From 250c498a0c380edaaf54b5ed56ae5afad7fd3532 Mon Sep 17 00:00:00 2001 From: tehw0lf Date: Mon, 5 Oct 2026 22:20:02 +0200 Subject: [PATCH] feat(android): let callers choose the JDK of the APK release job release-android-apk.yml had the JDK hard-coded, and the last Java major update moved it to 25. Gradle wrappers older than 9.1 cannot run on JDK 25, so an app that ships one could no longer be released. The workflow now takes a java_version input (default 25, unchanged behaviour) and the orchestrator passes its own java_version on to it. An app with an older Gradle wrapper passes a JDK its wrapper supports. Closes #177 --- .github/workflows/build-test-publish.yml | 1 + .github/workflows/release-android-apk.yml | 7 ++++++- CLAUDE.md | 21 +++++++++++---------- README.md | 3 ++- renovate.json | 2 +- 5 files changed, 21 insertions(+), 13 deletions(-) diff --git a/.github/workflows/build-test-publish.yml b/.github/workflows/build-test-publish.yml index 767afbf..2b08738 100755 --- a/.github/workflows/build-test-publish.yml +++ b/.github/workflows/build-test-publish.yml @@ -403,6 +403,7 @@ jobs: app_root: ${{ inputs.app_root }} artifact_path: ${{ inputs.artifact_path }} tool: ${{ inputs.tool }} + java_version: ${{ inputs.java_version }} secrets: ANDROID_STOREPASS: ${{ secrets.ANDROID_STOREPASS }} ANDROID_KEYSTORE: ${{ secrets.ANDROID_KEYSTORE }} diff --git a/.github/workflows/release-android-apk.yml b/.github/workflows/release-android-apk.yml index 9a6be10..4f97caa 100644 --- a/.github/workflows/release-android-apk.yml +++ b/.github/workflows/release-android-apk.yml @@ -29,6 +29,11 @@ on: default: "none" required: false type: string + java_version: + description: "Java version to use" + default: "25" + required: false + type: string jobs: release_android_apk: @@ -84,7 +89,7 @@ jobs: uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1 with: distribution: "temurin" - java-version: "25" + java-version: ${{ inputs.java_version }} # The keystore comes from a secret and is never generated here. It used # to live only in the Actions cache, which GitHub evicts after 7 days diff --git a/CLAUDE.md b/CLAUDE.md index d406335..f8dd8b9 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -473,16 +473,17 @@ Renovate's custom managers track: on the active LTS line rather than jumping to an odd/current release. - **npm CLI** — the `npm install -g npm@` pin; minor/patch updates are disabled since the pin only expresses a major. -- **Java** — the `java-version:` pin in `release-android-apk.yml` and the - `java_version` input default in `test-and-build.yml` / `build-test-publish.yml` / - `publish-maven-central.yml`. - The pins differ on purpose (25 generic, 24 android) and a caller may ask for - another major through `java_version`, so a major update is never opened on - its own: it waits as a checkbox in the Dependency Dashboard - (`dependencyDashboardApproval`) until someone asks for the PR. Changing a - default major is a deliberate, tested change — the android pin stays on 24 - until every `app_root` caller runs Gradle 9.1+, the first Gradle that runs on - JDK 25. The pins express a major +- **Java** — the `java_version` input default in `test-and-build.yml` / + `build-test-publish.yml` / `publish-maven-central.yml` / + `release-android-apk.yml`. + All defaults are the same major (25) and a caller may ask for another one + through `java_version`, which the orchestrator also passes to the Android + release job. A major update is never opened on its own: it waits as a + checkbox in the Dependency Dashboard (`dependencyDashboardApproval`) until + someone asks for the PR. Changing the default major is a deliberate, tested + change — JDK 25 needs Gradle 9.1+, so an `app_root` caller with an older + Gradle wrapper has to pass a `java_version` its wrapper supports. The pins + express a major only, so `extractVersionTemplate` cuts the datasource's full versions (`21.0.12+101.0.LTS`) down to the major — without it Renovate tries to write the full version into the pin and the branch fails with "update failure". diff --git a/README.md b/README.md index f346ed2..bd814b4 100644 --- a/README.md +++ b/README.md @@ -105,7 +105,7 @@ _Python, Rust, Firefox, Android, GitHub releases_ | Input | Default | Description | |---|---|---| | `publish_python_libraries` | `false` | Validate build + tag for PyPI release (requires `tool: uv`; upload is parked, see §5) | -| `java_version` | `25` | JDK major version for `tool: ./gradlew` or `mvn` (Temurin). JDK 25 needs Gradle 9.1+; with an older wrapper pass `java_version: "21"` | +| `java_version` | `25` | JDK major version (Temurin) for `tool: ./gradlew` or `mvn`, and for the Android APK release job (`app_root`). JDK 25 needs Gradle 9.1+; with an older wrapper pass `java_version: "21"` | | `go_version` | `""` | Go version for `tool: go`; empty reads it from `go.mod` | | `rust_version` | `stable` | Rust toolchain version | | `enable_clippy` | `true` | Run Clippy | @@ -327,6 +327,7 @@ Builds and releases Android APK files. **Features:** - ✅ Signing keystore from the `ANDROID_KEYSTORE` secret; never generated, so every release is signed with the same key +- ✅ JDK chosen by the caller through `java_version` (default 25); an app whose Gradle wrapper is older than 9.1 has to pass a JDK that wrapper supports - ✅ APK signing and alignment - ✅ GitHub releases integration - ✅ Timeout protection (30 minutes) diff --git a/renovate.json b/renovate.json index 13d510d..dba9d26 100644 --- a/renovate.json +++ b/renovate.json @@ -136,7 +136,7 @@ "groupName": "python security tools" }, { - "description": "Java pins are chosen per job (25 generic default, 24 android) and callers override via java_version; majors are a deliberate, tested change, so they wait for approval in the Dependency Dashboard", + "description": "Java defaults are one major for all jobs and callers override via java_version; majors are a deliberate, tested change, so they wait for approval in the Dependency Dashboard", "matchDepNames": [ "java" ],