Files
sbt/.github/workflows/ci.yml
T
BrianHotoppandClaude Fable 5 cb90a47ce8 [1.x] fix: Delegate JDK platform classes to the platform loader in console (#9327)
The console/consoleQuick REPL loader rejects JDK platform-module
classes: ClasspathFilter's post-check refuses classes whose code
source is a jrt: URL, so a top-down REPL reference to java.sql.* falls
through to the REPL's own classloader, which finds the bytes in the
runner-generated java9-rt-ext jar (via scala.ext.dirs) and dies in
defineClass:

  java.lang.SecurityException: Prohibited package name: java.sql

Wrap the REPL parent loader with a fallback that consults
ClassLoader.getPlatformClassLoader (reflectively; absent on JDK 8,
which has no platform loader) only after the existing chain misses,
so project classes keep winning and platform classes resolve instead
of being redefined. Linkage through the classpath loader (a JDBC
driver implementing java.sql.Driver) was already sound: the launcher's
topLoader delegates to the platform loader on JDK 9+; only the
top-down path through ClasspathFilter was broken.

Verified against sbt 1.11.7 (fails) and a patched 1.12.3-SNAPSHOT
(passes) with the original report's repro: java.sql.Timestamp,
a project class extending it, and DriverManager.getConnection with
the postgresql driver, which now reaches the network layer.

The console/* scripted group is added to CI; it was not in any
scripted glob, so the new test (and the pre-existing
console/project-compiler-bridge) never ran.

Fixes #4328 (still reproducible on 1.11.7 before this change).

Co-authored-by: Claude Fable 5 <[email protected]>
2026-06-13 01:54:58 -04:00

128 lines
4.5 KiB
YAML

name: CI
on:
pull_request:
push:
permissions:
contents: read # to fetch code (actions/checkout)
jobs:
test:
strategy:
fail-fast: false
matrix:
include:
- os: ubuntu-22.04
java: 21
distribution: temurin
jobtype: 1
- os: ubuntu-latest
java: 21
distribution: temurin
jobtype: 2
- os: ubuntu-latest
java: 25
distribution: zulu
jobtype: 3
- os: ubuntu-latest
java: 21
distribution: temurin
jobtype: 4
- os: ubuntu-latest
java: 21
distribution: temurin
jobtype: 5
# - os: ubuntu-latest
# java: 8
# distribution: adopt
# jobtype: 6
runs-on: ${{ matrix.os }}
timeout-minutes: 25
env:
JAVA_OPTS: -Xms800M -Xmx2G -Xss6M -XX:ReservedCodeCacheSize=128M -server -Dsbt.io.virtual=false -Dfile.encoding=UTF-8
JVM_OPTS: -Xms800M -Xmx2G -Xss6M -XX:ReservedCodeCacheSize=128M -server -Dsbt.io.virtual=false -Dfile.encoding=UTF-8
SCALA_212: 2.12.21
UTIL_TESTS: "utilCache/test utilControl/test utilInterface/test utilLogging/test utilPosition/test utilRelation/test utilScripted/test utilTracking/test"
SBT_ETC_FILE: $HOME/etc/sbt/sbtopts
JDK11: [email protected]
SPARK_LOCAL_IP: "127.0.0.1"
steps:
- name: Checkout sbt/sbt
uses: actions/checkout@v6
- name: Checkout sbt/io
uses: actions/checkout@v6
with:
repository: sbt/io
ref: develop
path: io
- name: Checkout sbt/librarymanagement
uses: actions/checkout@v6
with:
repository: sbt/librarymanagement
ref: 1.12.x
path: librarymanagement
- name: Checkout sbt/zinc
uses: actions/checkout@v6
with:
repository: sbt/zinc
ref: 1.12.x
path: zinc
- name: Setup JDK
uses: actions/setup-java@v5
with:
distribution: "${{ matrix.distribution }}"
java-version: "${{ matrix.java }}"
cache: "sbt"
- uses: sbt/setup-sbt@v1
- name: Build and test (1)
if: ${{ matrix.jobtype == 1 }}
shell: bash
run: |
./sbt -v --client mimaReportBinaryIssues
./sbt -v --client javafmtCheck
./sbt -v --client "Test/javafmtCheck"
./sbt -v --client scalafmtCheckAll
./sbt -v --client scalafmtSbtCheck
./sbt -v --client serverTestProj/scalafmtCheckAll
./sbt -v --client headerCheck
./sbt -v --client "Test/headerCheck"
./sbt -v --client "Test/compile"
./sbt -v --client publishLocal
./sbt -v --client test
./sbt -v --client doc
./sbt -v --client "all $UTIL_TESTS"
./sbt -v --client ++2.13.x
./sbt -v --client "all $UTIL_TESTS"
- name: Build and test (2)
if: ${{ matrix.jobtype == 2 }}
shell: bash
run: |
./sbt -v "scripted actions/* apiinfo/* compiler-project/* console/* ivy-deps-management/* reporter/* tests/* watch/* classloader-cache/* package/*"
- name: Build and test (3)
if: ${{ matrix.jobtype == 3 }}
shell: bash
run: |
./sbt -v "dependencyTreeProj/publishLocal; scripted dependency-graph/* dependency-management/* plugins/* project-load/* java/* run/* nio/*"
- name: Build and test (4)
if: ${{ matrix.jobtype == 4 }}
shell: bash
run: |
./sbt -v "repoOverrideTest:scripted dependency-management/*; scripted source-dependencies/* project/*"
- name: Build and test (5)
if: ${{ matrix.jobtype == 5 }}
shell: bash
run: |
./sbt -v "++2.13.x; all utilControl/test utilRelation/test utilPosition/test"
- name: Multirepo integration test
if: ${{ matrix.jobtype == 6 }}
shell: bash
run: |
# build from fresh IO, LM, and Zinc
BUILD_VERSION="${TEST_SBT_VER}-SNAPSHOT"
cd io
sbt -v -Dsbt.build.version=${BUILD_VERSION} +publishLocal
cd ../
sbt -Dsbtlm.path=$HOME/work/sbt/sbt/librarymanagement -Dsbtzinc.path=$HOME/work/sbt/sbt/zinc -Dsbt.build.version=$BUILD_VERSION -Dsbt.build.fatal=false "+lowerUtils/publishLocal; {librarymanagement}/publishLocal; {zinc}/publishLocal; upperModules/publishLocal"
rm -r $(find $HOME/.sbt/boot -name "*-SNAPSHOT") || true
sbt -v -Dsbt.version=$BUILD_VERSION "++2.13.x; all $UTIL_TESTS; ++$SCALA_212; all $UTIL_TESTS; scripted actions/* source-dependencies/*1of3 dependency-management/*1of4 java/*"