Summary
Today, the list of Microsoft Build of OpenJDK binaries used by setup-java is obtained from a static JSON manifest committed to this repository at src/distributions/microsoft/microsoft-openjdk-versions.json, which is fetched at runtime via the GitHub Contents API:
https://api.github.com/repos/actions/setup-java/contents/src/distributions/microsoft/microsoft-openjdk-versions.json?ref=main
The code even acknowledges this is not ideal — getAvailableVersions() in src/distributions/microsoft/installer.ts carries a // TODO get these dynamically! comment noting "We will need Microsoft to add an endpoint where we can query for versions."
Problems with the current approach
- Manual updates required — every new Microsoft JDK release requires a hand-edited PR to the JSON file.
- Outdated versions — because updates are manual, the manifest lags behind actual Microsoft releases.
- Rate limiting — fetching the manifest via the GitHub API can hit rate limits during workflow runs, especially on GHES.
Decision / Intent
Per maintainer feedback in #928 (comment):
We will look into continue using a JSON file, however hosted somewhere else we can automate its generation.
We want to keep the JSON-file model (it is simple, predictable, and resilient) but:
- Host the JSON file outside the repo / off the GitHub Contents API so resolving versions no longer counts against GitHub API rate limits.
- Automate the generation of that JSON file so new Microsoft JDK releases are picked up without manual PRs and the list stays current.
This is explicitly in preference to the alternative proposed in #928 of scraping the Microsoft Learn HTML download page at runtime, which is considered too fragile (it breaks whenever Microsoft changes their website).
Proposed direction (open for discussion)
- Stand up an automated job (e.g., a scheduled GitHub Action) that generates/refreshes the
microsoft-openjdk-versions.json manifest from an authoritative Microsoft source.
- Publish the generated JSON to a stable hosted location (e.g.,
aka.ms/a Microsoft-owned endpoint, GitHub Releases asset, or raw CDN) not subject to GitHub API rate limiting.
- Update
MicrosoftDistributions.getAvailableVersions() to read from that hosted URL instead of the GitHub Contents API.
- Keep the JSON schema compatible with
tc.findFromManifest so the resolution logic in findPackageForDownload() is unchanged.
Acceptance criteria
References
Summary
Today, the list of Microsoft Build of OpenJDK binaries used by
setup-javais obtained from a static JSON manifest committed to this repository atsrc/distributions/microsoft/microsoft-openjdk-versions.json, which is fetched at runtime via the GitHub Contents API:The code even acknowledges this is not ideal —
getAvailableVersions()insrc/distributions/microsoft/installer.tscarries a// TODO get these dynamically!comment noting "We will need Microsoft to add an endpoint where we can query for versions."Problems with the current approach
Decision / Intent
Per maintainer feedback in #928 (comment):
We want to keep the JSON-file model (it is simple, predictable, and resilient) but:
This is explicitly in preference to the alternative proposed in #928 of scraping the Microsoft Learn HTML download page at runtime, which is considered too fragile (it breaks whenever Microsoft changes their website).
Proposed direction (open for discussion)
microsoft-openjdk-versions.jsonmanifest from an authoritative Microsoft source.aka.ms/a Microsoft-owned endpoint, GitHub Releases asset, or raw CDN) not subject to GitHub API rate limiting.MicrosoftDistributions.getAvailableVersions()to read from that hosted URL instead of the GitHub Contents API.tc.findFromManifestso the resolution logic infindPackageForDownload()is unchanged.Acceptance criteria
setup-javaresolves Microsoft JDK versions from that hosted JSON.References
src/distributions/microsoft/installer.tssrc/distributions/microsoft/microsoft-openjdk-versions.json