Harden CI: Artifactory OIDC, fork-aware workflows, tightened permissions - #538
Open
MichaelGHSeg wants to merge 16 commits into
Open
MichaelGHSeg wants to merge 16 commits into
MichaelGHSeg wants to merge 16 commits into
Conversation
- Add Artifactory OIDC composite action (writes ~/.m2/settings.xml mirroring virtual-maven-thirdparty) - Add ci.yml: fork-aware, Java 11/17/21 matrix, spotless/animal-sniffer, SHA-pinned actions - Add deploy.yml: tag-triggered, environment: maven-central gate, GPG signing - Update e2e-tests.yml: remove E2E_TESTS_TOKEN, fork-aware
didiergarcia
previously approved these changes
Jul 10, 2026
Rewrite composite action to use single-script pattern matching
analytics-python: audience=${ARTIFACTORY_URL}, provider_name=
github-actions-segmentio, and add JWT claim logging for debugging.
The plugin is a build extension resolved on every mvn invocation, causing CI test jobs to fail when Artifactory doesn't have the Sonatype Central plugin. Gate it behind -P release so it only loads during actual deploys.
Switch default repo to virtual-maven-twilio (includes remote-maven-maven-central-cache, which virtual-maven-thirdparty doesn't). Add pluginRepositories in settings.xml so Maven resolves build plugins (spotless, central-publishing, etc.) through Artifactory rather than falling back to Maven Central directly. Also broaden mirrorOf from 'central' to '*' to catch all repos.
…uires twilio org token)
JFrog binds the access token to the subject identity it resolved and returns that identity in the exchange response. settings.xml hardcoded '_' instead, so the exchange succeeded and every subsequent artifact fetch got 401 — which read as an Artifactory permissions problem rather than a client-side auth bug. twilio/sdk-actions/artifactory-oidc reads .username for exactly this reason, and analytics-kotlin resolves through the same virtual-maven-thirdparty on the same host, so the repository itself is readable.
com.google.code.findbugs:findbugs was declared provided in both modules but nothing references it — no imports, no @SuppressFBWarnings, no findbugs plugin. The annotations actually in use come from jakarta.annotation-api. Its only effect was dragging in dom4j 1.6.1, which Artifactory curation refuses (403) and which blocked dependency resolution outright. assertj-core 3.24.2 is likewise curation-blocked; 3.27.7 is the current 3.x. google-java-format stays as low as Spotless permits on JVM 11 to keep the formatting delta from 1.5 as small as possible.
…format stub templating-maven-plugin 1.0.0 pulls maven-core 2.2.1 (2009) and maven-shared-utils 0.6, both refused by curation. google-java-format 1.8 collapses a short Javadoc onto one line where 1.5 kept it expanded; JavadocStub.java was the only file affected.
Output of mvn spotless:apply. Indentation and line wrapping only; no semantic change (git diff -w shows re-wrapping alone).
The pre-hardening workflow ran spotless, animal-sniffer, test and verify in one Maven invocation, so inter-module SNAPSHOTs resolved from the reactor. Split into its own call, animal-sniffer could not resolve analytics-core.
javadoc-plugin 3.6.3 resolves maven-core 3.1.1 (2013), which curation refuses. The build-verification job packages, so this blocks it regardless of lint. The lint job only needs compiled classes for animal-sniffer, so compile rather than package keeps javadoc, source and gpg out of it entirely.
Replaces the repo-local copy with the shared first-party action, pinned. It covers maven natively and is the same action analytics-kotlin adopted, so fixes land once instead of per SDK — including the username handling this repo had to discover on its own.
This branch has not been deployed
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
2 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Notes
Test plan