ci: test Java SDK across JDK matrix + platforms

[pratyush618]

What

• Bump actions/setup-java@v4 → v5 (Node 24; clears the Node 20 deprecation warning).
• Run the Java SDK CI across JDK 11/17/21 instead of only 21.
• Smoke-build the other published platforms (macOS arm64, Windows x86_64).

Why

SDK targets Java 11 but is consumed on 11/17/21 and loads a native JNI binary — JVM behaviour is runtime-sensitive (JPMS encapsulation, SecurityManager removal in 21+, reflection). Green on one JDK/platform is not green on all.

Design (optimized)

The cdylib is JDK-independent, so on Linux it's built once and handed to every JDK leg as an artifact — no per-leg cargo rebuild:

• native job: cargo build -p taskito-java --features postgres,redis,workflows → uploads libtaskito_java.so.
• test matrix [11, 17, 21], fail-fast: false: downloads the .so, runs ./gradlew build -x cargoBuild. No Rust on test legs; copyNative still stages the prebuilt library.
• smoke matrix [osx-aarch64, windows-x86_64] on JDK 21: native binary is platform-specific (.dylib/.dll), so these legs run the real cargoBuild + full suite. Windows points OPENSSL_SRC_PERL at Strawberry Perl for vendored OpenSSL.

Feature flags match: the native job's --features postgres,redis,workflows mirrors Gradle's cargoBuild (build.gradle.kts:103) exactly, so the artifact reused on Linux is what a real gradle build / the publish pipeline ships.

Verification (live in this PR's checks)

• Java / Build native library ✅
• Java / Java SDK Tests (JDK 11 | 17 | 21) ✅ — artifact upload → download round-trip exercised; downloaded .so resolved where copyNative expects (repo-root target/release).
• Java / Java SDK Smoke (osx-aarch64) ✅
• Java / Java SDK Smoke (windows-x86_64) ✅ — real cargoBuild + vendored OpenSSL on Windows.

Notes

• Branch protection: required-check names change. Add:
  • Java / Build native library
  • Java / Java SDK Tests (JDK 11), (JDK 17), (JDK 21)
  • Java / Java SDK Smoke (osx-aarch64), (windows-x86_64)
  • Drop the old Java / Java SDK Tests.
• Coverage: linux-x86_64 (×3 JDK) + osx-aarch64 + windows-x86_64 tested. linux-aarch64 + osx-x86_64 remain publish-only (built in publish-java.yml, not CI-gated).
• JDK 25 omitted — Gradle 8.12 can't run on it; needs a wrapper bump first.
• smoke is the heavy leg (full build + Rust-from-scratch + Windows OpenSSL-from-source, a known flakiness source). Intentional; worth watching.

[coderabbitai]

Warning

Review limit reached

@pratyush618, we couldn't start this review because you've reached your PR review rate limit.

More reviews will be available in 28 minutes and 45 seconds. Learn how PR review limits work.

Your organization has run out of usage credits. Purchase more credits in the billing tab to continue.

⌛ How to resolve this issue?

After more reviews become available, a review can be triggered using the @coderabbitai review command as a PR comment. Alternatively, push new commits to this PR.

To avoid repeated limits, reduce automatic review volume by pausing incremental auto-reviews earlier, using label-based review opt-in, excluding WIP or generated PR titles, or requesting reviews manually when the PR is ready. If your team needs uninterrupted high-volume reviews, an organization admin can enable usage-based credits.

🚦 How do rate limits work?

CodeRabbit enforces per-developer PR review limits for each organization. Most developers receive the normal plan review availability.

For paid Pro and Pro+ PR reviews, CodeRabbit uses adaptive limits for sustained high-volume activity. When a developer's recent PR review activity reaches the 95th percentile or higher among CodeRabbit users, additional reviews become available more gradually as earlier reviews age out of the rolling window.

Please see our Fair Usage Limits Policy for further information.

ℹ️ Review info

⚙️ Run configuration

Configuration used: defaults

Review profile: CHILL

Plan: Pro

Run ID: 59bf5d13-653b-4c51-beb1-19c3507b3170

📥 Commits

Reviewing files that changed from the base of the PR and between 28dc5f3 and dd4e02f.

📒 Files selected for processing (2)

• .github/workflows/ci-java.yml
• .github/workflows/cleanup.yml

📝 Walkthrough

Walkthrough

The PR updates shared Java setup steps to actions/setup-java@v5, changes the reusable Java CI workflow to build the JNI native library in a separate job and reuse it across JDK 11/17/21 test runs, and updates the Java publish workflow to use the newer setup action.

Changes

Java CI and publish updates

Layer / File(s)	Summary
Shared JDK setup update \.github/actions/setup-java/action.yml, \.github/workflows/publish-java.yml	The composite action and publish workflow switch their JDK setup step to actions/setup-java@v5 with the same Temurin and Gradle cache inputs.
Native build and matrix test flow \.github/workflows/ci-java.yml	The reusable Java CI workflow now builds the JNI cdylib in a native job, uploads and downloads it as an artifact, and runs the Java Gradle build on JDK 11/17/21 with Rust compilation skipped.

Sequence Diagram(s)

sequenceDiagram
  participant NativeJob as native job
  participant CargoBuild as cargo build --release
  participant ArtifactStore as GitHub artifact store
  participant TestJob as test job
  participant Gradle as ./gradlew build -x cargoBuild

  NativeJob->>CargoBuild: build JNI cdylib with features
  CargoBuild-->>NativeJob: produce .so artifact
  NativeJob->>ArtifactStore: upload .so artifact
  TestJob->>ArtifactStore: download native artifact into target/release
  TestJob->>Gradle: run build on JDK 11/17/21
  Gradle-->>TestJob: build and test results

Loading

Estimated code review effort

🎯 3 (Moderate) | ⏱️ ~20 minutes

Possibly related PRs

• ByteVeda/taskito#304: Updates the same Java setup action and reusable Java CI workflow.

Poem

🐰 I hop through CI with speedy feet,
Temurin v5 makes the JDK seat.
One native build, then tests take flight,
Gradle hums softly through the night.

🚥 Pre-merge checks | ✅ 5

✅ Passed checks (5 passed)

Check name	Status	Explanation
Docstring Coverage	✅ Passed	No functions found in the changed files to evaluate docstring coverage. Skipping docstring coverage check.
Linked Issues check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Out of Scope Changes check	✅ Passed	Check skipped because no linked issues were found for this pull request.
Title check	✅ Passed	The title clearly captures the main CI change: running Java SDK tests across a JDK matrix.
Description Check	✅ Passed	Check skipped - CodeRabbit’s high-level summary is enabled.

✨ Finishing Touches

🧪 Generate unit tests (beta)

• Create PR with unit tests
• Commit unit tests in branch ci/java-jdk-matrix

---

_{Comment @coderabbitai help to get the list of available commands.}