chore: use Gradle Java toolchains for the build and test execution

It enables decoupling of the build JVM vs test JVM.
By default we use Java 17 for the build and target with --release 11.
Then we vary Java version when running tests

Signed-off-by: Vladimir Sitnikov <[email protected]>

Author: vlsi

.github/workflows/ci.yaml

@@ -42,7 +42,10 @@ jobs:
     - name: Set up JDK ${{ matrix.java-version }}
       uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
       with:
-        java-version: ${{ matrix.java-version }}
+        # We need Java 17 for the build, so we install it always
+        java-version: |
+          ${{ matrix.java-version }}
+          17
         distribution: 'temurin'
     - name: Setup Go environment
       uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
@@ -58,7 +61,7 @@ jobs:
 
     # if you need to skip staging due to flakiness use "-PskipStaging"
     - name: Test sigstore-java
-      run: ./gradlew build
+      run: ./gradlew build -Porg.gradle.java.installations.auto-download=false -PjdkTestVersion=${{ matrix.java-version }}
 
     - name: Ensure sigstore-java self signing still works
       if: ${{ !github.event.pull_request.head.repo.fork }}

.github/workflows/conformance.yml

@@ -22,10 +22,10 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Set up JDK ${{ matrix.java-version }}
+      - name: Set up JDK 17
         uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
         with:
-          java-version: ${{ matrix.java-version }}
+          java-version: 17
           distribution: 'temurin'
 
       - name: Setup Gradle
@@ -37,6 +37,12 @@ jobs:
       - name: Unpack sigstore-java distribution
         run: tar -xvf ${{ github.workspace }}/sigstore-cli/build/distributions/sigstore-cli-*.tar --strip-components 1
 
+      - name: Set up JDK ${{ matrix.java-version }}
+        uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
+        with:
+          java-version: ${{ matrix.java-version }}
+          distribution: 'temurin'
+
       - uses: sigstore/sigstore-conformance@640e7dfb715518eeeb492910c6d244cedcc6cfea # v0.0.17
         with:
           entrypoint: ${{ github.workspace }}/bin/sigstore-cli

.github/workflows/examples.yaml

@@ -28,7 +28,7 @@ jobs:
     - name: Setup Java
       uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
       with:
-        java-version: 11
+        java-version: 17
         distribution: 'temurin'
 
     - name: Setup Gradle

.github/workflows/release-sigstore-gradle-plugin-from-tag.yaml

@@ -47,10 +47,10 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Set up JDK 11
+      - name: Set up JDK 17
         uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
         with:
-          java-version: 11
+          java-version: 17
           distribution: 'temurin'
 
       - name: Setup Gradle

.github/workflows/release-sigstore-java-from-tag.yaml

@@ -48,10 +48,10 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Set up JDK 11
+      - name: Set up JDK 17
         uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
         with:
-          java-version: 11
+          java-version: 17
           distribution: 'temurin'
 
       - name: Setup Gradle

.github/workflows/tuf-conformance.yml

@@ -22,10 +22,10 @@ jobs:
         with:
           persist-credentials: false
 
-      - name: Set up JDK ${{ matrix.java-version }}
+      - name: Set up JDK 17
         uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
         with:
-          java-version: ${{ matrix.java-version }}
+          java-version: 17
           distribution: 'temurin'
 
       - name: Setup Gradle
@@ -37,6 +37,12 @@ jobs:
       - name: Unpack tuf distribution
         run: tar -xvf ${{ github.workspace }}/tuf-cli/build/distributions/tuf-cli-*.tar --strip-components 1
 
+      - name: Set up JDK ${{ matrix.java-version }}
+        uses: actions/setup-java@3a4f6e1af504cf6a31855fa899c6aa5355ba6c12 # v4.7.0
+        with:
+          java-version: ${{ matrix.java-version }}
+          distribution: 'temurin'
+
       - uses: theupdateframework/tuf-conformance@dee4e23533d7a12a6394d96b59b3ea0aa940f9bf # v2.2.0
         with:
           entrypoint: ${{ github.workspace }}/bin/tuf-cli

