Optimize Maven configuration warm path

Avoid eager Maven XML initialization on warm JDK runs by using deterministic serializers for new Maven settings/toolchains files, lazy-loading xmlbuilder2 for existing toolchains merges, and deferring Maven configuration modules until after Java setup. Add targeted tests for XML escaping, lazy xmlbuilder2 loading, concurrent Maven configuration, and a manual benchmark workflow for warm-path validation. Co-authored-by: Copilot App <223556219+Copilot@users.noreply.github.com> Copilot-Session: 4dc58426-5e20-44cb-af16-8da0965fac3b
brunoborges · Jul 30, 2026 · Jul 30, 2026 · Jul 30, 2026 · Jul 30, 2026 · Jul 30, 2026
commit 22ebe9694606d01a05744c211c0fdaec923e51eb
diff --git a/.github/workflows/benchmark-maven-configuration.yml b/.github/workflows/benchmark-maven-configuration.yml
@@ -0,0 +1,160 @@
+name: Benchmark Maven configuration
+
+on:
+  workflow_dispatch:
+    inputs:
+      baseline-ref:
+        description: Git ref containing the baseline implementation
+        required: true
+        default: main
+        type: string
+      candidate-ref:
+        description: Git ref containing the candidate implementation (defaults to the dispatched ref)
+        required: false
+        type: string
+
+permissions:
+  contents: read
+
+defaults:
+  run:
+    shell: bash
+
+jobs:
+  benchmark:
+    name: ${{ matrix.os }} ${{ matrix.cache }} ${{ matrix.versions.name }} ${{ matrix.toolchains }}
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        os: [ubuntu-latest, windows-latest, macos-15-intel]
+        cache: [none, maven, gradle]
+        versions:
+          - name: single
+            java-version: '21'
+          - name: multiple
+            java-version: |
+              17
+              21
+        toolchains: [empty, existing]
+    steps:
+      - name: Checkout benchmark workflow
+        uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - name: Checkout baseline
+        uses: actions/checkout@v7
+        with:
+          path: baseline
+          persist-credentials: false
+          ref: ${{ inputs.baseline-ref }}
+      - name: Checkout candidate
+        uses: actions/checkout@v7
+        with:
+          path: candidate
+          persist-credentials: false
+          ref: ${{ inputs.candidate-ref || github.ref }}
+
+      - name: Record bundle sizes
+        run: |
+          bash __tests__/benchmark-maven-configuration.sh record-size baseline baseline
+          bash __tests__/benchmark-maven-configuration.sh record-size candidate candidate
+
+      - name: Prepare baseline iteration 1
+        run: bash __tests__/benchmark-maven-configuration.sh prepare "${{ matrix.cache }}" "${{ matrix.toolchains }}"
+      - name: Start baseline iteration 1 timer
+        run: bash __tests__/benchmark-maven-configuration.sh start
+      - name: Run baseline iteration 1
+        uses: ./baseline
+        with:
+          distribution: temurin
+          java-version: ${{ matrix.versions.java-version }}
+          cache: ${{ matrix.cache == 'none' && '' || matrix.cache }}
+          cache-dependency-path: benchmark/${{ matrix.cache == 'gradle' && 'build.gradle' || 'pom.xml' }}
+          settings-path: benchmark-maven-home
+      - name: Record baseline iteration 1
+        run: bash __tests__/benchmark-maven-configuration.sh record "${{ matrix.os }}" "${{ matrix.cache }}" "${{ matrix.versions.name }}" "${{ matrix.toolchains }}" baseline 1
+
+      - name: Prepare candidate iteration 1
+        run: bash __tests__/benchmark-maven-configuration.sh prepare "${{ matrix.cache }}" "${{ matrix.toolchains }}"
+      - name: Start candidate iteration 1 timer
+        run: bash __tests__/benchmark-maven-configuration.sh start
+      - name: Run candidate iteration 1
+        uses: ./candidate
+        with:
+          distribution: temurin
+          java-version: ${{ matrix.versions.java-version }}
+          cache: ${{ matrix.cache == 'none' && '' || matrix.cache }}
