feat!: remove legacy Java node attribute API

.github/workflows/ci.yml

@@ -8,43 +8,52 @@ name: "Test"
 
 jobs:
   lint-unit:
-    uses: sous-chefs/.github/.github/workflows/lint-unit.yml@8.0.2
+    uses: sous-chefs/.github/.github/workflows/lint-unit.yml@8.0.4
     permissions:
-      actions: write
       checks: write
       pull-requests: write
       statuses: write
-      issues: write
+    secrets: inherit
 
   integration:
     needs: "lint-unit"
     runs-on: ubuntu-latest
     strategy:
       matrix:
         os:
+          - almalinux-8
+          - almalinux-9
+          - almalinux-10
           - amazonlinux-2023
+          - centos-stream-9
+          - centos-stream-10
           - debian-12
           - debian-13
-          - rockylinux-9
+          - fedora-latest
+          - oraclelinux-8
+          - oraclelinux-9
           - rockylinux-8
+          - rockylinux-9
+          - rockylinux-10
           - ubuntu-2204
-          - ubuntu-2004
+          - ubuntu-2404
         suite:
-          - corretto-11
-          - corretto-17
-          - corretto-18
-          - temurin-8
+          - openjdk-11
+          - openjdk-17
           - temurin-11
           - temurin-17
           - temurin-21
+          - temurin-25
+          - corretto-11
+          - corretto-17
       fail-fast: false
     steps:
       - name: Check out code
         uses: actions/checkout@v6
       - name: Install Chef
-        uses: actionshub/chef-install@6.0.0
+        uses: sous-chefs/.github/.github/actions/install-workstation@8.0.4
       - name: Dokken
-        uses: actionshub/test-kitchen@3.0.0
+        uses: actionshub/test-kitchen@main
         env:
           CHEF_LICENSE: accept-no-persist
           KITCHEN_LOCAL_YAML: kitchen.dokken.yml
@@ -56,4 +65,4 @@ jobs:
     runs-on: ubuntu-latest
     needs: [integration]
     steps:
-      - run: echo ${{needs.integration.outputs}}
+      - run: echo "integration completed"

.github/workflows/release.yml

@@ -16,7 +16,7 @@ permissions:
 
 jobs:
   release:
-    uses: sous-chefs/.github/.github/workflows/release-cookbook.yml@8.0.2
+    uses: sous-chefs/.github/.github/workflows/release-cookbook.yml@8.0.4
     secrets:
       token: ${{ secrets.PORTER_GITHUB_TOKEN }}
       supermarket_user: ${{ secrets.CHEF_SUPERMARKET_USER }}

AGENTS.md

@@ -0,0 +1,79 @@
+# AGENTS.md
+
+## Purpose
+
+This file records maintainer and agent decisions for the Java cookbook. Keep it focused on durable
+patterns, support boundaries, and non-obvious implementation choices. Do not use it as a task
+changelog.
+
+## Modernization Scope
+
+This cookbook is being modernized incrementally. Preserve the existing custom-resource API where it
+is still useful, and avoid broad rewrites unless the requested work explicitly calls for a full
+migration.
+
+Prefer resource properties and helper-derived defaults over cookbook node attributes. Do not add
+`attributes/` back to provide defaults for resources.
+
+## Resource Defaults
+
+Cookbook-owned defaults should live on resources as static defaults, `lazy` helper calls, or helper
+methods in `libraries/`. This keeps defaults visible at the resource boundary and testable through
+ChefSpec.
+
+Do not write cookbook state into `node.default`, `node.normal`, `node.override`, or
+`node.automatic`. In particular, do not reintroduce `node['java']` as an API surface for
+`java_home`, `jdk_version`, `download_path`, install type, JCE values, or similar resource inputs.
+
+Do not create custom Ohai plugins for cookbook defaults. Ohai automatic attributes should describe
+discovered machine facts, not cookbook policy or resource configuration.
+
+## Platform Support
+
+Keep `metadata.rb`, Kitchen files, and GitHub Actions matrices aligned. Platform entries should be
+current, non-EOL, and backed by either vendor support or explicit cookbook helper behavior.
+
+OpenJDK package installs use the platform package manager where helper logic supports the requested
+Java version. Source installs remain the fallback when a requested version is not available through
+the package path.
+
+## Dependency Management
+
+Use `Policyfile.rb` for dependency resolution. Keep it local-only unless a real external cookbook
+dependency is introduced. Do not add `default_source :supermarket` when every cookbook in the policy
+is supplied by a path.
+
+Avoid external cookbook dependencies for simple file edits in custom resources. Prefer native Chef
+resources so unit tests and Kitchen do not need to contact Supermarket during Policyfile setup.
+
+Do not reintroduce Berkshelf files or ChefSpec Berkshelf loading unless there is an explicit
+compatibility reason.
+
+## Resource Notes
+
+`java_alternatives` accepts `bin_cmds` as an Array. Its public actions are `:set` and `:unset`.
+Keep both actions covered by ChefSpec when changing alternatives behavior.
+
+Linux install resources that include the shared Linux partial (`openjdk_pkg_install`,
+`openjdk_source_install`, `openjdk_install`, `corretto_install`, and `temurin_package_install`)
+default `reset_alternatives` to `true` through that partial.
+
+`java_certificate` should provide sensible resource defaults without reading `node['java']`.
+Current defaults are Java 17 and a platform-specific OpenJDK package `java_home` derived from helper
+logic.
+
+`java_jce` documents legacy Oracle JCE policy file installation only. It should not be described as
+a general Java vendor installation path. JCE URL, checksum, and Java home are explicit resource
+inputs; staging defaults to Chef's file cache path.
+
+`temurin_package_install` does not have an `air_gap` property. It supports `repository_uri` for
+alternate or mirrored package repositories. The resource must not make live Adoptium API calls while
+evaluating defaults.
+
+Amazon Corretto installs are source archive based and support the architecture-specific Corretto
+archive naming handled by helper code (`x64` and `aarch64`). Kitchen and CI cover Corretto 11 and 17
+only; do not add Corretto suites for other majors unless `libraries/corretto_helpers.rb`, docs, and
+tests are updated with explicit archive metadata.
+
+`openjdk_source_install` documentation examples should call `openjdk_source_install`, not the
+dispatcher resource `openjdk_install`.

