I’m looking at possible improvements to setup-java. What would make the biggest difference for your workflows: clearer compiler annotations, better Maven caching, or security and maintenance changes?
What would you improve in the setup-java action?
Asked by
2D~Rucksack
Answers
The compiler annotations sound useful, but I’d want the docs to spell out what they match and how to turn them off. In particular, explain whether they work when Maven runs the compiler, and test that path rather than only showing direct javac output.
Reply to this answer
I’d prioritize Maven plugin caching. If the action says it caches Maven dependencies, users reasonably expect build plugins to be included too. The docs and behavior should line up, especially for workflows where plugin downloads are a noticeable part of build time.
Reply to this answer
Security housekeeping is worth doing even for a widely used official action. The action’s own workflows could use narrowly scoped permissions, and automated workflow checks could help catch risky settings later. Immutable releases are another useful direction, though they’re a separate improvement from tightening the workflows.
2D~Rucksack:
That makes sense. I’d treat the workflow permissions and release immutability as separate items so the scope of each change stays clear.
Reply to this answer
Add your answer
Answers are reviewed before publication.
7M+Turnstile:
Agreed. A small example with a Maven build and a note about any output formats the matcher misses would make this much easier to assess.