feat(installer): add user-wide installers and publication workflows

.github/workflows/pages.yml

@@ -0,0 +1,54 @@
+name: Publish installer site
+on:
+  push:
+    paths:
+      - 'web/**'
+      - 'tools/**'
+      - 'tests/**'
+      - '.github/workflows/**'
+  workflow_dispatch:
+permissions:
+  contents: read
+concurrency:
+  group: pages
+  cancel-in-progress: false
+jobs:
+  checks:
+    if: github.ref == format('refs/heads/{0}', github.event.repository.default_branch)
+    uses: ./.github/workflows/test.yml
+    with:
+      revision: ${{ github.sha }}
+  stage:
+    needs: checks
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          persist-credentials: false
+      - name: Verify public release before exposing latest.txt
+        run: |
+          python3 tools/pages-preflight.py
+          python3 tools/package-release.py "$(cat web/latest.txt)" "$RUNNER_TEMP/site" --site
+      - uses: actions/upload-pages-artifact@56afc609e74202658d3ffba0e8f6dda462b719fa # v3
+        with:
+          path: ${{ runner.temp }}/site
+  deploy:
+    needs: stage
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: read
+      pages: write
+      id-token: write
+    environment:
+      name: github-pages
+      url: ${{ steps.deployment.outputs.page_url }}
+    steps:
+      - name: Refuse stale queued revision
+        env:
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+          BRANCH: ${{ github.event.repository.default_branch }}
+          REVISION: ${{ github.sha }}
+        run: test "$(gh api "repos/$GH_REPO/commits/$BRANCH" --jq .sha)" = "$REVISION"
+      - uses: actions/deploy-pages@d6db90164ac5ed86f2b6aed7e0febac5b3c0c03e # v4
+        id: deployment

.github/workflows/release.yml

@@ -0,0 +1,63 @@
+name: Publish versioned tool
+on:
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: Existing reviewed tag, e.g. v0.2.0 (never overwritten)
+        required: true
+        type: string
+permissions:
+  contents: read
+concurrency:
+  group: release-${{ inputs.tag }}
+  cancel-in-progress: false
+jobs:
+  resolve:
+    runs-on: ubuntu-24.04
+    outputs:
+      revision: ${{ steps.tag.outputs.revision }}
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ inputs.tag }}
+          fetch-depth: 0
+          persist-credentials: false
+      - id: tag
+        env:
+          TAG: ${{ inputs.tag }}
+        run: |
+          [[ "$TAG" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]
+          revision=$(git rev-parse "refs/tags/$TAG^{commit}")
+          test "$revision" = "$(git rev-parse HEAD)"
+          printf 'revision=%s\n' "$revision" >> "$GITHUB_OUTPUT"
+  checks:
+    needs: resolve
+    uses: ./.github/workflows/test.yml
+    with:
+      revision: ${{ needs.resolve.outputs.revision }}
+  publish:
+    needs: [resolve, checks]
+    runs-on: ubuntu-24.04
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ needs.resolve.outputs.revision }}
+          fetch-depth: 0
+          persist-credentials: false
+      - name: Validate tag and prepare exact-byte assets
+        env:
+          TAG: ${{ inputs.tag }}
+        run: |
+          [[ "$TAG" =~ ^v(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)\.(0|[1-9][0-9]*)$ ]]
+          test "$(git rev-parse "refs/tags/$TAG^{commit}")" = "$(git rev-parse HEAD)"
+          python3 tools/package-release.py "${TAG#v}" "$RUNNER_TEMP/assets"
+      - name: Create draft with all assets, then publish
+        env:
+          TAG: ${{ inputs.tag }}
+          GH_TOKEN: ${{ github.token }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          gh release create "$TAG" "$RUNNER_TEMP/assets/"* --verify-tag --draft --title "$TAG" --notes "Verified jvm tool payloads. See README for installation instructions."
+          gh release edit "$TAG" --draft=false

.github/workflows/test.yml

@@ -3,6 +3,14 @@ name: Bash portability
 on:
   push:
   pull_request:
+  workflow_call:
+    inputs:
+      revision:
+        type: string
+        default: ''
+      real_jdk:
+        type: boolean
+        default: false
   workflow_dispatch:
     inputs:
       real_jdk:
@@ -13,11 +21,32 @@ on:
 permissions:
   contents: read
 
-concurrency:
-  group: bash-${{ github.workflow }}-${{ github.ref }}
-  cancel-in-progress: true
-
 jobs:
+  packaging:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ inputs.revision || github.sha }}
+          persist-credentials: false
+      - run: python3 tests/release-tooling.py
+
+  shells:
+    runs-on: ubuntu-24.04
+    steps:
+      - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
+        with:
+          ref: ${{ inputs.revision || github.sha }}
+          persist-credentials: false
+      - run: |
+          sudo apt-get update
+          sudo apt-get install --no-install-recommends -y zsh fish csh tcsh shellcheck
+          csh_bin=$(dpkg -L csh | awk '/\/bsd-csh$/ {print; exit}')
+          test -x "$csh_bin"
+          sudo update-alternatives --set csh "$csh_bin"
+          shellcheck -S warning web/install.sh
+          bash tests/tool-installer.sh --native-shells
+
   unix:
     name: ${{ matrix.os }} / Bash ${{ matrix.bash }}
     runs-on: ${{ matrix.os }}
@@ -34,6 +63,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
+          ref: ${{ inputs.revision || github.sha }}
       - name: Bash 3.2 build dependencies
         if: runner.os == 'Linux' && matrix.bash == '3.2'
         run: |
@@ -91,11 +121,14 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
+          ref: ${{ inputs.revision || github.sha }}
       - name: Windows PowerShell 5.1 smoke suite
         run: |
           $PSVersionTable.PSVersion
           powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/powershell.ps1
           if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
+          powershell.exe -NoProfile -ExecutionPolicy Bypass -File tests/tool-installer.ps1
+          if ($LASTEXITCODE -ne 0) { exit $LASTEXITCODE }
 
   windows:
     name: Windows / ${{ matrix.environment }} / Bash ${{ matrix.bash }}
@@ -121,6 +154,7 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
           persist-credentials: false
+          ref: ${{ inputs.revision || github.sha }}
       - uses: msys2/setup-msys2@ec48f7c5447b3140e2b088413ae3a55687bccb6e # v2
         if: matrix.environment == 'MSYS2'
         with: