Skip to content

docs: document seeding the Maven cache for plugin dependencies - #1094

Merged
brunoborges merged 5 commits into
mainfrom
brunoborges-issue-990-cache-maven-plugin-deps
Jul 9, 2026
Merged

docs: document seeding the Maven cache for plugin dependencies#1094
brunoborges merged 5 commits into
mainfrom
brunoborges-issue-990-cache-maven-plugin-deps

Conversation

@brunoborges

@brunoborges brunoborges commented Jul 9, 2026

Copy link
Copy Markdown
Contributor

Description:

With cache: maven, the action stores whatever a run downloads into ~/.m2 and does not re-save on a cache hit. Because Maven resolves plugin dependencies lazily (only for the goals that actually execute), a cache first created by a "thin" goal such as mvn compile never captures plugins bound to later phases. For example maven-shade-plugin and its dependencies (plexus-archiver, commons-compress, aircompressor, xz) are missing, so every later test/verify/package job re-downloads them on each run. The same effect hits parallel matrix jobs that each run a partial goal and race to save an incomplete cache (issue #705). This behavior was reproduced and confirmed on the current main.

This is a documentation-only change. It explains the behavior and shows how to seed a complete cache; it does not change the action's caching code.

  • README.md: a short note under "Caching maven dependencies" that states the problem in a couple of lines and links to the advanced guide.
  • docs/advanced-usage.md: a new "Ensuring the Maven cache is complete (plugin dependencies)" section with the root-cause explanation, a comparison of seed commands (dependency:resolve alone is insufficient; dependency:resolve-plugins / dependency:go-offline cover plugin deps), a single-job example, and a separate-seed-job (matrix) example that addresses the parallel multi-job race in Add extra cache key for multiple jobs on the same pom, but a different part #705, plus caveats.

The recommended seed is mvn -B dependency:go-offline dependency:resolve-plugins, verified to produce a superset that lets a subsequent build download nothing.

The section is honest about limits: the seed only helps on the run that creates the cache (an already-incomplete cache must be invalidated once), static resolution is not exhaustive (profile/module/execution-time gaps), and multi-module builds should seed at the reactor root. A closing note flags that cache: gradle has the same limitation and points Gradle users to gradle/actions/setup-gradle for complete dependency caching.

Related issue:
Fixes: #990
Addresses: #705

Check list:

  • Ran npm run check locally (format, lint, build, test) and all checks pass. (N/A: docs-only; npm run check targets .ts/.yml, not Markdown.)
  • Mark if documentation changes are required.
  • Mark if tests were added or updated to cover the changes. (N/A: documentation-only change.)

brunoborges and others added 3 commits July 9, 2026 15:56
Explain that setup-java's maven cache only stores what a run downloads and
is not re-saved on a hit, so plugin dependencies resolved lazily (e.g. by
maven-shade-plugin) can be missing from the cache. Document a dependency
resolution 'seed' step (dependency:go-offline + dependency:resolve-plugins)
in README and a fuller advanced-usage section with a goal-comparison table,
single-job and separate-seed-job examples, and caveats.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
#990)

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
Copilot AI review requested due to automatic review settings July 9, 2026 20:01
@brunoborges
brunoborges requested a review from a team as a code owner July 9, 2026 20:01
@brunoborges
brunoborges merged commit 90be272 into main Jul 9, 2026
2 checks passed
@brunoborges
brunoborges deleted the brunoborges-issue-990-cache-maven-plugin-deps branch July 9, 2026 20:03

Copilot AI left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Pull request overview

Documentation update explaining a common limitation of cache: maven in actions/setup-java: Maven plugin dependencies are resolved lazily, so an initial cache created by a “thin” goal may not include plugin deps, causing repeated downloads on subsequent CI runs.

Changes:

  • Added a brief note in the README under “Caching maven dependencies” pointing to an advanced guide section.
  • Added a new advanced-usage section describing why plugin deps can be missing and how to seed a more complete Maven cache (with examples and caveats).
Show a summary per file
File Description
README.md Adds a short note linking to the advanced guidance about seeding Maven plugin dependencies into the cache.
docs/advanced-usage.md Adds a new section detailing the root cause and recommended seeding commands/workflow patterns to produce a more complete Maven cache.

