ci: build the SDK on JDK 25; fix musl cdylib; gate macOS native builds

- tests.yml: build+test on a single JDK 25 (the jextract Gradle plugin needs a
  JDK 21+ daemon and the FFM path needs the JDK 25 toolchain). Cross-JRE runtime
  coverage (17/21/25) is the integration container matrix. Bump test-javadocs to 25.
- All building workflows now use JDK 25 (docker, integration build, release,
  release-docs, dependency-submission).
- native.yaml: musl targets build the cdylib with -C target-feature=-crt-static
  (musl is static-by-default and otherwise can't produce a .so).
- native.yaml: macOS native builds only run on main, release/* and tags (expensive
  runners); a temporary head_ref clause keeps them on for the shared-core-jni PR.

Co-Authored-By: Claude Opus 4.8 (1M context) <noreply@anthropic.com>

Author: slinkydeveloper

.github/workflows/dependency-submission.yml

@@ -17,7 +17,7 @@ jobs:
         uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
-          java-version: 17
+          java-version: 25
       - name: Install Rust toolchain
         uses: actions-rust-lang/setup-rust-toolchain@v1
       - name: Generate and submit dependency graph

.github/workflows/docker.yaml

@@ -32,7 +32,7 @@ jobs:
         uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
-          java-version: '21'
+          java-version: '25'
 
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v4

.github/workflows/integration.yaml

@@ -123,7 +123,7 @@ jobs:
         uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
-          java-version: '21'
+          java-version: '25'
 
       - name: Setup Gradle
         if: ${{ inputs.serviceImage == '' }}

.github/workflows/native.yaml

@@ -17,28 +17,46 @@ jobs:
     name: "Build native (${{ matrix.target }})"
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 30
+    # Linux targets always build. macOS runners are expensive, so they only build on main, release
+    # branches and tags (where the release artifacts are assembled).
+    # TODO(shared-core-jni): the last clause keeps macOS builds on for this PR for testing; remove
+    # it before merging.
+    if: >-
+      ${{ !startsWith(matrix.runner, 'macos')
+          || github.ref == 'refs/heads/main'
+          || startsWith(github.ref, 'refs/heads/release')
+          || startsWith(github.ref, 'refs/tags/')
+          || github.head_ref == 'shared-core-jni' }}
     strategy:
       fail-fast: false
       matrix:
         include:
           - target: x86_64-unknown-linux-gnu
             runner: ubuntu-latest
             cross: false
+            rustflags: ""
           - target: aarch64-unknown-linux-gnu
             runner: ubuntu-latest
             cross: true
+            rustflags: ""
+          # musl is statically linked by default, which can't produce a cdylib (.so); disabling
+          # crt-static makes the target dynamically linkable so the shared library can be built.
           - target: x86_64-unknown-linux-musl
             runner: ubuntu-latest
             cross: true
+            rustflags: "-C target-feature=-crt-static"
           - target: aarch64-unknown-linux-musl
             runner: ubuntu-latest
             cross: true
+            rustflags: "-C target-feature=-crt-static"
           - target: x86_64-apple-darwin
             runner: macos-13
             cross: false
+            rustflags: ""
           - target: aarch64-apple-darwin
             runner: macos-14
             cross: false
+            rustflags: ""
     steps:
       - uses: actions/checkout@v4
 
@@ -53,6 +71,9 @@ jobs:
 
       - name: Build cdylib
         working-directory: sdk-core/src/main/rust
+        env:
+          # `cross` forwards RUSTFLAGS into the build container.
+          RUSTFLAGS: ${{ matrix.rustflags }}
         run: |
           if [ "${{ matrix.cross }}" = "true" ]; then
             cross build --release --target ${{ matrix.target }}

.github/workflows/release-docs.yml

@@ -28,7 +28,7 @@ jobs:
       - uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
-          java-version: '21'
+          java-version: '25'
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v4
       - name: Install Rust toolchain

.github/workflows/release.yml

@@ -11,11 +11,11 @@ jobs:
     timeout-minutes: 20
     steps:
       - uses: actions/checkout@v4
-      - name: Set up JDK ${{ matrix.java }}
-        uses: actions/setup-java@v3
+      - name: Set up JDK 25
+        uses: actions/setup-java@v4
         with:
-          java-version: 17
-          distribution: 'adopt'
+          java-version: '25'
+          distribution: 'temurin'
 
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v4

.github/workflows/tests.yml

@@ -9,20 +9,19 @@ on:
 
 jobs:
   build-and-test:
-    name: Build and test (Java ${{ matrix.java }})
+    name: Build and test
     runs-on: warp-ubuntu-latest-x64-4x
     timeout-minutes: 10
-    strategy:
-      fail-fast: false
-      matrix:
-        java: [ 17, 21, 25 ]
     steps:
       - uses: actions/checkout@v4
-      - name: Set up JDK ${{ matrix.java }}
-        uses: actions/setup-java@v3
+      # The SDK is built with JDK 25: the jextract Gradle plugin requires the Gradle daemon to run
+      # on JDK 21+, and the FFM/Panama path needs the JDK 25 toolchain. Cross-JRE (17/21/25) runtime
+      # coverage is provided by the integration test container matrix (integration.yaml).
+      - name: Set up JDK 25
+        uses: actions/setup-java@v4
         with:
-          java-version: ${{ matrix.java }}
-          distribution: 'adopt'
+          java-version: '25'
+          distribution: 'temurin'
 
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v4
@@ -40,7 +39,7 @@ jobs:
         if: always()
         uses: actions/upload-artifact@v4
         with:
-          name: Test results (Java ${{ matrix.java }})
+          name: Test results
           path: "**/test-results/test/*.xml"
 
   test-javadocs:
@@ -54,7 +53,7 @@ jobs:
           # We test with same Java version and distribution used by the Docs script
           # https://github.com/restatedev/documentation/blob/main/.github/workflows/pre-release.yml
           distribution: 'temurin'
-          java-version: '21'
+          java-version: '25'
       - name: Setup Gradle
         uses: gradle/actions/setup-gradle@v4
       - name: Install Rust toolchain