You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Looks like the intention was to remove the oracle jdk feature by rolling back 3.7.0. Would have been great to roll forward to 4.0.0 instead since the removal is a breaking change.
For now I think the best way forward is to fix broken builds by re-releasing 3.7.0 to HEAD or to at least 3.6.0 - if that's to be considered a stable version.
Reacted by fgarsombke, Stephan Schroevers, Rick Ossendrijver, Danilo Pianini and Felix Neumann
Reacted by Stephan Schroevers, Colin White, Jaime Moncayo, Nicolas Baumann, Niklas, kenji yoshida, Rohit Karadkar, Rick Ossendrijver, Frode Evensen, Danilo Pianini and 3 more
Reacted by fgarsombke, Jaime Moncayo, Niklas and James A Sutherland
Please just tag 3.6.0 also as 3.7.0 (or 3.7.1 / 3.8.0) to fix the majority of problems. All our actions were updated automatically and it would cost much time to downgrade them manually.
Reacted by Frode Evensen, Michael Arndt, kenji yoshida and lokigin
It's worrying that this is possible. 3.7.0 could be re-released with any code at all - if they had been malicious this could have happened quickly after most of us had auto-upgraded and it would have slipped through without anyone noticing
Just to be certain: That is a GitHub Actions design decision and not an issue of the setup-java maintainers. This can happen with any action you use. If that is of concern you should switch to using the commit id of the action.
Reacted by Michael Arndt, Christoph Strebin, Frode Evensen and Felix Neumann
Just to be certain: That is a GitHub Actions design decision and not an issue of the setup-java maintainers. This can happen with any action you use. If that is of concern you should switch to using the commit id of the action.
This can happen but should not. Retracting released software (except in case of extreme security concerns, in which case I'd expect a notification and explanation) is a bad practice that disrupts your clients. Some software repos forbid it altogether (Maven Central), and others have a more flexible policy (NPM), but all of them state the criterion and allow others to adapt.
Retracting versions just because it is as simple as deleting a git tag is not a great move, IMHO. As others suggested already, in case of mistakes it would be much better to release a patch.
Reacted by Stephan Schroevers, Anders R. Thorbeck, Kyle Roe, Xavier Alvarez, Rick Ossendrijver and Daniel Santos
Hello everyone. As you all are probably aware, the legal points of OracleJdk still need to be tackled and we had to delete this release of the new distribution. I would like to apologize for the inconvenience it has introduced to many of our customers, and we will do our best to prevent similar incidents from happening in the future.
Thank you for understanding the situation, I will close this issue for now.
Hello everyone. We had discussions with Oracle teams and confirmed that we can add support for Oracle OpenJDK. We've released a new version of the action with support of Oracle OpenJDK. We are sorry for the confusion.
Activity
ArloL commentedon Dec 5, 2022
Looks like the intention was to remove the oracle jdk feature by rolling back 3.7.0. Would have been great to roll forward to 4.0.0 instead since the removal is a breaking change.
For now I think the best way forward is to fix broken builds by re-releasing 3.7.0 to HEAD or to at least 3.6.0 - if that's to be considered a stable version.
fgarsombke commentedon Dec 5, 2022
That would be fantastic, we have a lot of repositories to modify and rebuild if we can't get that release back :)
JakeWharton commentedon Dec 5, 2022
With the presence of tools like Dependabot and Renovate hundreds of repositories migrated and are now broken: https://github.com/search?q=%22actions%2Fsetup-java%40v3.7.0%22&type=code
wtf actions/setup-java#422
ci: switch back to actions/setup-java@v3.6.0
Revert "Upgrade actions/setup-java v3.6.0 -> v3.7.0 (#381)"
Downgrade actions/setup-java v3.7.0 -> v3.6.0 (#392)
merge: #589
PatrickGotthard commentedon Dec 6, 2022
Please just tag 3.6.0 also as 3.7.0 (or 3.7.1 / 3.8.0) to fix the majority of problems. All our actions were updated automatically and it would cost much time to downgrade them manually.
Change version of setup-java action to 'v3'
DanySK commentedon Dec 6, 2022
Wow, this destroyed dozens of my pipelines. Please, please, never delete releases anymore 🙏
jdrphillips commentedon Dec 6, 2022
It's worrying that this is possible. 3.7.0 could be re-released with any code at all - if they had been malicious this could have happened quickly after most of us had auto-upgraded and it would have slipped through without anyone noticing
revert: update actions/setup-java action to v3.7.0" (#245) due to bug a…
ArloL commentedon Dec 6, 2022
Just to be certain: That is a GitHub Actions design decision and not an issue of the setup-java maintainers. This can happen with any action you use. If that is of concern you should switch to using the commit id of the action.
DanySK commentedon Dec 6, 2022
This can happen but should not. Retracting released software (except in case of extreme security concerns, in which case I'd expect a notification and explanation) is a bad practice that disrupts your clients. Some software repos forbid it altogether (Maven Central), and others have a more flexible policy (NPM), but all of them state the criterion and allow others to adapt.
Retracting versions just because it is as simple as deleting a git tag is not a great move, IMHO. As others suggested already, in case of mistakes it would be much better to release a patch.
Change version of setup-java action to 'v3' (#394)
Gakk commentedon Dec 6, 2022
Approx. 15 minutes ago a new version 3.8.0 was released 😃
fgarsombke commentedon Dec 6, 2022
I guess we are updating a few dozen repositories this morning 🥲 ...
garydgregory commentedon Dec 8, 2022
It happened to all of the Apache Commons repositories, not fun.
revert: actions/setup-java from 3.7.0 to 3.6.0
revert: actions/setup-java from 3.7.0 to 3.6.0
panticmilos commentedon Jan 9, 2023
Hello everyone. As you all are probably aware, the legal points of OracleJdk still need to be tackled and we had to delete this release of the new distribution. I would like to apologize for the inconvenience it has introduced to many of our customers, and we will do our best to prevent similar incidents from happening in the future.
Thank you for understanding the situation, I will close this issue for now.
dmitry-shibanov commentedon Feb 7, 2023
Hello everyone. We had discussions with Oracle teams and confirmed that we can add support for Oracle OpenJDK. We've released a new version of the action with support of Oracle OpenJDK. We are sorry for the confusion.