Review details

Tip

Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

  • Files reviewed: 2/2 changed files
  • Comments generated: 1
  • Review effort level: Low

Comment thread docs/advanced-usage.md
brunoborges added a commit that referenced this pull request Jul 9, 2026
Address post-merge review feedback on #1094: the intro paragraph
described the cache too narrowly. setup-java caches both
~/.m2/repository and ~/.m2/wrapper/dists, and the default key hashes
**/pom.xml plus .mvn/wrapper/maven-wrapper.properties and
.mvn/extensions.xml, so changing wrapper/extensions files also
invalidates the cache.

Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com>
mergify Bot added a commit to ArcadeData/arcadedb that referenced this pull request Aug 30, 2026
Bumps [actions/setup-java](https://github.com/actions/setup-java) from 5.7.0 to 6.0.0.
Release notes

*Sourced from [actions/setup-java's releases](https://github.com/actions/setup-java/releases).*

> v6.0.0
> ------
>
> What's Changed
> --------------
>
> * dist: Migrate from Zulu Discovery API to Azul Metadata API by [`@​jameswald`](https://github.com/jameswald) in [actions/setup-java#1010](https://redirect.github.com/actions/setup-java/pull/1010)
> * feat: add .mvn/extensions.xml to Maven cache key pattern by [`@​brunoborges`](https://github.com/brunoborges) with [`@​Copilot`](https://github.com/Copilot) in [actions/setup-java#1041](https://redirect.github.com/actions/setup-java/pull/1041)
> * Migrate to ESM and upgrade dependencies by [`@​priyagupta108`](https://github.com/priyagupta108) in [actions/setup-java#1078](https://redirect.github.com/actions/setup-java/pull/1078)
> * Map Zulu x86 architecture to i686 for Azul Metadata API by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1079](https://redirect.github.com/actions/setup-java/pull/1079)
> * Rename jdkFile input to jdk-file with deprecated alias by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1083](https://redirect.github.com/actions/setup-java/pull/1083)
> * Infer distribution from asdf .tool-versions vendor prefix by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1084](https://redirect.github.com/actions/setup-java/pull/1084)
> * Add Maven compiler problem matcher for javac diagnostics by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1086](https://redirect.github.com/actions/setup-java/pull/1086)
> * feat: expose cache-primary-key output ([#597](https://redirect.github.com/actions/setup-java/issues/597)) by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1088](https://redirect.github.com/actions/setup-java/pull/1088)
> * docs: clarify V6 ESM migration is not a user-facing breaking change by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1090](https://redirect.github.com/actions/setup-java/pull/1090)
> * Support multi-field Java versions like `18.0.1.1` by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1092](https://redirect.github.com/actions/setup-java/pull/1092)
> * docs: document seeding the Maven cache for plugin dependencies by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1094](https://redirect.github.com/actions/setup-java/pull/1094)
> * docs: clarify Maven cache paths and key hash inputs by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1096](https://redirect.github.com/actions/setup-java/pull/1096)
> * Support pinning java-version as "latest" by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1093](https://redirect.github.com/actions/setup-java/pull/1093)
> * chore(deps-dev): bump eslint from 10.6.0 to 10.7.0 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#1101](https://redirect.github.com/actions/setup-java/pull/1101)
> * chore(deps-dev): bump eslint-plugin-n from 18.2.1 to 18.2.2 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#1103](https://redirect.github.com/actions/setup-java/pull/1103)
> * chore(deps-dev): bump prettier from 3.9.4 to 3.9.5 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#1105](https://redirect.github.com/actions/setup-java/pull/1105)
> * chore(deps): bump actions/checkout from 6 to 7 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#1106](https://redirect.github.com/actions/setup-java/pull/1106)
> * chore(deps-dev): bump `@​types/node` from 26.1.0 to 26.1.1 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#1104](https://redirect.github.com/actions/setup-java/pull/1104)
> * dist: Cover Tencent Kona JDK 25 by [`@​johnshajiang`](https://github.com/johnshajiang) in [actions/setup-java#1108](https://redirect.github.com/actions/setup-java/pull/1108)
> * chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#1102](https://redirect.github.com/actions/setup-java/pull/1102)
> * Preserve Maven toolchains across repeated setup-java runs ([#1099](https://redirect.github.com/actions/setup-java/issues/1099)) by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1111](https://redirect.github.com/actions/setup-java/pull/1111)
> * dist: Support Liberica NIK ([#878](https://redirect.github.com/actions/setup-java/issues/878)) by [`@​asm0dey`](https://github.com/asm0dey) in [actions/setup-java#1112](https://redirect.github.com/actions/setup-java/pull/1112)
