jest.fn((p: string) => p),
+  toWin32Path: jest.fn((p: string) => p),
+  toPosixPath: jest.fn((p: string) => p)
+}));
+
+const real_util_module = await import('../src/util.js');
+jest.unstable_mockModule('../src/util.js', () => ({
+  ...real_util_module,
+  extractJdkFile: jest.fn(),
+  getDownloadArchiveExtension: jest.fn(),
+  getToolcachePath: jest.fn(),
+  isJobStatusSuccess: jest.fn(),
+  renameWinArchive: jest.fn(),
+  isVersionSatisfies: real_util_module.isVersionSatisfies,
+  getTempDir: real_util_module.getTempDir
+}));
+
+// Dynamic imports after mocking
+const core = await import('@actions/core');
+const cache = await import('@actions/cache');
+const {run: cleanup} = await import('../src/cleanup-java.js');
+const util = await import('../src/util.js');
+const constants = await import('../src/constants.js');
+const {GPG_HOME_PREFIX} = await import('../src/gpg.js');
+const {registerJdk, buildJdkCacheKey} = await import('../src/jdk-cache.js');
+
+const jdkTempRoots: string[] = [];
+
+describe('cleanup', () => {
+  let spyWarning: any;
+  let spyInfo: any;
+  let spyCacheSave: any;
+  let spyJobStatusSuccess: any;
+  let spyCoreError: any;
+
+  beforeEach(() => {
+    spyWarning = core.warning as jest.Mock;
+    spyWarning.mockImplementation(() => null);
+
+    spyInfo = core.info as jest.Mock;
+    spyInfo.mockImplementation(() => null);
+
+    spyCacheSave = cache.saveCache as jest.Mock;
+
+    spyJobStatusSuccess = util.isJobStatusSuccess as jest.Mock;
+    spyJobStatusSuccess.mockReturnValue(true);
+
+    // Mock core.error to suppress error logs
+    spyCoreError = core.error as jest.Mock;
+    spyCoreError.mockImplementation(() => {});
+
+    createStateForSuccessfulRestore();
+  });
+
+  afterEach(() => {
+    while (jdkTempRoots.length) {
+      fs.rmSync(jdkTempRoots.pop()!, {recursive: true, force: true});
+    }
+    resetState();
+    jest.resetAllMocks();
+    jest.clearAllMocks();
+    jest.restoreAllMocks();
+  });
+
+  it('does not warn/fail even when the save process throws a ReserveCacheError', async () => {
+    spyCacheSave.mockImplementation((paths: string[], key: string) =>
+      Promise.reject(
+        new cache.ReserveCacheError(
+          'Unable to reserve cache with key, another job may be creating this cache.'
+        )
+      )
+    );
+    (core.getInput as jest.Mock<any>).mockImplementation((name: string) => {
+      return name === 'cache' ? 'gradle' : '';
+    });
+
+    await cleanup();
+    expect(spyCacheSave).toHaveBeenCalled();
+    expect(spyWarning).not.toHaveBeenCalled();
+  });
+
+  it('removes the isolated GPG home without touching unrelated key material', async () => {
+    const tempDir = util.getTempDir();
+    fs.mkdirSync(tempDir, {recursive: true});
+    const gpgHome = fs.mkdtempSync(path.join(tempDir, GPG_HOME_PREFIX));
+    const unrelatedGpgHome = fs.mkdtempSync(
+      path.join(tempDir, 'user-gpg-home-')
+    );
+    fs.writeFileSync(
+      path.join(unrelatedGpgHome, 'private.key'),
+      'pre-existing'
+    );
+    (core.getInput as jest.Mock<any>).mockReturnValue('');
+    (core.getState as jest.Mock<any>).mockImplementation((name: string) =>
+      name === constants.STATE_GPG_HOME ? gpgHome : ''
+    );
+
+    await cleanup();
+
+    expect(fs.existsSync(gpgHome)).toBe(false);
+    expect(
+      fs.readFileSync(path.join(unrelatedGpgHome, 'private.key'), 'utf8')
+    ).toBe('pre-existing');
+    fs.rmSync(unrelatedGpgHome, {recursive: true, force: true});
+  });
+
+  it('makes repeated cleanup of the same GPG home idempotent', async () => {
+    const tempDir = util.getTempDir();
+    fs.mkdirSync(tempDir, {recursive: true});
+    const gpgHome = fs.mkdtempSync(path.join(tempDir, GPG_HOME_PREFIX));
+    (core.getInput as jest.Mock<any>).mockReturnValue('');
+    (core.getState as jest.Mock<any>).mockImplementation((name: string) =>
+      name === constants.STATE_GPG_HOME ? gpgHome : ''
+    );
+
+    await cleanup();
+    await cleanup();