+          cache-dependency-path: benchmark/${{ matrix.cache == 'gradle' && 'build.gradle' || 'pom.xml' }}
+          settings-path: benchmark-maven-home
+      - name: Record candidate iteration 1
+        run: bash __tests__/benchmark-maven-configuration.sh record "${{ matrix.os }}" "${{ matrix.cache }}" "${{ matrix.versions.name }}" "${{ matrix.toolchains }}" candidate 1
+
+      - name: Prepare baseline iteration 2
+        run: bash __tests__/benchmark-maven-configuration.sh prepare "${{ matrix.cache }}" "${{ matrix.toolchains }}"
+      - name: Start baseline iteration 2 timer
+        run: bash __tests__/benchmark-maven-configuration.sh start
+      - name: Run baseline iteration 2
+        uses: ./baseline
+        with:
+          distribution: temurin
+          java-version: ${{ matrix.versions.java-version }}
+          cache: ${{ matrix.cache == 'none' && '' || matrix.cache }}
+          cache-dependency-path: benchmark/${{ matrix.cache == 'gradle' && 'build.gradle' || 'pom.xml' }}
+          settings-path: benchmark-maven-home
+      - name: Record baseline iteration 2
+        run: bash __tests__/benchmark-maven-configuration.sh record "${{ matrix.os }}" "${{ matrix.cache }}" "${{ matrix.versions.name }}" "${{ matrix.toolchains }}" baseline 2
+
+      - name: Prepare candidate iteration 2
+        run: bash __tests__/benchmark-maven-configuration.sh prepare "${{ matrix.cache }}" "${{ matrix.toolchains }}"
+      - name: Start candidate iteration 2 timer
+        run: bash __tests__/benchmark-maven-configuration.sh start
+      - name: Run candidate iteration 2
+        uses: ./candidate
+        with:
+          distribution: temurin
+          java-version: ${{ matrix.versions.java-version }}
+          cache: ${{ matrix.cache == 'none' && '' || matrix.cache }}
+          cache-dependency-path: benchmark/${{ matrix.cache == 'gradle' && 'build.gradle' || 'pom.xml' }}
+          settings-path: benchmark-maven-home
+      - name: Record candidate iteration 2
+        run: bash __tests__/benchmark-maven-configuration.sh record "${{ matrix.os }}" "${{ matrix.cache }}" "${{ matrix.versions.name }}" "${{ matrix.toolchains }}" candidate 2
+
+      - name: Prepare baseline iteration 3
+        run: bash __tests__/benchmark-maven-configuration.sh prepare "${{ matrix.cache }}" "${{ matrix.toolchains }}"
+      - name: Start baseline iteration 3 timer
+        run: bash __tests__/benchmark-maven-configuration.sh start
+      - name: Run baseline iteration 3
+        uses: ./baseline
+        with:
+          distribution: temurin
+          java-version: ${{ matrix.versions.java-version }}
+          cache: ${{ matrix.cache == 'none' && '' || matrix.cache }}
+          cache-dependency-path: benchmark/${{ matrix.cache == 'gradle' && 'build.gradle' || 'pom.xml' }}
+          settings-path: benchmark-maven-home
+      - name: Record baseline iteration 3
+        run: bash __tests__/benchmark-maven-configuration.sh record "${{ matrix.os }}" "${{ matrix.cache }}" "${{ matrix.versions.name }}" "${{ matrix.toolchains }}" baseline 3
+
+      - name: Prepare candidate iteration 3
+        run: bash __tests__/benchmark-maven-configuration.sh prepare "${{ matrix.cache }}" "${{ matrix.toolchains }}"
+      - name: Start candidate iteration 3 timer
+        run: bash __tests__/benchmark-maven-configuration.sh start
+      - name: Run candidate iteration 3
+        uses: ./candidate
+        with:
+          distribution: temurin
+          java-version: ${{ matrix.versions.java-version }}
+          cache: ${{ matrix.cache == 'none' && '' || matrix.cache }}
+          cache-dependency-path: benchmark/${{ matrix.cache == 'gradle' && 'build.gradle' || 'pom.xml' }}
+          settings-path: benchmark-maven-home
+      - name: Record candidate iteration 3
+        run: bash __tests__/benchmark-maven-configuration.sh record "${{ matrix.os }}" "${{ matrix.cache }}" "${{ matrix.versions.name }}" "${{ matrix.toolchains }}" candidate 3
