Release 3.7.0 was deleted

[fgarsombke]

We have just moved all of our builds to actions/setup-java@v3.7.0 and it just disappeared so they are all failing.

Do we need to revert everything back to actions/setup-java@v3.6.0 or is this going to be replaced?

Thanks.

[ArloL]

Looks like the intention was to remove the oracle jdk feature by rolling back 3.7.0. Would have been great to roll forward to 4.0.0 instead since the removal is a breaking change.

For now I think the best way forward is to fix broken builds by re-releasing 3.7.0 to HEAD or to at least 3.6.0 - if that's to be considered a stable version.

[fgarsombke]

That would be fantastic, we have a lot of repositories to modify and rebuild if we can't get that release back :)

[JakeWharton]

With the presence of tools like Dependabot and Renovate hundreds of repositories migrated and are now broken: https://github.com/search?q=%22actions%2Fsetup-java%40v3.7.0%22&type=code

[PatrickGotthard]

Please just tag 3.6.0 also as 3.7.0 (or 3.7.1 / 3.8.0) to fix the majority of problems. All our actions were updated automatically and it would cost much time to downgrade them manually.

[DanySK]

Wow, this destroyed dozens of my pipelines. Please, please, never delete releases anymore 🙏

[jdrphillips]

It's worrying that this is possible. 3.7.0 could be re-released with any code at all - if they had been malicious this could have happened quickly after most of us had auto-upgraded and it would have slipped through without anyone noticing

[ArloL]

It's worrying that this is possible.

Just to be certain: That is a GitHub Actions design decision and not an issue of the setup-java maintainers. This can happen with any action you use. If that is of concern you should switch to using the commit id of the action.

[DanySK]

Just to be certain: That is a GitHub Actions design decision and not an issue of the setup-java maintainers. This can happen with any action you use. If that is of concern you should switch to using the commit id of the action.

This can happen but should not. Retracting released software (except in case of extreme security concerns, in which case I'd expect a notification and explanation) is a bad practice that disrupts your clients. Some software repos forbid it altogether (Maven Central), and others have a more flexible policy (NPM), but all of them state the criterion and allow others to adapt.
Retracting versions just because it is as simple as deleting a git tag is not a great move, IMHO. As others suggested already, in case of mistakes it would be much better to release a patch.

[Gakk]

Approx. 15 minutes ago a new version 3.8.0 was released 😃

[fgarsombke]

I guess we are updating a few dozen repositories this morning 🥲 ...

[garydgregory]

It happened to all of the Apache Commons repositories, not fun.

[panticmilos]

Hello everyone. As you all are probably aware, the legal points of OracleJdk still need to be tackled and we had to delete this release of the new distribution. I would like to apologize for the inconvenience it has introduced to many of our customers, and we will do our best to prevent similar incidents from happening in the future.

Thank you for understanding the situation, I will close this issue for now.

[dmitry-shibanov]

Hello everyone. We had discussions with Oracle teams and confirmed that we can add support for Oracle OpenJDK. We've released a new version of the action with support of Oracle OpenJDK. We are sorry for the confusion.