Set default signature verification for supported distributions

[johnoliver]

This pull request updates the Java setup action to change how signature verification is handled for downloaded Java packages. Signature verification is now enabled by default for the temurin and microsoft distributions, while remaining disabled for others unless explicitly set. The changes also update documentation, input handling, and tests to reflect this new default behavior.

Key changes include:

Default Behavior and Input Handling:

• Signature verification (verify-signature) now defaults to enabled for temurin and microsoft distributions, and is disabled for others unless explicitly specified. The input is now optional, and if not provided, the action determines the default based on the distribution. [1] [2] [3]
• The action.yml and README.md have been updated to reflect the new default behavior for verify-signature. [1] [2]
• The input parsing logic in src/setup-java.ts now uses a new function getVerifySignatureInput() to correctly handle undefined or explicit values for verify-signature. [1] [2] [3]

Testing and Validation:

• Tests for both temurin and microsoft installers have been updated to verify that signature verification is enabled by default, and to check that it can be explicitly disabled when requested. [1] [2] [3] [4]
• Orchestration tests in setup-java.test.ts have been updated to check that the correct signature verification value is passed to the distribution based on input and defaults. [1] [2] [3]

These changes ensure better security defaults for supported distributions while allowing users to override signature verification behavior as needed.

[Copilot]

Pull request overview

This pull request changes how the action decides whether to verify downloaded JDK signatures by making signature verification default to “on” for distributions that support it (currently Temurin and Microsoft), while keeping it “off” for other distributions unless explicitly enabled/disabled via input.

Changes:

• Makes verify-signature input optional and distinguishes “unset” from an explicit boolean value in input parsing.
• Updates distribution installer defaulting so supported distributions automatically enable signature verification when the input is not provided.
• Updates documentation and tests to reflect and validate the new default behavior.

Reviewed changes

Copilot reviewed 7 out of 9 changed files in this pull request and generated no comments.

Show a summary per file

File	Description
src/setup-java.ts	Adds getVerifySignatureInput() and passes verifySignature: boolean | undefined through to installers.
src/distributions/base-installer.ts	Defaults signature verification to supportsSignatureVerification() when input is unset.
README.md	Documents distribution-dependent defaults for verify-signature.
action.yml	Removes the hardcoded default so “unset” can be detected.
tests/setup-java.test.ts	Adds orchestration tests for explicit vs unset verify-signature.
tests/distributors/temurin-installer.test.ts	Updates Temurin tests to verify “default on” and “explicitly off”.
tests/distributors/microsoft-installer.test.ts	Updates Microsoft tests to verify “default on”.
dist/setup/index.js	Updates compiled output for setup logic changes.
dist/setup/242.index.js	Updates compiled output for base installer defaulting changes.

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.