Install Results CI Java toolchain on the M17 branch

.github/workflows/results-regression.yml

@@ -1,6 +1,13 @@
 name: Tekton Results regression
 
 on:
+  pull_request:
+    paths:
+      - ".github/workflows/results-regression.yml"
+      - "scripts/install-postgres-kind.sh"
+      - "scripts/install-tekton-results.sh"
+      - "scripts/run-regression-agent-full.sh"
+      - "scripts/run-lang-unit-tests.sh"
   workflow_dispatch:
   schedule:
     # Weekly strict Results/Postgres evidence on the default branch.
@@ -40,6 +47,30 @@ jobs:
           cache: npm
           cache-dependency-path: management-gui/frontend/package-lock.json
 
+      - name: Set up Java
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
+        with:
+          distribution: temurin
+          java-version: "21"
+          cache: maven
+          cache-dependency-path: |
+            libs/baggage-spring-boot-starter/pom.xml
+            libs/baggage-servlet-filter/pom.xml
+
+      - name: Set up PHP
+        uses: shivammathur/setup-php@bf6b4fbd49ca58e4608c9c89fba0b8d90bd2a39f # 2.35.5
+        with:
+          php-version: "8.3"
+          extensions: dom
+          tools: composer
+          coverage: none
+
+      - name: Set up Go
+        uses: actions/setup-go@b7ad1dad31e06c5925ef5d2fc7ad053ef454303e # v7
+        with:
+          go-version: "1.26.8"
+          cache-dependency-path: operator/go.sum
+
       - name: Install Kind and Newman
         run: |
           curl -fsSL -o /tmp/kind "https://kind.sigs.k8s.io/dl/${KIND_VERSION}/kind-linux-amd64"

libs/tekton-dag-common/tests/test_m17_results_automation.py

@@ -10,6 +10,8 @@ def test_results_workflow_is_scheduled_strict_and_retains_diagnostics():
 
     assert "workflow_dispatch:" in workflow
     assert "schedule:" in workflow
+    assert "pull_request:" in workflow
+    assert '".github/workflows/results-regression.yml"' in workflow
     assert "run-regression-agent-full.sh" in workflow
     assert "install-postgres-kind.sh --ephemeral" in workflow
     assert "install-tekton-results.sh" in workflow
@@ -19,6 +21,10 @@ def test_results_workflow_is_scheduled_strict_and_retains_diagnostics():
     assert "postgres.log" in workflow
     assert "if: always()" in workflow
     assert "actions/upload-artifact@" in workflow
+    assert 'java-version: "21"' in workflow
+    assert 'php-version: "8.3"' in workflow
+    assert "extensions: dom" in workflow
+    assert "cache-dependency-path: operator/go.sum" in workflow
 
 
 def test_results_installers_are_pinned_and_fail_closed():

milestones/milestone-17.md

@@ -32,12 +32,11 @@ Work is intentionally paused to preserve the remaining implementation budget.
   [PR #60](https://github.com/jmjava/tekton-dag/pull/60); its final revision
   passed all 17 reported checks, including Kind Phase 2, authoritative Newman,
   both intercept backends, static quality, regression, and supply-chain scans.
-- The first resume action is operational, not an implementation slice: make
-  `.github/workflows/results-regression.yml` available on the default branch
-  (GitHub cannot dispatch or schedule a workflow that exists only on the
-  aggregate feature branch), then manually dispatch it against the M17
-  revision. Mark M17.4 complete only if strict Results/Postgres verification
-  exits zero; otherwise fix that failure first.
+- The first resume action is still M17.4 live acceptance. Scheduled run
+  `35107095845` already executed on `main` and failed because the workflow
+  lacked JDK 21. Merge the Results toolchain fix to `main`, then confirm a
+  green scheduled or manually dispatched `results-regression` run before
+  marking M17.4 complete.
 - After M17.4, continue in numeric order from M17.11. Do not skip directly to
   maintainability work because M17.11–M17.14 establish the test evidence needed
   to refactor safely.
@@ -80,6 +79,10 @@ Work is intentionally paused to preserve the remaining implementation budget.
   - Install Results/Postgres and run the strict Results DB verification.
   - Acceptance: `run-regression-agent-full.sh` equivalent exits zero and uploads
     diagnostic artifacts on failure.
+  - Evidence: scheduled run `35107095845` on `main` failed compiling
+    `baggage-spring-boot-starter` (`invalid target release: 21`) because the
+    workflow did not install JDK 21. The workflow now provisions Java 21, PHP
+    DOM, and Go before the strict regression. Live green run still required.
 
 ## P1 — CI gates and operator assurance