> * Fix template injection (zizmor alert [#118](https://redirect.github.com/actions/setup-java/issues/118)) in e2e-versions.yml by [`@​brunoborges`](https://github.com/brunoborges) with [`@​Copilot`](https://github.com/Copilot) in [actions/setup-java#1114](https://redirect.github.com/actions/setup-java/pull/1114)
> * Fix template injection in e2e-versions.yml (zizmor alert [#122](https://redirect.github.com/actions/setup-java/issues/122)) by [`@​brunoborges`](https://github.com/brunoborges) with [`@​Copilot`](https://github.com/Copilot) in [actions/setup-java#1120](https://redirect.github.com/actions/setup-java/pull/1120)
> * Disable persisted checkout credentials in e2e workflow by [`@​brunoborges`](https://github.com/brunoborges) with [`@​Copilot`](https://github.com/Copilot) in [actions/setup-java#1115](https://redirect.github.com/actions/setup-java/pull/1115)
> * feat: Update recommended configuration for GPG signing by [`@​wetneb`](https://github.com/wetneb) in [actions/setup-java#608](https://redirect.github.com/actions/setup-java/pull/608)
> * Cache Maven and Gradle wrapper distributions separately from the dependency cache by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1097](https://redirect.github.com/actions/setup-java/pull/1097)
> * Consolidate cache-dependency-path e2e workflow and add maven/sbt coverage by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1124](https://redirect.github.com/actions/setup-java/pull/1124)
> * Use gpg.passphraseEnvName instead of the deprecated gpg.passphrase server by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1123](https://redirect.github.com/actions/setup-java/pull/1123)
> * Extract repeated directory-check assertions into check-dir.sh helper by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1127](https://redirect.github.com/actions/setup-java/pull/1127)
> * Consolidate duplicate jobs in e2e-versions workflow by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1125](https://redirect.github.com/actions/setup-java/pull/1125)
> * Use YAML anchors to reduce boilerplate in e2e-versions workflow by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1126](https://redirect.github.com/actions/setup-java/pull/1126)
> * Updated msft json for now by [`@​jmjaffe37`](https://github.com/jmjaffe37) in [actions/setup-java#1129](https://redirect.github.com/actions/setup-java/pull/1129)
> * Document missing action inputs in README by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1130](https://redirect.github.com/actions/setup-java/pull/1130)
> * chore(deps): bump `@​actions/cache` to 6.2.0 by [`@​philip-gai`](https://github.com/philip-gai) in [actions/setup-java#1128](https://redirect.github.com/actions/setup-java/pull/1128)
> * Add an option to disable Java problem matchers by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1133](https://redirect.github.com/actions/setup-java/pull/1133)
> * docs: update setup-java examples by [`@​HarithaVattikuti`](https://github.com/HarithaVattikuti) in [actions/setup-java#1131](https://redirect.github.com/actions/setup-java/pull/1131)
> * Clarify credential environment variable inputs by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1134](https://redirect.github.com/actions/setup-java/pull/1134)
> * chore(deps-dev): bump `@​typescript-eslint/eslint-plugin` from 8.63.0 to 8.64.0 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#1135](https://redirect.github.com/actions/setup-java/pull/1135)
> * chore(deps): bump actions/setup-python from 6 to 7 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#1143](https://redirect.github.com/actions/setup-java/pull/1143)
> * chore(deps): bump fast-xml-parser from 5.9.3 to 5.10.1 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#1142](https://redirect.github.com/actions/setup-java/pull/1142)
> * chore(deps-dev): bump `@​typescript-eslint/parser` from 8.64.0 to 8.65.0 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#1138](https://redirect.github.com/actions/setup-java/pull/1138)
> * chore(deps-dev): bump lint-staged from 17.0.8 to 17.2.0 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#1136](https://redirect.github.com/actions/setup-java/pull/1136)
> * chore(deps-dev): bump typescript from 6.0.3 to 7.0.2 by [`@​dependabot`](https://github.com/dependabot)[bot] in [actions/setup-java#1137](https://redirect.github.com/actions/setup-java/pull/1137)
> * chore(deps): fix npm audited vulnerabilities by [`@​mhoffrog`](https://github.com/mhoffrog) in [actions/setup-java#1140](https://redirect.github.com/actions/setup-java/pull/1140)
> * Fix formatting issues in README.md by [`@​brunoborges`](https://github.com/brunoborges) in [actions/setup-java#1144](https://redirect.github.com/actions/setup-java/pull/1144)
> * Remediate npm audit findings and rebuild distributions by [`@​brunoborges`](https://github.com/brunoborges) with [`@​Copilot`](https://github.com/Copilot) in [actions/setup-java#1145](https://redirect.github.com/actions/setup-java/pull/1145)
> * Set GRAALVM\_HOME for GraalVM distributions by [`@​brunoborges`](https://github.com/brunoborges) with [`@​Copilot`](https://github.com/Copilot) in [actions/setup-java#1146](https://redirect.github.com/actions/setup-java/pull/1146)