+
+      - name: Summarize benchmark
+        run: bash __tests__/benchmark-maven-configuration.sh summarize "$GITHUB_STEP_SUMMARY"
+      - name: Upload raw benchmark data
+        uses: actions/upload-artifact@v6
+        with:
+          name: maven-config-${{ matrix.os }}-${{ matrix.cache }}-${{ matrix.versions.name }}-${{ matrix.toolchains }}
+          path: .benchmark-results/
+          if-no-files-found: error
@@ -13,6 +13,7 @@ import * as io from '@actions/io';
 import * as fs from 'fs';
 import * as path from 'path';
 import os from 'os';
+import {create as parseXml} from 'xmlbuilder2';
 
 // Mock @actions/core before importing source modules that depend on it
 jest.unstable_mockModule('@actions/core', () => ({
@@ -271,6 +272,31 @@ describe('auth tests', () => {
     );
   });
 
+  it('escapes settings.xml values while preserving parsed semantics', () => {
+    const id = `packages&<>"'é`;
+    const username = `USER&<>"'é`;
+    const password = `TOKEN&<>"'é`;
+    const gpgPassphrase = `GPG&<>"'é`;
+
+    const xml = auth.generate(id, username, password, gpgPassphrase);
+    const parsed = parseXml(xml).root().toObject() as any;
+
+    expect(parsed.settings.interactiveMode).toBe('false');
+    expect(xmlElementText(xml, 'id')).toBe(id);
+    expect(xmlElementText(xml, 'username')).toBe(`\${env.${username}}`);
+    expect(xmlElementText(xml, 'password')).toBe(`\${env.${password}}`);
+    expect(xmlElementText(xml, 'gpg.passphraseEnvName')).toBe(gpgPassphrase);
+    expect(parsed.settings.activeProfiles.activeProfile).toBe('setup-java-gpg');
+  });
+
+  function xmlElementText(xml: string, tagName: string): string {
+    const match = new RegExp(`<${tagName}>([\\s\\S]*?)</${tagName}>`).exec(xml);
+    expect(match).not.toBeNull();
+    return (
+      parseXml(`<value>${match?.[1]}</value>`).root().node.textContent ?? ''
+    );
+  }
+
   it('uses deprecated input aliases and warns', () => {
     const mockGetInput = core.getInput as jest.MockedFunction<
       typeof core.getInput

diff --git a/__tests__/benchmark-maven-configuration.sh b/__tests__/benchmark-maven-configuration.sh
@@ -0,0 +1,161 @@
+#!/usr/bin/env bash
+
+set -euo pipefail
+
+command=${1:?command is required}
+
+benchmark_home="$PWD/benchmark-maven-home"
+results_dir="$PWD/.benchmark-results"
+results_file="$results_dir/maven-configuration-timings.csv"
+sizes_file="$results_dir/maven-configuration-sizes.csv"
+
+case "$command" in
+  prepare)
+    cache=${2:?cache profile is required}
+    toolchains_profile=${3:?toolchains profile is required}
+
+    rm -rf "$benchmark_home"
+    mkdir -p "$benchmark_home" benchmark
+    printf '<project />\n' > benchmark/pom.xml
+    printf 'plugins { id("java") }\n' > benchmark/build.gradle
+
+    if [ "$toolchains_profile" = "existing" ]; then
+      cat > "$benchmark_home/toolchains.xml" <<'XML'
+<toolchains xmlns="http://maven.apache.org/TOOLCHAINS/1.0.0"
+  xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+  xsi:schemaLocation="http://maven.apache.org/TOOLCHAINS/1.0.0 http://maven.apache.org/xsd/toolchains-1.0.0.xsd">
+  <toolchain>
+    <type>foo</type>
+    <provides>
+      <custom>preserved</custom>
+    </provides>
+    <configuration>
+      <fooHome>/opt/foo</fooHome>
+    </configuration>
+  </toolchain>
+</toolchains>
+XML
+    elif [ "$toolchains_profile" != "empty" ]; then
+      echo "Unsupported toolchains profile: $toolchains_profile" >&2
+      exit 1
+    fi
+
+    case "$cache" in
+      none | maven | gradle) ;;
+      *)
+        echo "Unsupported cache profile: $cache" >&2
+        exit 1
+        ;;
+    esac
+    ;;
+  start)
+    mkdir -p "$results_dir"
+    node -e "require('fs').writeFileSync('.benchmark-start', String(Date.now()))"
+    ;;
+  record)
+    os=${2:?os is required}
+    cache=${3:?cache profile is required}
+    versions=${4:?versions profile is required}
