Guardrails / java

Java version is reproducible

java/version-reproducible@v1

The Java release is declared by a mechanism that provisions the JDK, rather than one that asks whichever JDK is running to target an older release.

Id	java/version-reproducible
Version	v1
Category	java
Default severity	warning
Interpreter	python3
Timeout	30 seconds
Violations tolerated	0
Collects	java

Collectors

This guardrail gathers nothing itself. It depends on the collectors below, which the CLI runs once per build before any check, and reads what they found out of GUARDRAIL_FACTS. A collector that collects nothing skips this guardrail rather than failing it.

Collector	Gathers	Inputs it is given
java	The Java version the Gradle or Maven build declares, how it declares it, and whether that mechanism makes the build reproducible, for the project and for every Gradle project it includes.	projectDir

The inputs above are this guardrail's own, passed straight through. Configuring one in buildnote.json changes what is collected, and two guardrails configured the same way share the one collection.

Configuration

{
  "guardrails": {
      "failOn": "error",
      "comment": true,
      "checks": [
          {
              "use": "java/version-reproducible@v1",
              "severity": "warning",
              "with": {
                  "projectDir": "."
              },
              "exemptions": []
          }
      ]
  }
}

Inputs

Input	Description	Default	Environment variable
projectDir	Directory holding the project, relative to the directory the CLI runs in.	.	GUARDRAIL_INPUT_PROJECTDIR

How to fix

Replace sourceCompatibility, targetCompatibility, options.release or maven.compiler.release with a toolchain, which selects the JDK rather than asking the running one to aim at an older release:

java {
    toolchain {
        languageVersion.set(JavaLanguageVersion.of(21))
    }
}

sourceCompatibility = JavaVersion.VERSION_17 still compiles against the class library of whichever JDK is on the runner, so a method added after 17 resolves at compile time and throws NoSuchMethodError on the Java 17 runtime the artifact was built for.

More in java

• java/toolchain-declared. The build chooses the JDK it compiles with through a Java toolchain, rather than inheriting whichever JDK started it.
• java/version-declared. The build declares the Java release it compiles for, and that release is no older than the configured floor.

All 3 java guardrails