This is an automated email from the ASF dual-hosted git repository.
jdaugherty pushed a commit to branch 8.0.x
in repository https://gitbox.apache.org/repos/asf/grails-core.git
The following commit(s) were added to refs/heads/8.0.x by this push:
new 2a30340391 Read java version from .sdkmanrc
2a30340391 is described below
commit 2a303403915704088f37d2027345fb48feae26ef
Author: James Daugherty <[email protected]>
AuthorDate: Fri Aug 21 10:32:43 2026 -0400
Read java version from .sdkmanrc
---
.github/workflows/vulnerability-scan.yml | 34 ++++++++++++++++++++++++++++++--
1 file changed, 32 insertions(+), 2 deletions(-)
diff --git a/.github/workflows/vulnerability-scan.yml
b/.github/workflows/vulnerability-scan.yml
index 7195dc86b8..55d2225c12 100644
--- a/.github/workflows/vulnerability-scan.yml
+++ b/.github/workflows/vulnerability-scan.yml
@@ -45,11 +45,26 @@ jobs:
steps:
- name: "📥 Checkout repository"
uses: actions/checkout@v6
+ - name: "☕️ Determine Java version from .sdkmanrc"
+ # Read the JDK the build targets out of the file that already declares
it, so a
+ # baseline bump does not leave a stale literal behind here. Only the
major is kept:
+ # a scan is outside the reproducible-build surface, so CI takes the
runner's current
+ # release of that major rather than pinning the patch version.
+ id: sdkmanrc
+ run: |
+ set -euo pipefail
+ sdkman_java=$(grep -E '^java=' .sdkmanrc | cut -d= -f2 || true)
+ if [ -z "${sdkman_java}" ]; then
+ echo "❌ Could not determine the java version from .sdkmanrc" >&2
+ exit 1
+ fi
+ echo "Scanning with JDK ${sdkman_java%%.*} (from .sdkmanrc:
${sdkman_java})"
+ echo "java-version=${sdkman_java%%.*}" >> "$GITHUB_OUTPUT"
- name: "☕️ Setup JDK"
uses: actions/setup-java@v4
with:
distribution: liberica
- java-version: 17
+ java-version: ${{ steps.sdkmanrc.outputs.java-version }}
- name: "🐘 Setup Gradle"
uses:
gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
with:
@@ -84,11 +99,26 @@ jobs:
steps:
- name: "📥 Checkout pull request"
uses: actions/checkout@v6
+ - name: "☕️ Determine Java version from .sdkmanrc"
+ # Read the JDK the build targets out of the file that already declares
it, so a
+ # baseline bump does not leave a stale literal behind here. Only the
major is kept:
+ # a scan is outside the reproducible-build surface, so CI takes the
runner's current
+ # release of that major rather than pinning the patch version.
+ id: sdkmanrc
+ run: |
+ set -euo pipefail
+ sdkman_java=$(grep -E '^java=' .sdkmanrc | cut -d= -f2 || true)
+ if [ -z "${sdkman_java}" ]; then
+ echo "❌ Could not determine the java version from .sdkmanrc" >&2
+ exit 1
+ fi
+ echo "Scanning with JDK ${sdkman_java%%.*} (from .sdkmanrc:
${sdkman_java})"
+ echo "java-version=${sdkman_java%%.*}" >> "$GITHUB_OUTPUT"
- name: "☕️ Setup JDK"
uses: actions/setup-java@v4
with:
distribution: liberica
- java-version: 17
+ java-version: ${{ steps.sdkmanrc.outputs.java-version }}
- name: "🐘 Setup Gradle"
uses:
gradle/actions/setup-gradle@50e97c2cd7a37755bbfafc9c5b7cafaece252f6e # v6.1.0
with:
