Add force-download option for reproducible JDK builds

[Copilot]

Description:
Runner-cached JDKs may contain system-modified certificate stores, producing non-reproducible runtime images.

• Add force-download to bypass and replace matching tool-cache installations.
• Apply the behavior to downloaded distributions and jdkfile.
• Document the input and add cache-bypass coverage.

with:
  distribution: temurin
  java-version: '25.0.2'
  force-download: true

Related issue:

Check list:

• Ran npm run check locally (format, lint, build, test) and all checks pass.
• Mark if documentation changes are required.
• Mark if tests were added or updated to cover the changes.

• Fixes Add force-download option for reproducible builds #979

[Copilot]

Pull request overview

Adds a new force-download input to actions/setup-java to bypass potentially system-modified runner tool-cache JDKs (e.g., modified cacerts) and ensure reproducible JDK artifacts by always downloading/unpacking and re-caching the requested version.

Changes:

• Introduces force-download input plumbing (constants, action.yml, README) and passes it through installer options.
• Updates the base installer and jdkfile (local) distribution to skip tool-cache resolution when force-download is enabled.
• Adds unit tests covering cache-bypass behavior and updates bundled dist/* artifacts.

Show a summary per file

File	Description
src/setup-java.ts	Reads force-download input and forwards it into JavaInstallerOptions.
src/distributions/local/installer.ts	Skips tool-cache resolution for jdkfile installs when force-download is enabled.
src/distributions/base-models.ts	Extends installer options model with forceDownload.
src/distributions/base-installer.ts	Implements tool-cache bypass in the common installer flow and ensures latest-resolution doesn’t fall back to cache when forced.
src/constants.ts	Adds INPUT_FORCE_DOWNLOAD constant.
README.md	Documents the new force-download input and its reproducibility motivation.
action.yml	Declares force-download input for the action.
tests/distributors/local-installer.test.ts	Adds coverage for jdkfile extraction path when force-download is enabled.
tests/distributors/base-installer.test.ts	Adds coverage ensuring tool-cache lookup is skipped when force-download is enabled.
dist/setup/index.js	Updates bundled action output to include force-download behavior.
dist/cleanup/index.js	Updates bundled cleanup output to include the new constant.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

Comments suppressed due to low confidence (1)

src/distributions/local/installer.ts:35

• When force-download is enabled, the tool-cache lookup is intentionally skipped, but the log message in the else branch still says the version "was not found in tool-cache". This is misleading for users trying to understand why a cached JDK wasn’t used.

    let foundJava = this.forceDownload ? null : this.findInToolcache();

    if (foundJava) {
      core.info(`Resolved Java ${foundJava.version} from tool-cache`);
    } else {

• Files reviewed: 9/11 changed files
• Comments generated: 0
• Review effort level: Low