... (truncated)


Commits

* [`dd06d9c`](actions/setup-java@dd06d9c) Prepare documentation for v6 release ([#1253](https://redirect.github.com/actions/setup-java/issues/1253))
* [`59b3450`](actions/setup-java@59b3450) chore(deps): combine open Dependabot npm updates ([#1252](https://redirect.github.com/actions/setup-java/issues/1252))
* [`b96213d`](actions/setup-java@b96213d) Set default signature verification for supported distributions ([#1246](https://redirect.github.com/actions/setup-java/issues/1246))
* [`1dbac3c`](actions/setup-java@1dbac3c) docs: expose contributing guide to GitHub ([#1245](https://redirect.github.com/actions/setup-java/issues/1245))
* [`11741d6`](actions/setup-java@11741d6) ci: constrain cache e2e job modes ([#1244](https://redirect.github.com/actions/setup-java/issues/1244))
* [`ff99aa1`](actions/setup-java@ff99aa1) Fix Oracle macOS E2E version ([#1243](https://redirect.github.com/actions/setup-java/issues/1243))
* [`416c6d1`](actions/setup-java@416c6d1) Add Red Hat Build of OpenJDK support ([#1241](https://redirect.github.com/actions/setup-java/issues/1241))
* [`5f75b27`](actions/setup-java@5f75b27) Add Maven dependency-resolution repositories ([#1240](https://redirect.github.com/actions/setup-java/issues/1240))
* [`a42a52c`](actions/setup-java@a42a52c) Add multiple Maven server credentials ([#1239](https://redirect.github.com/actions/setup-java/issues/1239))
* [`fb4abd7`](actions/setup-java@fb4abd7) test: cover JDK 26 from SDKMAN ([#1238](https://redirect.github.com/actions/setup-java/issues/1238))
* Additional commits viewable in [compare view](actions/setup-java@b6effb0...dd06d9c)
  
[![Dependabot compatibility score](https://dependabot-badges.githubapp.com/badges/compatibility\_score?dependency-name=actions/setup-java&package-manager=github\_actions&previous-version=5.7.0&new-version=6.0.0)](https://docs.github.com/en/github/managing-security-vulnerabilities/about-dependabot-security-updates#about-compatibility-scores)
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting `@dependabot rebase`.
[//]: # (dependabot-automerge-start)
[//]: # (dependabot-automerge-end)
---
Dependabot commands and options
  
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot show  ignore conditions` will show all of the ignore conditions of the specified dependency
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

Support caching Maven plugin dependencies in setup-java

2 participants