Pin OpenJDK version in reproducible binary workflow on release

Author: emlun

doc/releasing.md

@@ -12,21 +12,43 @@ Release candidate versions
     $ ./gradlew clean check
     ```
 
- 3. Tag the head commit with an `X.Y.Z-RCN` tag:
+ 3. Update the Java version in the [`release-verify-signatures`
+    workflow](https://github.com/Yubico/java-webauthn-server/blob/main/.github/workflows/release-verify-signatures.yml#L42).
+
+    See the `openjdk version` line of output from `java -version`:
+
+    ```
+    $ java -version  # (example output below)
+    openjdk version "17.0.7" 2023-04-18
+    OpenJDK Runtime Environment (build 17.0.7+7)
+    OpenJDK 64-Bit Server VM (build 17.0.7+7, mixed mode)
+    ```
+
+    Given the above output as an example, update the workflow like so:
+
+    ```yaml
+    strategy:
+      matrix:
+        java: ["17.0.7"]
+    ```
+
+    Commit this change, if any.
+
+ 4. Tag the head commit with an `X.Y.Z-RCN` tag:
 
     ```
     $ git tag -a -s 1.4.0-RC1 -m "Pre-release 1.4.0-RC1"
     ```
 
     No tag body needed.
 
- 4. Publish to Sonatype Nexus:
+ 5. Publish to Sonatype Nexus:
 
     ```
     $ ./gradlew publishToSonatype closeAndReleaseSonatypeStagingRepository
     ```
 
- 5. Push to GitHub.
+ 6. Push to GitHub.
 
     If the pre-release makes significant changes to the project README, such
     that the README does not accurately reflect the latest non-pre-release
@@ -44,16 +66,17 @@ Release candidate versions
     $ git push origin main 1.4.0-RC1
     ```
 
- 6. Make GitHub release.
+ 7. Make GitHub release.
 
-    - Use the new tag as the release tag
-    - Check the pre-release checkbox
+    - Use the new tag as the release tag.
+    - Check the pre-release checkbox.
     - Copy the release notes from `NEWS` into the GitHub release notes; reformat
       from ASCIIdoc to Markdown and remove line wraps. Include only
       changes/additions since the previous release or pre-release.
-    - Note which JDK version was used to build the artifacts.
+    - Note the JDK version shown by `java -version` in step 3.
+      For example: `openjdk version "17.0.7" 2023-04-18`.
 
- 7. Check that the ["Reproducible binary"
+ 8. Check that the ["Reproducible binary"
     workflow](https://github.com/Yubico/java-webauthn-server/actions/workflows/release-verify-signatures.yml)
     runs and succeeds.
 
@@ -91,47 +114,68 @@ Release versions
 
  5. Update the version in JavaDoc links in the READMEs.
 
- 6. Amend these changes into the merge commit:
+ 6. Update the Java version in the [`release-verify-signatures`
+    workflow](https://github.com/Yubico/java-webauthn-server/blob/main/.github/workflows/release-verify-signatures.yml#L42).
+
+    See the `openjdk version` line of output from `java -version`:
+
+    ```
+    $ java -version  # (example output below)
+    openjdk version "17.0.7" 2023-04-18
+    OpenJDK Runtime Environment (build 17.0.7+7)
+    OpenJDK 64-Bit Server VM (build 17.0.7+7, mixed mode)
+    ```
+
+    Given the above output as an example, update the workflow like so:
+
+    ```yaml
+    strategy:
+      matrix:
+        java: ["17.0.7"]
+    ```
+
+ 7. Amend these changes into the merge commit:
 
     ```
-    $ git add NEWS
+    $ git add NEWS README */README .github/workflows/release-verify-signatures.yml
     $ git commit --amend --reset-author
     ```
 
- 7. Run the tests one more time:
+ 8. Run the tests one more time:
 
     ```
     $ ./gradlew clean check
     ```
 
- 8. Tag the merge commit with an `X.Y.Z` tag:
+ 9. Tag the merge commit with an `X.Y.Z` tag:
 
     ```
     $ git tag -a -s 1.4.0 -m "Release 1.4.0"
     ```
 
     No tag body needed since that's included in the commit.
 
- 9. Publish to Sonatype Nexus:
+10. Publish to Sonatype Nexus:
 
     ```
     $ ./gradlew publishToSonatype closeAndReleaseSonatypeStagingRepository
     ```
 
-10. Push to GitHub:
+11. Push to GitHub:
 
     ```
     $ git push origin main 1.4.0
     ```
 
-11. Make GitHub release.
+12. Make GitHub release.
 
-    - Use the new tag as the release tag
+    - Use the new tag as the release tag.
     - Copy the release notes from `NEWS` into the GitHub release notes; reformat
       from ASCIIdoc to Markdown and remove line wraps. Include all changes since
       the previous release (not just changes since the previous pre-release).
-    - Note which JDK version was used to build the artifacts.
+    - Note the JDK version shown by `java -version` in step 6.
+      For example: `openjdk version "17.0.7" 2023-04-18`.
 
-12. Check that the ["Reproducible binary"
+13. Check that the ["Reproducible binary"
     workflow](https://github.com/Yubico/java-webauthn-server/actions/workflows/release-verify-signatures.yml)
     runs and succeeds.