DEVELOPMENT.md

@@ -3,6 +3,17 @@
 ./gradlew build
 ```
 
+## execute tests with Java 23 
+```sh
+./gradlew build -PjdkTestVersion=23
+```
+
+# list build parameters
+
+```sh
+./gradlew parameters
+```
+
 ## skip tests that require OIDC logins
 
 ```sh

build-logic-commons/gradle-plugin/build.gradle.kts

@@ -1,33 +1,27 @@
+import org.gradle.kotlin.dsl.support.expectedKotlinDslPluginsVersion
+
 plugins {
     `kotlin-dsl`
 }
 
 group = "dev.sigstore.build-logic"
 
-java {
-    sourceCompatibility = JavaVersion.VERSION_11
-    targetCompatibility = JavaVersion.VERSION_11
-}
-
-// We use precompiled script plugins (== plugins written as src/kotlin/build-logic.*.gradle.kts files,
-// and we need to declare dependency on org.gradle.kotlin.kotlin-dsl:org.gradle.kotlin.kotlin-dsl.gradle.plugin
-// to make it work.
-// Unfortunately, Gradle does not expose the version of `kotlin-dsl` in-core plugin, so we call `kotlin-dsl`
-// on our own PluginDependenciesSpec object, so it leaks the version to us.
-// See https://github.com/gradle/gradle/issues/17016
-val kotlinDslVersion = PluginDependenciesSpec { id ->
-    object : PluginDependencySpec {
-        var version: String? = null
-        override fun version(version: String?) = apply { this.version = version }
-        override fun apply(apply: Boolean) = this
-        override fun toString() = version ?: ""
-    }
-}.`kotlin-dsl`.toString()
-
 dependencies {
-    implementation("org.gradle.kotlin.kotlin-dsl:org.gradle.kotlin.kotlin-dsl.gradle.plugin:$kotlinDslVersion")
+    // We use precompiled script plugins (== plugins written as src/kotlin/build-logic.*.gradle.kts files,
+    // and we need to declare dependency on org.gradle.kotlin.kotlin-dsl:org.gradle.kotlin.kotlin-dsl.gradle.plugin
+    // to make it work.
+    // See https://github.com/gradle/gradle/issues/17016 regarding expectedKotlinDslPluginsVersion
+    implementation("org.gradle.kotlin.kotlin-dsl:org.gradle.kotlin.kotlin-dsl.gradle.plugin:$expectedKotlinDslPluginsVersion")
 }
 
-kotlinDslPluginOptions {
-    jvmTarget.set("11")
-}
+// We need to figure out a version that is supported by the current JVM, and by the Kotlin Gradle plugin
+// So we settle on 21, 17, or 11 if the current JVM supports it
+listOf(21, 17, 11)
+    .firstOrNull { JavaVersion.toVersion(it) <= JavaVersion.current() }
+    ?.let { buildScriptJvmTarget ->
+        java {
+            toolchain {
+                languageVersion.set(JavaLanguageVersion.of(buildScriptJvmTarget))
+            }
+        }
+    }

build-logic-commons/gradle-plugin/src/main/kotlin/build-logic.kotlin-dsl-gradle-plugin.gradle.kts

@@ -3,16 +3,19 @@ plugins {
     id("org.gradle.kotlin.kotlin-dsl") // this is 'kotlin-dsl' without version
 }
 
-java {
-    sourceCompatibility = JavaVersion.VERSION_11
-    targetCompatibility = JavaVersion.VERSION_11
-}
-
 tasks.validatePlugins {
     failOnWarning.set(true)
     enableStricterValidation.set(true)
 }
 
-kotlinDslPluginOptions {
-    jvmTarget.set("11")
-}
+// We need to figure out a version that is supported by the current JVM, and by the Kotlin Gradle plugin
+// So we settle on 21, 17, or 11 if the current JVM supports it
+listOf(21, 17, 11)
+    .firstOrNull { JavaVersion.toVersion(it) <= JavaVersion.current() }
+    ?.let { buildScriptJvmTarget ->
+        java {
+            toolchain {
+                languageVersion.set(JavaLanguageVersion.of(buildScriptJvmTarget))
+            }
+        }
+    }