$ show actions/setup-java
This repository implements a GitHub Action (`actions/setup-java`) that installs a Java JDK or JRE in CI environments. It supports 17+ distributions (Adoptium Temurin, Azul Zulu, Microsoft, Amazon Corretto, GraalVM, Liberica, etc.) and resolves versions from user input, version files (`.java-version`, `.tool-versions`, `.sdkmanrc`), or the `latest` alias. The action also sets up dependency caching for Maven, Gradle, and sbt, generates Maven settings.xml with server credentials and GPG signing profiles, and handles Maven toolchains.xml merging across workflow steps. It includes signature verification (GPG) for Temurin and Microsoft distributions and checksum verification for downloaded archives. The architecture is modular: a factory pattern lazily loads distribution-specific installer classes (each extending an abstract `JavaBase`), which handle version resolution, download, extraction, and tool-cache registration. A separate cache system (JDK binary cache, dependency cache, and resolution cache) uses GitHub Actions cache primitives with configurable retention. The codebase is written in TypeScript and heavily leverages the `@actions/*` toolkit. Tests mock all external dependencies and use static JSON fixtures to simulate vendor APIs. The action is deployed as compiled bundles in `dist/` and is actively maintained with comprehensive CI workflows for e2e testing across OS, architecture, and distribution variants. The core value of this repository is its reliability and breadth of support: it automates the brittle process of Java version management in CI, handles edge cases like early-access builds, floating version tags, and platform-specific package types (jdk+fx, jdk+jmods, etc.). The caching and retry logic reduce pipeline execution time and failure rates. While tightly integrated with GitHub Actions, several internal modules (retrying HTTP client, checksum verification, XML escaping) are isolated enough for potential extraction into other TypeScript projects.
The LLM identified 3 files worth highlighting for reuse:
Implements an HTTP client (wrapping @actions/http-client) with configurable retry logic (numAttempts, delay, jitter) and rate-limit handling (retry-after header). The retry strategy uses exponential backoff with optional jitter to avoid thundering herd. The class is self-contained (only imports 'crypto' and '@actions/http-client') and can be extracted into any TypeScript project needing resilient HTTP requests.
Provides secure checksum verification using Node.js crypto module. Supports SHA-256 and SHA-512, compares digests in constant time (timingSafeEqual) to prevent timing attacks. Handles both raw hex digests and GNU-style checksum files (lines with checksum and filename). Isolated to imports only from 'crypto' and 'fs', making it directly reusable in any Node.js project for verifying downloaded files.
Exports a single `escapeXmlText` function that escapes special XML characters (&, <, >, ", '). This is a foundational security utility used when injecting user-provided values (server credentials, repository URLs) into generated Maven settings.xml or toolchains.xml. The implementation is trivial but demonstrates a correct, complete escaping table; it has zero internal dependencies and can be copied into any project needing safe XML construction.