From 33a25fdf6144a2b48bdd4873d572e6255b383d9d Mon Sep 17 00:00:00 2001
From: "dependabot[bot]" <49699333+dependabot[bot]@users.noreply.github.com>
Date: Fri, 14 Jun 2024 22:30:10 +1200
Subject: [PATCH] Bump gradle/actions from 3.3.2 to 3.4.0 (#934)

Bumps [gradle/actions](https://github.com/gradle/actions) from 3.3.2 to 3.4.0.
- [Release notes](https://github.com/gradle/actions/releases)
- [Commits](https://github.com/gradle/actions/compare/db19848a5fa7950289d3668fb053140cf3028d43...d9336dac04dea2507a617466bc058a3def92b18b)

---
updated-dependencies:
- dependency-name: gradle/actions
  dependency-type: direct:production
  update-type: version-update:semver-minor
...

Signed-off-by: dependabot[bot] <support@github.com>
Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
---
 .github/workflows/linux.yml        |  2 +-
 .github/workflows/pgkbuild.yml     | 45 ---------------------
 .github/workflows/pkgbuild.yml     | 64 ++++++++++++++++++++++++++++++
 .github/workflows/semgrep_diff.yml |  4 ++
 4 files changed, 69 insertions(+), 46 deletions(-)
 delete mode 100644 .github/workflows/pgkbuild.yml
 create mode 100644 .github/workflows/pkgbuild.yml

diff --git a/.github/workflows/linux.yml b/.github/workflows/linux.yml
index f3eb2c6ca..cf8fdf12f 100644
--- a/.github/workflows/linux.yml
+++ b/.github/workflows/linux.yml
@@ -199,4 +199,4 @@ jobs:
     runs-on: ubuntu-latest
     steps:
       - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-      - uses: gradle/actions/wrapper-validation@db19848a5fa7950289d3668fb053140cf3028d43 # v3.3.2
+      - uses: gradle/actions/wrapper-validation@d9336dac04dea2507a617466bc058a3def92b18b # v3.4.0
diff --git a/.github/workflows/pgkbuild.yml b/.github/workflows/pgkbuild.yml
deleted file mode 100644
index 14ad2040f..000000000
--- a/.github/workflows/pgkbuild.yml
+++ /dev/null
@@ -1,45 +0,0 @@
-name: macOS
-on:
-  pull_request:
-    branches: [ master ]
-    paths:
-      - .github/workflows/pkgbuild.yml
-      - pkgbuild/**
-jobs:
-  pkgbuild:
-    strategy:
-      matrix:
-        architecture: [x64, aarch64]
-    name: pkgbuild
-    runs-on: macos-latest
-    steps:
-
-    - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
-
-    - name: Install dependencies
-      run: brew install --cask packages
-
-    - name: Setup environment variables
-      uses: allenevans/set-env@7ccfd08576e7096fe3b98928bd0320d2b9a65728 # v4.0.0
-      with:
-        MAJOR_VERSION: 17
-        FULL_VERSION: 17.0.3_7
-        TAG: jdk-17.0.3+7
-        SUB_TAG: 17.0.3_7
-        JVM: hotspot
-
-    - name: Download prebuilt binaries
-      run: |
-        mkdir -p workspace/target/
-        cd workspace/target/
-        wget -q "https://github.com/adoptium/temurin${{ env.MAJOR_VERSION }}-binaries/releases/download/${{ env.TAG }}/OpenJDK${{ env.MAJOR_VERSION }}U-jdk_${{ matrix.architecture }}_mac_${{ env.JVM }}_${{ env.SUB_TAG }}.tar.gz"
-
-    - name: Create Package
-      run: |
-        export WORKSPACE=$PWD
-        bash pkgbuild/create-installer-mac.sh
-
-    - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
-      with:
-        name: macOS_${{ matrix.architecture }}
-        path: workspace/target/*.pkg
diff --git a/.github/workflows/pkgbuild.yml b/.github/workflows/pkgbuild.yml
new file mode 100644
index 000000000..ee34b490f
--- /dev/null
+++ b/.github/workflows/pkgbuild.yml
@@ -0,0 +1,64 @@
+name: macOS
+on:
+  workflow_dispatch:
+  pull_request:
+    branches: [ master ]
+    paths:
+      - 'pkgbuild/**'
+      - '.github/workflows/pkgbuild.yml'
+permissions:
+  contents: read
+
+jobs:
+  pkgbuild:
+    strategy:
+      fail-fast: false
+      matrix:
+        jdk: [8, 11, 17, 21]
+        architecture: [x64, aarch64]
+        exclude:
+          - jdk: 8
+            architecture: aarch64
+    name: pkgbuild
+    runs-on: macos-latest
+    steps:
+
+    - uses: actions/checkout@a5ac7e51b41094c92402da3b24376905380afc29 # v4.1.6
+
+    - name: Install dependencies
+      run: brew install --cask packages
+
+    - name: Fetch latest macOS version from Adoptium API
+      run: |
+        response=$(curl -s "https://api.adoptium.net/v3/assets/feature_releases/${{ matrix.jdk }}/ga?architecture=${{ matrix.architecture }}&image_type=jdk&os=mac&page=0&page_size=1")
+        json=$(echo "$response" | jq '.[0]')
+
+        major=$(echo "$json" | jq -r '.version_data.major')
+        echo "MAJOR_VERSION=$major" >> $GITHUB_ENV
+        echo "TAG=$(echo "$json" | jq -r '.release_name')" >> $GITHUB_ENV
+
+        # SUB_TAG is used to create the file name of the JDK/JRE zip file
+        release_name=$(echo "$json" | jq -r '.release_name')
+        if [[ "$major" -eq 8 ]]; then
+          subTag=$(echo "$release_name" | sed -e 's/jdk//' -e 's/-//')
+        else
+          subTag=$(echo "$release_name" | sed -e 's/jdk-//' -e 's/+/_/')
+        fi
+        echo "FULL_VERSION=$subTag" >> $GITHUB_ENV
+        echo "SUB_TAG=$subTag" >> $GITHUB_ENV
+
+    - name: Download prebuilt binaries
+      run: |
+        mkdir -p workspace/target/
+        cd workspace/target/
+        wget -q "https://github.com/adoptium/temurin${{ env.MAJOR_VERSION }}-binaries/releases/download/${{ env.TAG }}/OpenJDK${{ env.MAJOR_VERSION }}U-jdk_${{ matrix.architecture }}_mac_hotspot_${{ env.SUB_TAG }}.tar.gz"
+
+    - name: Create Package
+      run: |
+        export WORKSPACE=$PWD
+        bash pkgbuild/create-installer-mac.sh
+
+    - uses: actions/upload-artifact@65462800fd760344b1a7b4382951275a0abb4808 # v4.3.3
+      with:
+        name: macos-${{ env.MAJOR_VERSION }}-${{ matrix.architecture }}
+        path: workspace/target/*.pkg
diff --git a/.github/workflows/semgrep_diff.yml b/.github/workflows/semgrep_diff.yml
index 4b03d1ccb..4e7d6c067 100644
--- a/.github/workflows/semgrep_diff.yml
+++ b/.github/workflows/semgrep_diff.yml
@@ -15,6 +15,10 @@ name: Semgrep Differential Scan
 on:
   pull_request:
 
+permissions:
+  contents: read
+  statuses: write
+
 jobs:
   semgrep-diff:
     uses: adoptium/.github/.github/workflows/semgrep_diff.yml@main