[1.x] Pin graalvm/setup-graalvm to ASF-allowed commit hash (#1612)

* Pin graalvm/setup-graalvm to ASF-allowed commit hash and fix spotless

ASF policy requires third-party GitHub Actions to be pinned to commit
hashes rather than tags. Also fix the release source job which referenced
an undefined GRAALVM_VERSION variable and was missing the distribution
parameter. Fix spotless formatting in DaemonCrashTest.java.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Revert native-maven-plugin to 0.11.5 for JDK 22 compatibility

native-maven-plugin >= 1.0.0 requires a reachability-metadata schema
that is only supported by GraalVM for JDK 25+. GraalVM 25 dropped
macOS Intel support, which is inappropriate to drop in a micro release.
Reverting to 0.11.5 keeps all platforms including macOS Intel.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Restore native-maven-plugin to 1.1.0

The revert to 0.11.5 was unnecessary — CI history shows 1.1.0 works
fine with JDK 22. The older 0.11.5 has worse Windows VS detection,
causing vcvarsall.bat lookup failures on windows-2025 runners.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Disable metadata repository to fix JDK 22 schema incompatibility

The GraalVM reachability-metadata repository was recently updated to
use a schema that requires GraalVM 25+. With native-maven-plugin 1.1.0
and JDK 22, this causes build failures. Disabling the automatic metadata
download resolves this while keeping the better Windows VS detection
from 1.1.0.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

* Use windows-2022 runner for GraalVM 22 compatibility

GraalVM 22's native-image cannot find vcvarsall.bat on windows-2025
runners. This is fixed in GraalVM 25 but the 1.x branch stays on
JDK 22. Use windows-2022 where VS detection works.

Co-Authored-By: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

---------

Co-authored-by: Claude Opus 4.6 (1M context) <noreply@anthropic.com>

.github/workflows/early-access.yaml

@@ -63,7 +63,7 @@ jobs:
       fail-fast: false
       matrix:
         # binaries wanted: linux amd64, mac M1, mac intel, windows x86
-        os: [ ubuntu-24.04, ubuntu-24.04-arm, macos-15, macos-15-intel, windows-2025 ]
+        os: [ ubuntu-24.04, ubuntu-24.04-arm, macos-15, macos-15-intel, windows-2022 ]
     runs-on: ${{ matrix.os }}
 
     steps:
@@ -93,7 +93,7 @@ jobs:
           echo "VERSION=$(./mvnw help:evaluate -Dexpression=project.version -q -DforceStdout)" >> $GITHUB_ENV
 
       - name: 'Set up GraalVM'
-        uses: graalvm/setup-graalvm@v1
+        uses: graalvm/setup-graalvm@bef4b0e916c7dd079bf60fb95d49139f67e32c5f # v1.5.3
         with:
           java-version: ${{ env.JAVA_VERSION }}
           distribution: 'graalvm'

.github/workflows/release.yaml

@@ -35,7 +35,7 @@ jobs:
       fail-fast: true
       matrix:
         # binaries wanted: linux amd64, linux arm64, mac intel, mac M1, windows x86
-        os: [ ubuntu-24.04, ubuntu-24.04-arm, macos-15-intel, macos-15, windows-2025 ]
+        os: [ ubuntu-24.04, ubuntu-24.04-arm, macos-15-intel, macos-15, windows-2022 ]
     runs-on: ${{ matrix.os }}
 
     steps:
@@ -65,7 +65,7 @@ jobs:
           echo "VERSION=$(./mvnw help:evaluate -Dexpression=project.version -q -DforceStdout)" >> $GITHUB_ENV
 
       - name: 'Set up GraalVM'
-        uses: graalvm/setup-graalvm@v1
+        uses: graalvm/setup-graalvm@bef4b0e916c7dd079bf60fb95d49139f67e32c5f # v1.5.3
         with:
           java-version: ${{ env.JAVA_VERSION }}
           distribution: 'graalvm'
@@ -175,10 +175,10 @@ jobs:
           echo "VERSION=$(./mvnw help:evaluate -Dexpression=project.version -q -DforceStdout)" >> $GITHUB_ENV
 
       - name: 'Set up GraalVM'
-        uses: graalvm/setup-graalvm@v1
+        uses: graalvm/setup-graalvm@bef4b0e916c7dd079bf60fb95d49139f67e32c5f # v1.5.3
         with:
-          version: ${{ env.GRAALVM_VERSION }}
           java-version: ${{ env.JAVA_VERSION }}
+          distribution: 'graalvm'
           github-token: ${{ secrets.GITHUB_TOKEN }}
 
       - name: 'Build source distribution'

client/pom.xml

@@ -272,7 +272,7 @@
             <artifactId>native-maven-plugin</artifactId>
             <configuration>
               <metadataRepository>
-                <enabled>true</enabled>
+                <enabled>false</enabled>
               </metadataRepository>
               <skip>false</skip>
               <mainClass>org.mvndaemon.mvnd.client.DefaultClient</mainClass>

integration-tests/src/test/java/org/mvndaemon/mvnd/it/DaemonCrashTest.java

@@ -63,8 +63,9 @@ class DaemonCrashTest {
         Stream.of(installedJars).forEach(jar -> Assertions.assertThat(jar).doesNotExist());
 
         final TestClientOutput output = new TestClientOutput();
-        assertThrows(DaemonException.StaleAddressException.class, () -> client.execute(
-                        output, "clean", "install", "-e", "-Dmvnd.log.level=DEBUG")
-                .assertFailure());
+        assertThrows(
+                DaemonException.StaleAddressException.class,
+                () -> client.execute(output, "clean", "install", "-e", "-Dmvnd.log.level=DEBUG")
+                        .assertFailure());
     }
 }