build: run CI on JDK 17, fork tests on JDK 8, enforce --release 8

halibobo1205 · halibobo1205 · commit 8d3588f734ea · 2026-06-26T15:06:23.000+08:00
diff --git a/.github/workflows/codeql.yml b/.github/workflows/codeql.yml
@@ -41,10 +41,12 @@ jobs:
         languages: ${{ matrix.language }}
         build-mode: manual
 
-    - name: Set up JDK 8
+    # Gradle 9.1 requires JVM 17+ to run; bytecode still targets Java 8 via
+    # sourceCompatibility. CodeQL only needs to compile, so JDK 17 is enough.
+    - name: Set up JDK 17
       uses: actions/setup-java@v5
       with:
-        java-version: '8'
+        java-version: '17'
         distribution: 'temurin'
 
     - name: Build
diff --git a/.github/workflows/dependency-check.yml b/.github/workflows/dependency-check.yml
@@ -26,10 +26,12 @@ jobs:
           restore-keys: |
             ${{ runner.os }}-odc-data-
 
-      - name: Set up JDK 8
-        uses: actions/setup-java@v3
+      # Gradle 9.1 requires JVM 17+ to run; bytecode still targets Java 8 via
+      # sourceCompatibility. This job only compiles (build -x test), so JDK 17 is enough.
+      - name: Set up JDK 17
+        uses: actions/setup-java@v4
         with:
-          java-version: '8'
+          java-version: '17'
           distribution: 'temurin'
 
       - name: Gradlew build
diff --git a/.github/workflows/integration-test-multinode.yml b/.github/workflows/integration-test-multinode.yml
@@ -25,10 +25,12 @@ jobs:
       - name: Checkout java-tron
         uses: actions/checkout@v5
 
-      - name: Set up JDK 8
+      # Host builds FullNode.jar with JDK 17 (Gradle 9.1 needs JVM 17+); bytecode targets
+      # Java 8. The FullNode itself still RUNS on JDK 8 inside the test container (below).
+      - name: Set up JDK 17
         uses: actions/setup-java@v5
         with:
-          java-version: '8'
+          java-version: '17'
           distribution: 'temurin'
 
       - name: Cache Gradle packages
diff --git a/.github/workflows/integration-test-single-node.yml b/.github/workflows/integration-test-single-node.yml
@@ -25,10 +25,12 @@ jobs:
       - name: Checkout java-tron
         uses: actions/checkout@v5
 
-      - name: Set up JDK 8
+      # Host builds FullNode.jar with JDK 17 (Gradle 9.1 needs JVM 17+); bytecode targets
+      # Java 8. The FullNode itself still RUNS on JDK 8 inside the test container (below).
+      - name: Set up JDK 17
         uses: actions/setup-java@v5
         with:
-          java-version: '8'
+          java-version: '17'
           distribution: 'temurin'
 
       - name: Cache Gradle packages
diff --git a/.github/workflows/pr-build.yml b/.github/workflows/pr-build.yml
@@ -117,17 +117,22 @@ jobs:
       LC_ALL: en_US.UTF-8
 
     steps:
-      - name: Install dependencies (Rocky 8 + JDK8)
+      - name: Install dependencies (Rocky 8 + JDK 8 + JDK 17)
         run: |
           set -euxo pipefail
-          dnf -y install java-1.8.0-openjdk-devel git wget unzip which jq bc curl glibc-langpack-en
+          # JDK 8 runs the FullNode and the tests; JDK 17 runs Gradle (9.1 requires JVM 17+).
+          dnf -y install java-1.8.0-openjdk-devel java-17-openjdk-devel git wget unzip which jq bc curl glibc-langpack-en
           dnf -y groupinstall "Development Tools"
+          echo "JAVA8_HOME=$(readlink -f /usr/lib/jvm/java-1.8.0-openjdk)"  >> "$GITHUB_ENV"
+          echo "JAVA17_HOME=$(readlink -f /usr/lib/jvm/java-17-openjdk)" >> "$GITHUB_ENV"
 
       - name: Checkout code
         uses: actions/checkout@v5
 
-      - name: Check Java version
-        run: java -version
+      - name: Check Java versions
+        run: |
+          "$JAVA8_HOME/bin/java" -version
+          "$JAVA17_HOME/bin/java" -version
 
       - name: Cache Gradle
         uses: actions/cache@v5
@@ -140,22 +145,26 @@ jobs:
             rockylinux-x86_64-gradle-
 
       - name: Stop Gradle daemon
-        run: ./gradlew --stop || true
+        run: JAVA_HOME="$JAVA17_HOME" ./gradlew --stop || true
 
-      - name: Build
-        run: ./gradlew clean build --no-daemon
+      - name: Build (Gradle on JDK 17, tests forked on JDK 8)
+        run: |
+          JAVA_HOME="$JAVA17_HOME" ./gradlew clean build --no-daemon \
+            -PtestJavaVersion=8 "-Porg.gradle.java.installations.paths=$JAVA8_HOME"
 
-      - name: Toolkit jar smoke test
+      - name: Toolkit jar smoke test (JDK 8)
         run: |
           set -e
           JAR=plugins/build/libs/Toolkit.jar
-          java -jar "$JAR" help
-          java -jar "$JAR" db --help
-          java -jar "$JAR" db archive -h
-          java -jar "$JAR" keystore --help
+          "$JAVA8_HOME/bin/java" -jar "$JAR" help
+          "$JAVA8_HOME/bin/java" -jar "$JAR" db --help
+          "$JAVA8_HOME/bin/java" -jar "$JAR" db archive -h
+          "$JAVA8_HOME/bin/java" -jar "$JAR" keystore --help
 