Policyfile.rb

@@ -0,0 +1,15 @@
+# frozen_string_literal: true
+
+name 'java'
+
+cookbook 'java', path: '.'
+cookbook 'test', path: 'test/fixtures/cookbooks/test'
+
+run_list 'test::base'
+
+named_run_list :base, 'test::base'
+named_run_list :openjdk, 'test::openjdk'
+named_run_list :openjdk_pkg, 'test::openjdk_pkg'
+named_run_list :temurin_pkg, 'test::temurin_pkg'
+named_run_list :corretto, 'test::corretto'
+named_run_list :java_cert, 'test::java_cert'

README.md

@@ -6,7 +6,7 @@
 [![OpenCollective](https://opencollective.com/sous-chefs/sponsors/badge.svg)](#sponsors)
 [![License](https://img.shields.io/badge/License-Apache%202.0-green.svg)](https://opensource.org/licenses/Apache-2.0)
 
-This cookbook installs a Java JDK/JRE. It defaults to installing [OpenJDK](https://openjdk.java.net/), but it can also install [AdoptOpenJDK](https://adoptopenjdk.net/) and [Amazon Corretto](https://corretto.aws/).
+This cookbook installs a Java JDK/JRE. It defaults to installing [OpenJDK](https://openjdk.java.net/), but it can also install [Eclipse Temurin](https://adoptium.net/temurin/) and [Amazon Corretto](https://corretto.aws/).
 
 ## Maintainers
 
@@ -25,14 +25,14 @@ Chef 15.3+
 
 ## Resources
 
-- [adoptopenjdk_install](https://github.com/sous-chefs/java/blob/master/documentation/resources/adoptopenjdk_install.md)
-- [adoptopenjdk_macos_install](https://github.com/sous-chefs/java/blob/master/documentation/resources/adoptopenjdk_macos_install.md)
 - [alternatives](https://github.com/sous-chefs/java/blob/master/documentation/resources/alternatives.md)
 - [certificate](https://github.com/sous-chefs/java/blob/master/documentation/resources/certificate.md)
 - [corretto_install](https://github.com/sous-chefs/java/blob/master/documentation/resources/corretto_install.md)
 - [jce](https://github.com/sous-chefs/java/blob/master/documentation/resources/jce.md)
 - [openjdk_install](https://github.com/sous-chefs/java/blob/master/documentation/resources/openjdk_install.md)
 - [openjdk_pkg_install](https://github.com/sous-chefs/java/blob/master/documentation/resources/openjdk_pkg_install.md)
+- [openjdk_source_install](https://github.com/sous-chefs/java/blob/master/documentation/resources/openjdk_source_install.md)
+- [temurin_package_install](https://github.com/sous-chefs/java/blob/master/documentation/resources/temurin_package_install.md)
 
 ## Contributors
 

documentation/resources/alternatives.md

@@ -15,10 +15,10 @@ The `java_alternatives` resource uses `update-alternatives` command to set and u
 | Name                 | Type          | Default | Description                                                                  |
 | -------------------- | ------------- | ------- | ---------------------------------------------------------------------------- |
 | `java_location`      | `String`      |         | Java installation location                                                   |
-| `bin_cmds`           | `String`      |         | Array of Java tool names to set or unset alternatives on                     |
+| `bin_cmds`           | `Array`       |         | Array of Java tool names to set or unset alternatives on                     |
 | `default`            | `true, false` | `true`  | Whether to set the Java tools as system default. Boolean, defaults to `true` |
 | `priority`           | `Integer`     | `1061`  | Priority of the alternatives. Integer, defaults to `1061`                    |
-| `reset_alternatives` | `true, false` | `true`  | Whether to reset alternatives before setting them                            |
+| `reset_alternatives` | `true, false` | `false` | Whether to reset alternatives before setting them                            |
 
