Automate JDK version updates via versions.json single source of truth

[Luigi Montoya (Luigi96)]

Summary

Introduces a single source of truth for JDK versions and automates keeping it up to date, replacing the hardcoded version matrices that previously had to be edited by hand in multiple places.

Changes

• versions.json — new single source of truth for the expected JDK patch versions (temurin 8 + msopenjdk 11/17/21/25).

• .github/workflows/check-versions.yml and .github/workflows/validate-published-images.yml — refactored to build their matrices from versions.json via a prepare job (using jq + fromJson) instead of duplicating hardcoded { major, expected } lists. This removes 3 copies of the version list.

• scripts/update-versions.sh — new script that discovers the latest patch versions from the authoritative upstream sources:

  • msopenjdk — scraped from the Microsoft Build of OpenJDK download page
  • temurin — queried from the Adoptium API

  The majors to track are driven by the keys in versions.json.

• .github/workflows/update-jdk-versions.yml — new scheduled workflow that runs the script and opens/updates a PR when a newer version is found. Runs Tuesdays and Thursdays at midnight PT so version-bump PRs can be merged before the automated Monday/Wednesday/Friday image builds. Manual workflow_dispatch runs support a mode input:

  • dry-run (default) — prints the detected diff to the job summary, no PR
  • create-pull-request — opens/updates the PR

Notes

• GitHub Actions cron is pinned to 08:00 UTC (midnight PST).
• Auto-generated PRs use the default GITHUB_TOKEN, so the validation workflows won't auto-trigger on them and may need a manual re-run.