-      - name: Test with RocksDB engine
-        run: ./gradlew :framework:testWithRocksDb --no-daemon
+      - name: Test with RocksDB engine (Gradle on JDK 17, tests on JDK 8)
+        run: |
+          JAVA_HOME="$JAVA17_HOME" ./gradlew :framework:testWithRocksDb --no-daemon \
+            -PtestJavaVersion=8 "-Porg.gradle.java.installations.paths=$JAVA8_HOME"
 
   docker-build-debian11:
     name: Build debian11 (JDK 8 / x86_64)
@@ -174,17 +183,26 @@ jobs:
       GRADLE_USER_HOME: /github/home/.gradle
 
     steps:
-      - name: Install dependencies (Debian + build tools)
+      - name: Install dependencies (Debian + build tools + JDK 17 for Gradle)
         run: |
           set -euxo pipefail
           apt-get update
           apt-get install -y git wget unzip build-essential curl jq
+          # JDK 8 (container default, /opt/java/openjdk) runs the FullNode and tests;
+          # JDK 17 runs Gradle (9.1 requires JVM 17+).
+          mkdir -p /opt/jdk17
+          curl -fsSL "https://api.adoptium.net/v3/binary/latest/17/ga/linux/x64/jdk/hotspot/normal/eclipse" \
+            | tar -xz --strip-components=1 -C /opt/jdk17
+          echo "JAVA8_HOME=${JAVA_HOME:-/opt/java/openjdk}" >> "$GITHUB_ENV"
+          echo "JAVA17_HOME=/opt/jdk17" >> "$GITHUB_ENV"
 
       - name: Checkout code
         uses: actions/checkout@v5
 
-      - name: Check Java version
-        run: java -version
+      - name: Check Java versions
+        run: |
+          "$JAVA8_HOME/bin/java" -version
+          "$JAVA17_HOME/bin/java" -version
 
       - name: Cache Gradle
         uses: actions/cache@v5
@@ -196,23 +214,27 @@ jobs:
           restore-keys: |
             debian11-x86_64-gradle-
 
-      - name: Build
-        run: ./gradlew clean build --no-daemon --no-build-cache
+      - name: Build (Gradle on JDK 17, tests forked on JDK 8)
+        run: |
+          JAVA_HOME="$JAVA17_HOME" ./gradlew clean build --no-daemon --no-build-cache \
+            -PtestJavaVersion=8 "-Porg.gradle.java.installations.paths=$JAVA8_HOME"
 
-      - name: Toolkit jar smoke test
+      - name: Toolkit jar smoke test (JDK 8)
         run: |
           set -e
           JAR=plugins/build/libs/Toolkit.jar
-          java -jar "$JAR" help
-          java -jar "$JAR" db --help
-          java -jar "$JAR" db archive -h
-          java -jar "$JAR" keystore --help
+          "$JAVA8_HOME/bin/java" -jar "$JAR" help
+          "$JAVA8_HOME/bin/java" -jar "$JAR" db --help
+          "$JAVA8_HOME/bin/java" -jar "$JAR" db archive -h
+          "$JAVA8_HOME/bin/java" -jar "$JAR" keystore --help
 
-      - name: Test with RocksDB engine
-        run: ./gradlew :framework:testWithRocksDb --no-daemon --no-build-cache
+      - name: Test with RocksDB engine (Gradle on JDK 17, tests on JDK 8)
+        run: |
+          JAVA_HOME="$JAVA17_HOME" ./gradlew :framework:testWithRocksDb --no-daemon --no-build-cache \
+            -PtestJavaVersion=8 "-Porg.gradle.java.installations.paths=$JAVA8_HOME"
 
       - name: Generate module coverage reports
-        run: ./gradlew jacocoTestReport --no-daemon
+        run: JAVA_HOME="$JAVA17_HOME" ./gradlew jacocoTestReport --no-daemon
 
       - name: Upload PR coverage reports
         uses: actions/upload-artifact@v6
diff --git a/build.gradle b/build.gradle
@@ -65,6 +65,30 @@ subprojects {
         targetCompatibility = JavaVersion.VERSION_1_8
     }
 
+    // -target 8 only sets the bytecode version; method calls still resolve against the build JDK's
+    // classes, so a JDK 9+ API compiles on JDK 17 but fails at RUNTIME on JDK 8 (NoSuchMethodError).
+    // --release 8 compiles against the historical JDK 8 API so such usage is a compile error,
+    // regardless of which JDK runs Gradle. errorprone is excluded: it uses jdk.compiler internals
+    // and only runs on the build JVM, never on the JDK 8 runtime.
+    if (project.name != 'errorprone') {
+        tasks.withType(JavaCompile).configureEach {
+            options.release = 8
+        }
+    }
+
+    // Gradle 9.1 must run on JVM 17+, but the x86 stack is validated on JDK 8. When CI passes
+    // -PtestJavaVersion=8, test JVMs are forked on that JDK (classes are still compiled to bytecode 8
+    // by the Gradle JVM); Gradle locates the JDK via -Porg.gradle.java.installations.paths. Without
+    // the property, tests run on the Gradle JVM (arm64 JDK 17-21 and local dev) — unchanged.
+    if (project.hasProperty('testJavaVersion')) {
+        tasks.withType(Test).configureEach {
+            javaLauncher.set(javaToolchains.launcherFor {
+                languageVersion = JavaLanguageVersion.of(
+                        Integer.parseInt(project.property('testJavaVersion').toString()))
+            })
+        }
+    }
+
     [compileJava, compileTestJava]*.options*.encoding = 'UTF-8'
     jacoco {
         toolVersion = "0.8.15" // see https://www.jacoco.org/jacoco/trunk/doc/changes.html