+
+    expect(fs.existsSync(gpgHome)).toBe(false);
+    expect(core.setFailed).not.toHaveBeenCalled();
+  });
+
+  it('skips GPG cleanup when no home was persisted', async () => {
+    (core.getInput as jest.Mock<any>).mockReturnValue('');
+    (core.getState as jest.Mock<any>).mockReturnValue('');
+
+    await cleanup();
+
+    expect(spyInfo).not.toHaveBeenCalledWith(
+      'Removing private key from isolated GPG home'
+    );
+    expect(core.setFailed).not.toHaveBeenCalled();
+  });
+
+  it('does not fail even though the save process throws error', async () => {
+    spyCacheSave.mockImplementation((paths: string[], key: string) =>
+      Promise.reject(new Error('Unexpected error'))
+    );
+    (core.getInput as jest.Mock<any>).mockImplementation((name: string) => {
+      return name === 'cache' ? 'gradle' : '';
+    });
+    await cleanup();
+    expect(spyCacheSave).toHaveBeenCalled();
+  });
+
+  it.each(['maven', 'gradle', 'sbt'])(
+    'does not save the %s cache in read-only mode',
+    async packageManager => {
+      createStateForSuccessfulRestoreWithWrapper(packageManager);
+      (core.getInput as jest.Mock<any>).mockImplementation((name: string) => {
+        switch (name) {
+          case 'cache':
+            return packageManager;
+          case 'cache-read-only':
+            return 'true';
+          default:
+            return '';
+        }
+      });
+
+      await cleanup();
+
+      expect(spyCacheSave).not.toHaveBeenCalled();
+      expect(core.getState).toHaveBeenCalledTimes(1);
+      expect(core.getState).toHaveBeenCalledWith(constants.STATE_GPG_HOME);
+      expect(spyInfo).toHaveBeenCalledWith(
+        'Cache saving is skipped because cache-read-only is enabled.'
+      );
+    }
+  );
+
+  it('saves the cache when read-only mode is explicitly disabled', async () => {
+    spyCacheSave.mockResolvedValue(0);
+    (core.getInput as jest.Mock<any>).mockImplementation((name: string) => {
+      switch (name) {
+        case 'cache':
+          return 'maven';
+        case 'cache-read-only':
+          return 'false';
+        default:
+          return '';
+      }
+    });
+
+    await cleanup();
+
+    expect(spyCacheSave).toHaveBeenCalled();
+  });
+
+  it('saves the JDK cache without dependency caching', async () => {
+    const {key, path: jdkPath, state} = createRegisteredJdk();
+    (core.getInput as jest.Mock<any>).mockImplementation((name: string) =>
+      name === 'cache-jdk' ? 'true' : ''
+    );
+    (core.getState as jest.Mock<any>).mockImplementation((name: string) =>
+      name === 'jdk-caches' ? state : ''
+    );
+    spyCacheSave.mockResolvedValue(1);
+
+    await cleanup();
+
+    expect(spyCacheSave).toHaveBeenCalledWith([jdkPath], key);
+  });
+
+  it('does not save a JDK cache when cache-jdk is disabled', async () => {
+    (core.getInput as jest.Mock<any>).mockImplementation((name: string) =>
+      name === 'cache-jdk' ? 'false' : ''
+    );
+
+    await cleanup();
+
+    expect(spyCacheSave).not.toHaveBeenCalled();
+  });
+
+  it.each([
+    ['', '', false],
+    ['', 'true', true],
+    ['', 'false', false],
+    ['maven', '', true],
+    ['maven', 'true', true],
+    ['maven', 'false', false]
+  ])(
+    'uses effective JDK caching for cache=%j and cache-jdk=%j',
+    async (cacheInput, cacheJdkInput, expectedJdkSave) => {
+      const {key: jdkKey, path: jdkPath, state} = createRegisteredJdk();
+      (core.getInput as jest.Mock<any>).mockImplementation((name: string) => {
+        if (name === 'cache') return cacheInput;
+        if (name === 'cache-jdk') return cacheJdkInput;
+        return '';
+      });
+      (core.getState as jest.Mock<any>).mockImplementation((name: string) =>
+        name === 'jdk-caches' ? state : ''
+      );
+      spyCacheSave.mockResolvedValue(1);
+
+      await cleanup();
+
+      const jdkSaveCalls = spyCacheSave.mock.calls.filter(
+        ([, key]) => key === jdkKey
+      );
