CI: fix setup-java ea temurin sigcheck failure

[mbien]

setup-java action got updated to 6.01.

2026-09-10T09:25:40.6652165Z Download action repository 'actions/setup-java@v6' (SHA:de7274f081f381c8f8158605e0321c36c376e2e6)

and is now failing

  Downloading Java 27.0.0+35.0.ea (Temurin-Hotspot) from https://github.com/adoptium/temurin27-binaries/releases/download/jdk-27%2B35-ea-beta/OpenJDK27U-jdk_x64_linux_hotspot_27_35-ea.tar.gz ...
  Error: Java setup process failed due to: Checksum verification failed for Temurin-Hotspot version 27.0.0+35.0.ea: sha256 expected 8f2b21d827d4bccc7b3fe0ef0cdc4b5d1ffaa47b587bb3c8dcb8eec3e57c95b0, actual bc2676d99d27fb3bb28fd8cef928d8eb1f20eb388b72d291875ed8b08b25bff4.
  Error: Checksum verification failed for Temurin-Hotspot version 27.0.0+35.0.ea: sha256 expected 8f2b21d827d4bccc7b3fe0ef0cdc4b5d1ffaa47b587bb3c8dcb8eec3e57c95b0, actual bc2676d99d27fb3bb28fd8cef928d8eb1f20eb388b72d291875ed8b08b25bff4.

whats funny is that the setup-java update is supposed to have a fix for this very issue: actions/setup-java#1260 / https://github.com/actions/setup-java/releases/tag/v6.0.1

[mbien]

looks like that field doesn't do anything. It checks the sig despite it evaluating to false

2026-09-10T10:07:39.5499068Z   java-version: 27-ea
2026-09-10T10:07:39.5499772Z   distribution: temurin
2026-09-10T10:07:39.5500282Z   problem-matcher: false
2026-09-10T10:07:39.5500796Z   verify-signature: false
2026-09-10T10:07:39.5501307Z   java-package: jdk
2026-09-10T10:07:39.5501776Z   check-latest: false
2026-09-10T10:07:39.5502250Z   force-download: false
2026-09-10T10:07:39.5502739Z   set-default: true
2026-09-10T10:07:39.5503206Z   server-id: github
2026-09-10T10:07:39.5503715Z   mvn-repositories-include-central: true
2026-09-10T10:07:39.5504363Z   mvn-repositories-prioritize-central: true
2026-09-10T10:07:39.5504987Z   overwrite-settings: true
2026-09-10T10:07:39.5505519Z   cache-read-only: false
2026-09-10T10:07:39.5506014Z   job-status: success
2026-09-10T10:07:39.5510059Z   token: ***
2026-09-10T10:07:39.5510545Z   show-download-progress: false
2026-09-10T10:07:39.5511358Z env:
2026-09-10T10:07:39.5512015Z   OPTS: -Dtest-unit-sys-prop.ignore.random.failures=true
2026-09-10T10:07:39.5512693Z   CLUSTER_CONFIG: full
2026-09-10T10:07:39.5513192Z   DEFAULT_JAVA_DISTRIBUTION: temurin
2026-09-10T10:07:39.5513740Z   test_java: false
2026-09-10T10:07:39.5514197Z   test_javafx: false
2026-09-10T10:07:39.5514661Z   test_javadoc: false
2026-09-10T10:07:39.5515133Z   test_javascript: false
2026-09-10T10:07:39.5515609Z   test_php: false
2026-09-10T10:07:39.5516055Z   test_groovy: false
2026-09-10T10:07:39.5516521Z   test_rust: false
2026-09-10T10:07:39.5516996Z   test_platform: false
2026-09-10T10:07:39.5517461Z   test_lsp: false
2026-09-10T10:07:39.5517914Z   test_build_tools: false
2026-09-10T10:07:39.5518405Z   test_versioning: false
2026-09-10T10:07:39.5519038Z   test_enterprise: false
2026-09-10T10:07:39.5519900Z   test_web: false
2026-09-10T10:07:39.5520743Z   test_tests: false
2026-09-10T10:07:39.5521207Z ##[endgroup]
2026-09-10T10:07:39.6310569Z ##[group]Installed distributions
2026-09-10T10:07:39.6366035Z Trying to resolve the latest version from remote
2026-09-10T10:07:42.0340037Z Resolved latest version as 27.0.0+35.0.ea
2026-09-10T10:07:42.0342358Z Trying to download...
2026-09-10T10:07:42.0346067Z Downloading Java 27.0.0+35.0.ea (Temurin-Hotspot) from https://github.com/adoptium/temurin27-binaries/releases/download/jdk-27%2B35-ea-beta/OpenJDK27U-jdk_x64_linux_hotspot_27_35-ea.tar.gz ...
2026-09-10T10:07:43.0226328Z ##[error]Java setup process failed due to: Checksum verification failed for Temurin-Hotspot version 27.0.0+35.0.ea: sha256 expected 8f2b21d827d4bccc7b3fe0ef0cdc4b5d1ffaa47b587bb3c8dcb8eec3e57c95b0, actual bc2676d99d27fb3bb28fd8cef928d8eb1f20eb388b72d291875ed8b08b25bff4.
2026-09-10T10:07:43.0245191Z ##[error]Checksum verification failed for Temurin-Hotspot version 27.0.0+35.0.ea: sha256 expected 8f2b21d827d4bccc7b3fe0ef0cdc4b5d1ffaa47b587bb3c8dcb8eec3e57c95b0, actual bc2676d99d27fb3bb28fd8cef928d8eb1f20eb388b72d291875ed8b08b25bff4.
2026-09-10T10:07:43.6058406Z Post job cleanup.
2026-09-10T10:07:43.6895932Z Cleaning up orphan processes

https://github.com/apache/netbeans/actions/runs/34463300876

i guess last resort is action downgrade and pin

[mbien]

still failing. I am out of ideas at this point. Revert workaround and switch vendor?

summary of what i tried so far:

• verify-signature: false
• downgrade to 6.0.0 which we know worked until yesterday
• another run with both at the same time

[neilcsmith-net]

Temporary vendor switch sounds like a good idea. I guess either the Adoptium API or something cached in actions ecosystem is reporting the wrong file hash for that download. I wonder if check-latest and/or force-download work for that file?

[mbien]

will also clear our caches https://github.com/apache/netbeans/actions/caches short before merge. This will rebuild it on master which the other branches can then use.

[mbien]

will change back to temurin when JDK 27 updates from ea to ga.