+    toolchains_profile=${5:?toolchains profile is required}
+    implementation=${6:?implementation is required}
+    iteration=${7:?iteration is required}
+
+    started=$(cat .benchmark-start)
+    finished=$(node -e "process.stdout.write(String(Date.now()))")
+    elapsed=$((finished - started))
+    mkdir -p "$results_dir"
+    printf '%s,%s,%s,%s,%s,%s,%s\n' \
+      "$os" "$cache" "$versions" "$toolchains_profile" "$implementation" "$iteration" "$elapsed" \
+      >> "$results_file"
+    ;;
+  record-size)
+    implementation=${2:?implementation is required}
+    action_path=${3:?action path is required}
+    mkdir -p "$results_dir"
+    index_bytes=$(node -e "const fs=require('fs'); process.stdout.write(String(fs.statSync(process.argv[1]).size))" "$action_path/dist/setup/index.js")
+    js_bytes=$(node -e "const fs=require('fs'); const path=require('path'); let total=0; for (const entry of fs.readdirSync(process.argv[1])) { if (entry.endsWith('.js')) total += fs.statSync(path.join(process.argv[1], entry)).size; } process.stdout.write(String(total));" "$action_path/dist/setup")
+    chunk_count=$(find "$action_path/dist/setup" -maxdepth 1 -name '*.js' | wc -l | tr -d ' ')
+    xmlbuilder_chunks=$(grep -Rsl "xmlbuilder2" "$action_path/dist/setup"/*.js 2>/dev/null | xargs -n 1 basename 2>/dev/null | paste -sd ';' - || true)
+    printf '%s,%s,%s,%s\n' \
+      "$implementation" "$index_bytes" "$js_bytes" "${xmlbuilder_chunks:-none} ($chunk_count js files)" \
+      >> "$sizes_file"
+    ;;
+  summarize)
+    summary_file=${2:?summary file is required}
+    node --input-type=module - "$results_file" "$sizes_file" "$summary_file" <<'NODE'
+import fs from 'node:fs';
+
+const [, , resultsFile, sizesFile, summaryFile] = process.argv;
+
+const percentile = (values, percentileValue) => {
+  const sorted = [...values].sort((left, right) => left - right);
+  const index = Math.ceil((percentileValue / 100) * sorted.length) - 1;
+  return sorted[Math.max(0, Math.min(index, sorted.length - 1))];
+};
+
+const rows = fs
+  .readFileSync(resultsFile, 'utf8')
+  .trim()
+  .split('\n')
+  .filter(Boolean)
+  .map(line => {
+    const [os, cache, versions, toolchains, implementation, iteration, elapsed] =
+      line.split(',');
+    return {
+      os,
+      cache,
+      versions,
+      toolchains,
+      implementation,
+      iteration,
+      elapsed: Number(elapsed)
+    };
+  });
+
+const groups = new Map();
+for (const row of rows) {
+  const key = [row.os, row.cache, row.versions, row.toolchains, row.implementation].join(',');
+  const values = groups.get(key) ?? [];
+  values.push(row.elapsed);
+  groups.set(key, values);
+}
+
+const lines = [
+  '## Maven configuration warm-path benchmark',
+  '',
+  '| OS | Cache | Versions | Toolchains | Implementation | Runs | Median (ms) | p95 (ms) |',
+  '| --- | --- | --- | --- | --- | ---: | ---: | ---: |'
+];
+
+for (const [key, values] of [...groups.entries()].sort()) {
+  const [os, cache, versions, toolchains, implementation] = key.split(',');
+  lines.push(
+    `| ${os} | ${cache} | ${versions} | ${toolchains} | ${implementation} | ${values.length} | ${percentile(values, 50)} | ${percentile(values, 95)} |`
+  );
+}
+
+if (fs.existsSync(sizesFile)) {
+  lines.push(
+    '',
+    '## setup entry/chunk sizes',
+    '',
+    '| Implementation | dist/setup/index.js bytes | dist/setup JS bytes | xmlbuilder2 chunk location |',
+    '| --- | ---: | ---: | --- |'
+  );
+  for (const line of fs.readFileSync(sizesFile, 'utf8').trim().split('\n')) {
+    if (!line) continue;
+    const [implementation, indexBytes, jsBytes, xmlbuilderChunks] = line.split(',');
+    lines.push(
+      `| ${implementation} | ${indexBytes} | ${jsBytes} | ${xmlbuilderChunks} |`
+    );
+  }
+}
+
+fs.appendFileSync(summaryFile, `${lines.join('\n')}\n`);
+NODE
+    ;;
+  *)
+    echo "Unsupported command: $command" >&2
+    exit 1
+    ;;
+esac