+      expect(jdkSaveCalls).toHaveLength(expectedJdkSave ? 1 : 0);
+      if (expectedJdkSave) {
+        expect(spyCacheSave).toHaveBeenCalledWith([jdkPath], jdkKey);
+      }
+    }
+  );
+
+  it('keeps saving the remaining JDK caches when one save fails', async () => {
+    const first = createRegisteredJdk();
+    const second = createRegisteredJdk('17.0.19+9');
+    (core.getInput as jest.Mock<any>).mockImplementation((name: string) =>
+      name === 'cache-jdk' ? 'true' : ''
+    );
+    (core.getState as jest.Mock<any>).mockImplementation((name: string) =>
+      name === 'jdk-caches' ? second.state : ''
+    );
+    spyCacheSave.mockImplementation(async (paths: string[]) => {
+      if (paths[0] === first.path) {
+        throw new Error('Unexpected save failure');
+      }
+      return 1;
+    });
+
+    await cleanup();
+
+    expect(spyCacheSave).toHaveBeenCalledWith([first.path], first.key);
+    expect(spyCacheSave).toHaveBeenCalledWith([second.path], second.key);
+    expect(spyCoreError).not.toHaveBeenCalled();
+  });
+
+  it('does not save a JDK installation that was replaced after registration', async () => {
+    const {key, path: jdkPath, state, replace} = createRegisteredJdk();
+    (core.getInput as jest.Mock<any>).mockImplementation((name: string) =>
+      name === 'cache-jdk' ? 'true' : ''
+    );
+    (core.getState as jest.Mock<any>).mockImplementation((name: string) =>
+      name === 'jdk-caches' ? state : ''
+    );
+    spyCacheSave.mockResolvedValue(1);
+    replace();
+
+    await cleanup();
+
+    expect(spyCacheSave).not.toHaveBeenCalledWith([jdkPath], key);
+  });
+});
+
+function resetState() {
+  (core.getState as jest.Mock).mockReset();
+}
+
+/**
+ * Create states to emulate a successful restore process.
+ */
+function createStateForSuccessfulRestore() {
+  (core.getState as jest.Mock<any>).mockImplementation((name: any) => {
+    switch (name) {
+      case 'cache-primary-key':
+        return 'setup-java-cache-primary-key';
+      case 'cache-matched-key':
+        return 'setup-java-cache-matched-key';
+      default:
+        return '';
+    }
+  });
+}
+
+function createStateForSuccessfulRestoreWithWrapper(packageManager: string) {
+  (core.getState as jest.Mock<any>).mockImplementation((name: any) => {
+    switch (name) {
+      case 'cache-primary-key':
+        return 'setup-java-cache-primary-key';
+      case 'cache-matched-key':
+        return 'setup-java-cache-matched-key';
+      case `cache-primary-key-${packageManager}-wrapper`:
+        return `setup-java-${packageManager}-wrapper-primary-key`;
+      default:
+        return '';
+    }
+  });
+}
+
+/**
+ * Register a real JDK installation in a temporary tool cache so the post-job
+ * save sees the same installation identity that setup recorded.
+ */
+function createRegisteredJdk(version = '21.0.8+9') {
+  const root = fs.mkdtempSync(
+    path.join(os.tmpdir(), 'setup-java-cleanup-jdk-')
+  );
+  jdkTempRoots.push(root);
+  const jdkPath = path.join(
+    root,
+    'Java_temurin_jdk',
+    version.replace('+', '-')
+  );
+  const write = (marker: string) => {
+    const architecturePath = path.join(jdkPath, 'x64');
+    fs.rmSync(architecturePath, {recursive: true, force: true});
+    fs.rmSync(`${architecturePath}.complete`, {force: true});
+    fs.mkdirSync(architecturePath, {recursive: true});
+    fs.writeFileSync(path.join(architecturePath, 'release'), marker);
+    fs.writeFileSync(`${architecturePath}.complete`, marker);
+  };
+  write('installed');
+
+  const jdk = {
+    distribution: 'temurin',
+    packageType: 'jdk',
+    architecture: 'x64',
+    version,
+    source: `sha256:${path.basename(root)}`,
+    verification: 'unverified',
+    path: jdkPath
+  };
+  registerJdk(jdk);
+  const state = (
+    (core.saveState as jest.Mock).mock.calls.at(-1) as string[]
+  )[1];
+
+  return {
+    key: buildJdkCacheKey(jdk),
+    path: jdkPath,
+    state,
+    replace: () => write('replaced-by-a-later-step')
+  };
+}