ahus1 · Oct 28, 2026
@@ -52,6 +52,9 @@ runs:
         # classpath, so it is not a declared dependency and won't be fetched by dependency:resolve.
         JUNIT5_VER=$(./mvnw help:evaluate -Dexpression=junit5.version -q -DforceStdout -pl testsuite/integration-arquillian/tests/base)
         ./mvnw dependency:get -Dartifact=org.junit.jupiter:junit-jupiter-engine:${JUNIT5_VER}
+        # Surefire also resolves junit-platform-launcher at test runtime. Its version matches the JUnit 5
+        # version with the major version replaced (5.10.3 -> 1.10.3).
+        ./mvnw dependency:get -Dartifact=org.junit.platform:junit-platform-launcher:1.${JUNIT5_VER#5.}
 
     - id: compress-keycloak-maven-repository
       name: Compress Keycloak Maven artifacts

@@ -20,3 +20,18 @@ runs:
       with:
         distribution: ${{ inputs.distribution }}
         java-version: ${{ inputs.java-version }}
+
+    - name: Configure Maven for CI
+      shell: bash
+      run: |
+        # -B: batch mode, -nsu: don't check for snapshot updates
+        args="-B -nsu"
+        # HTTP transport settings for Maven Resolver 1.9.x (Maven 3.9.x); Maven 4 uses aether.transport.http.* instead.
+        # Drop pooled connections after 25 seconds (default: 300), as GitHub runners kept reusing connections that were already closed (https://github.com/keycloak/keycloak/pull/22946).
+        args="$args -Daether.connector.http.connectionMaxTtl=25"
+        # Retry failed downloads up to 5 times (default: 3), as Maven Central occasionally fails a single artifact with a transient error.
+        args="$args -Daether.connector.http.retryHandler.count=5"
+        # By default only 429 and 503 are retried with a back-off; add 502 (Bad Gateway) and 504 (Gateway Timeout).
+        # See https://github.com/apache/maven-resolver/issues/2151 for a request to make this configurable and to cover more status codes.
+        args="$args -Daether.connector.http.retryHandler.serviceUnavailable=429,502,503,504"
+        echo "MAVEN_ARGS=$args" >> "$GITHUB_ENV"
@@ -43,6 +43,10 @@ runs:
           ~/.m2/wrapper/dists
           !~/.m2/repository/org/keycloak
         key: mvn-and-wrapper-${{ runner.os }}-${{ steps.weekly-cache-key.outputs.key }}
+        # Fall back to an older cache (for example from the previous week) to avoid a cold start.
+        # This must not be added to the writing step above, as it would then grow the cache every week.
+        restore-keys: |
+          mvn-and-wrapper-${{ runner.os }}-mvn-
 
     - id: node-cache
       name: Node cache

@@ -10,7 +10,6 @@ on:
   workflow_dispatch:
 
 env:
-  MAVEN_ARGS: "-B -nsu -Daether.connector.http.connectionMaxTtl=25"
   SUREFIRE_RERUN_FAILING_COUNT: 2
   SUREFIRE_RETRY: "-Dsurefire.rerunFailingTestsCount=2"
   KC_TEST_GITHUB_SLOW_METHOD: "10"

@@ -11,9 +11,6 @@ on:
      branches: [main]
   workflow_dispatch:
 
-env:
-  MAVEN_ARGS: "-B -nsu -Daether.connector.http.connectionMaxTtl=25"
-
 concurrency:
   # Only cancel jobs for PR updates
   group: codeql-analysis-${{ github.ref }}

@@ -3,9 +3,6 @@ name: Conformance Tests
 on:
   workflow_dispatch:
 
-env:
-  MAVEN_ARGS: "-B -nsu -Daether.connector.http.connectionMaxTtl=25"
-
 concurrency:
   group: conformance-${{ github.ref }}
   cancel-in-progress: true

@@ -10,9 +10,6 @@ on:
   pull_request:
   workflow_dispatch:
 
-env:
-  MAVEN_ARGS: "-B -nsu -Daether.connector.http.connectionMaxTtl=25"
-
 concurrency:
   # Only cancel jobs for PR updates
   group: documentation-${{ github.ref }}

@@ -10,9 +10,6 @@ on:
   pull_request:
   workflow_dispatch:
 
-env:
-  MAVEN_ARGS: "-B -nsu -Daether.connector.http.connectionMaxTtl=25"
-
 concurrency:
   # Only cancel jobs for PR updates
   group: guides-${{ github.ref }}

@@ -10,9 +10,6 @@ on:
   pull_request:
   workflow_dispatch:
 
-env:
-  MAVEN_ARGS: "-B -nsu -Daether.connector.http.connectionMaxTtl=25"
-
 concurrency:
   # Only cancel jobs for PR updates
   group: js-ci-${{ github.ref }}

@@ -10,7 +10,6 @@ on:
   workflow_dispatch:
 
 env:
-  MAVEN_ARGS: "-B -nsu -Daether.connector.http.connectionMaxTtl=25"
   MINIKUBE_VERSION: v1.38.0
   KUBERNETES_VERSION: v1.35.0
   MINIKUBE_MEMORY: 4096 # Without explicitly setting memory, minikube uses ~25% of available memory which might be too little on smaller GitHub runners for running the tests

@@ -18,6 +18,8 @@ permissions:
   contents: read
 
 env:
+  # Keep in sync with the "Configure Maven for CI" step in .github/actions/java-setup, which this workflow cannot use.
+  MAVEN_ARGS: "-B -nsu -Daether.connector.http.connectionMaxTtl=25 -Daether.connector.http.retryHandler.count=5 -Daether.connector.http.retryHandler.serviceUnavailable=429,502,503,504"
   # Quarkus branch to build snapshots from. Update when quarkus-next should track a different release stream.
   QUARKUS_BRANCH: 3.39
 

@@ -7,6 +7,10 @@ on:
 permissions:
   contents: read
 
+env:
+  # Keep in sync with the "Configure Maven for CI" step in .github/actions/java-setup, which this workflow cannot use.
+  MAVEN_ARGS: "-B -nsu -Daether.connector.http.connectionMaxTtl=25 -Daether.connector.http.retryHandler.count=5 -Daether.connector.http.retryHandler.serviceUnavailable=429,502,503,504"
+
 jobs:
   define-refs:
     if: github.event_name != 'schedule' || github.repository == 'keycloak/keycloak'

@@ -12,9 +12,6 @@ on:
         description: Number of re-runs
         default: 50
 
-env:
-  MAVEN_ARGS: "-B -nsu -Daether.connector.http.connectionMaxTtl=25"
-
 defaults:
   run:
     shell: bash

@@ -3,9 +3,6 @@ name: Stability - Base
 on:
   workflow_dispatch:
 
-env:
-  MAVEN_ARGS: "-B -nsu -Daether.connector.http.connectionMaxTtl=25"
-
 defaults:
   run:
     shell: bash

@@ -3,9 +3,6 @@ name: Stability - Clustering
 on:
   workflow_dispatch:
 
-env:
-  MAVEN_ARGS: "-B -nsu -Daether.connector.http.connectionMaxTtl=25"
-
 defaults:
   run:
     shell: bash

@@ -3,9 +3,6 @@ name: Stability - Keycloak JavaScript CI
 on:
   workflow_dispatch:
 
-env:
-  MAVEN_ARGS: "-B -nsu -Daether.connector.http.connectionMaxTtl=25"
-
 defaults:
   run:
     shell: bash