define sdkmanrc and reference it in github action
What the developer wrote
Authored by Craig Raw
define sdkmanrc and reference it in github action
What changed, and why it matters
This commit changes how the project's automated build system selects its Java version. It replaces a direct GitHub setup step with a configuration file (.sdkmanrc) that tells SDKman to use Java 25.0.2 from the Temurin distribution. There is no security-relevant change here—only a tooling and consistency improvement.
No security action required. Reviewers may optionally verify that sdkman-action@v1 is a trusted action and that the .sdkmanrc pin matches the project's intended Java version.
Security signals we found
No strong security signals were identified.
Evidence from the diff
The commit modifies .github/workflows/package.yaml to use actions/sdkman-action@v1 with an .sdkmanrc file instead of actions/setup-java@v5 with explicit distribution and version. The new .sdkmanrc pins java=25.0.2-tem, which is the same Temurin JDK 25.0.2 previously used. This is a build pipeline refactor with no functional, cryptographic, or network code changes.
Changed components
.github/workflows/package.yaml.sdkmanrcInspect captured patch +6 / −4
diff --git a/.github/workflows/package.yaml b/.github/workflows/package.yaml
index 46195c5..0c38bcb 100644
--- a/.github/workflows/package.yaml
+++ b/.github/workflows/package.yaml
@@ -15,11 +15,10 @@ jobs:
- uses: actions/checkout@v6
with:
submodules: recursive
- - name: Set up JDK 25.0.2
- uses: actions/setup-java@v5
+ - name: Set up SDKman and Java
+ uses: actions/sdkman-action@v1
with:
- distribution: 'temurin'
- java-version: '25.0.2'
+ sdkmanrc: .sdkmanrc
- name: Show Build Versions
run: ./gradlew -v
- name: Build with Gradle
diff --git a/.sdkmanrc b/.sdkmanrc
new file mode 100644
index 0000000..5e93e02
--- /dev/null
+++ b/.sdkmanrc
@@ -0,0 +1,3 @@
+# Enable auto-env through the sdkman_auto_env config
+# Add key=value pairs of SDKs to use below
+java=25.0.2-tem
Why this scored 15/100
Community notes
Notes can correct, qualify, or add evidence to the AI analysis. Every note shown here has been validated by a human moderator.
The AI analysis stands alone for now. Submit a note if you can add evidence or important context.