 - `java_location`: Java installation location.
 - `bin_cmds`: .
@@ -29,7 +29,7 @@ The `java_alternatives` resource uses `update-alternatives` command to set and u
 
 ```ruby
 java_alternatives "set java alternatives" do
-    java_location '/usr/local/java'
-    bin_cmds ["java", "javac"]
+  java_location '/usr/local/java'
+  bin_cmds ["java", "javac"]
 end
 ```

documentation/resources/certificate.md

@@ -13,17 +13,17 @@ It can also populate the keystore with a certificate retrieved from a given SSL
 
 ## Properties
 
-| Name              | Type   | Default                     | Description                                                                             |
-| ----------------- | ------ | --------------------------- | --------------------------------------------------------------------------------------- |
-| `java_home`       |        | `node['java']['java_home']`   | The java home directory                                                                 |
-| `java_version`    |        | `node['java']['jdk_version']` | The java version                                                                        |
-| `keystore_path`   | String |                             | Path to the keystore                                                                    |
-| `keystore_passwd` | String | `changeit`                  | Password to the keystore                                                                |
-| `cert_alias`      | String |                             | The alias of the certificate in the keystore. This defaults to the name of the resource |
-| `cert_data`       | String |                             | The certificate data to install                                                         |
-| `cert_file`       | String |                             | Path to a certificate file to install                                                   |
-| `ssl_endpoint`    | String |                             | An SSL end-point from which to download the certificate                                 |
-| `starttls`        | String |                             | Control the TLS protocol handler when fetching a remote certificate from `ssl_endpoint` |
+| Name | Type | Default | Description |
+| --- | --- | --- | --- |
+| `java_home` | String | Platform-specific path for `java_version` | The java home directory |
+| `java_version` | String | `17` | The java version |
+| `keystore_path` | String | | Path to the keystore |
+| `keystore_passwd` | String | `changeit` | Password to the keystore |
+| `cert_alias` | String | | The alias of the certificate in the keystore. This defaults to the name of the resource |
+| `cert_data` | String | | The certificate data to install |
+| `cert_file` | String | | Path to a certificate file to install |
+| `ssl_endpoint` | String | | An SSL end-point from which to download the certificate |
+| `starttls` | String | | Control the TLS protocol handler when fetching a remote certificate from `ssl_endpoint` |
 
 ## Examples
 

documentation/resources/corretto_install.md

@@ -14,21 +14,21 @@ Introduced: v8.0.0
 
 ## Properties
 
-| Name                  | Type            | Default                              | Description                                                                                                       |
-| --------------------- | --------------- | ------------------------------------ | ----------------------------------------------------------------------------------------------------------------- |
-| version               | String          |                                      | Java version to install                                                                                           |
-| full_version          | String          |                                      | Used to configure the package directory, change this is the version installed by the package is no longer correct |
-| url                   | String          | `default_corretto_url(version)`      | The URL to download from                                                                                          |
-| checksum              | String          |                                      | The checksum for the downloaded file                                                                              |
-| java_home             | String          | Based on the version                 | Set to override the java_home                                                                                     |
-| java_home_mode        | Integer, String | `0755`                               | The permission for the Java home directory                                                                        |
-| java_home_owner       | String          | `root`                               | Owner of the Java Home                                                                                            |
-| java_home_group       | String          | `node['root_group']`                 | Group for the Java Home                                                                                           |
-| default               | Boolean         | `true`                               | Whether to set this as the default Java                                                                           |
-| bin_cmds              | Array           | `default_corretto_bin_cmds(version)` | A list of bin_cmds based on the version and variant                                                               |
-| alternatives_priority | Integer         | `1`                                  | Alternatives priority to set for this Java                                                                        |
-| reset_alternatives    | Boolean         | `true`                               | Whether to reset alternatives before setting                                                                      |
-| skip_alternatives     | Boolean         | `false`                              | Skip alternatives installation completely                                                                          |
+| Name | Type | Default | Description |
+| --- | --- | --- | --- |
+| version | String | | Java version to install |
+| full_version | String | | Used to configure the package directory, change this is the version installed by the package is no longer correct |
+| url | String | `default_corretto_url(version)` | The URL to download from |
+| checksum | String | | The checksum for the downloaded file |
+| java_home | String | Based on the version | Set to override the java_home |
+| java_home_mode | Integer, String | `0755` | The permission for the Java home directory |
+| java_home_owner | String | `root` | Owner of the Java Home |
+| java_home_group | String | `node['root_group']` | Group for the Java Home |
+| default | Boolean | `true` | Whether to set this as the default Java |
+| bin_cmds | Array | `default_corretto_bin_cmds(version)` | A list of bin_cmds based on the version and variant |
+| alternatives_priority | Integer | `1` | Alternatives priority to set for this Java |
+| reset_alternatives | Boolean | `true` | Whether to reset alternatives before setting |
+| skip_alternatives | Boolean | `false` | Skip alternatives installation completely |
 
 ## Examples