Harden CI: Artifactory OIDC, fork-aware workflows, tightened permissions

.github/workflows/ci.yml

@@ -0,0 +1,105 @@
+name: CI
+
+on:
+  push:
+    branches: [master]
+  pull_request:
+    branches: [master]
+
+permissions:
+  id-token: write
+  contents: read
+
+env:
+  ARTIFACTORY_URL: ${{ vars.ARTIFACTORY_URL }}
+
+jobs:
+  lint:
+    name: Lint (spotless + animal-sniffer)
+    runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-latest' || 'ubuntu-x64' }}
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+      - name: Set up JDK 11
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+          cache: maven
+
+      - name: Artifactory OIDC
+        if: ${{ !github.event.pull_request.head.repo.fork }}
+        uses: twilio/sdk-actions/artifactory-oidc@c94e420aa64ea686ff25bb03d4c66cdaf8e523e4 # main
+        with:
+          ecosystem: maven
+          provider-name: github-actions-segmentio
+
+      - name: Spotless check
+        run: mvn -B spotless:check
+
+      - name: Animal Sniffer check
+        # Needs the reactor compiled first: `analytics` builds against the
+        # analytics-core SNAPSHOT, which exists nowhere until this run makes it.
+        # `compile` rather than `package` — linting has no use for the javadoc,
+        # source and signing plugins that packaging would drag in.
+        run: mvn -B -DskipTests compile animal-sniffer:check
+
+  test:
+    name: Test (Java ${{ matrix.java-version }})
+    runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-latest' || 'ubuntu-x64' }}
+    strategy:
+      fail-fast: false
+      matrix:
+        java-version: ['11', '17', '21']
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+      - name: Set up JDK ${{ matrix.java-version }}
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4
+        with:
+          distribution: 'temurin'
+          java-version: ${{ matrix.java-version }}
+          cache: maven
+
+      - name: Artifactory OIDC
+        if: ${{ !github.event.pull_request.head.repo.fork }}
+        uses: twilio/sdk-actions/artifactory-oidc@c94e420aa64ea686ff25bb03d4c66cdaf8e523e4 # main
+        with:
+          ecosystem: maven
+          provider-name: github-actions-segmentio
+
+      - name: Run tests
+        run: mvn -B test
+
+  build:
+    name: Build verification
+    runs-on: ${{ github.event.pull_request.head.repo.fork && 'ubuntu-latest' || 'ubuntu-x64' }}
+    needs: [lint, test]
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+      - name: Set up JDK 11
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+          cache: maven
+
+      - name: Artifactory OIDC
+        if: ${{ !github.event.pull_request.head.repo.fork }}
+        uses: twilio/sdk-actions/artifactory-oidc@c94e420aa64ea686ff25bb03d4c66cdaf8e523e4 # main
+        with:
+          ecosystem: maven
+          provider-name: github-actions-segmentio
+
+      - name: Build
+        run: mvn -B package -DskipTests
+
+      - name: Verify
+        run: mvn -B verify -DskipTests

.github/workflows/deploy.yml

@@ -0,0 +1,76 @@
+name: Deploy to Maven Central
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  id-token: write
+  contents: read
+
+env:
+  ARTIFACTORY_URL: ${{ vars.ARTIFACTORY_URL }}
+
+jobs:
+  test:
+    name: Pre-deploy tests
+    runs-on: ubuntu-x64
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+      - name: Set up JDK 11
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+          cache: maven
+
+      - name: Artifactory OIDC
+        uses: twilio/sdk-actions/artifactory-oidc@c94e420aa64ea686ff25bb03d4c66cdaf8e523e4 # main
+        with:
+          ecosystem: maven
+          provider-name: github-actions-segmentio
+
+      - name: Run tests
+        run: mvn -B test
+
+  deploy:
+    name: Deploy to Maven Central
+    runs-on: ubuntu-x64
+    needs: [test]
+    environment: maven-central
+
+    steps:
+      - name: Checkout
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
+
+      - name: Set up JDK 11
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4
+        with:
+          distribution: 'temurin'
+          java-version: '11'
+          cache: maven
+          server-id: central
+          server-username: CI_DEPLOY_USERNAME
+          server-password: CI_DEPLOY_PASSWORD
+          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
+          gpg-passphrase: GPG_PASSPHRASE
+
+      - name: Artifactory OIDC
+        uses: twilio/sdk-actions/artifactory-oidc@c94e420aa64ea686ff25bb03d4c66cdaf8e523e4 # main
+        with:
+          ecosystem: maven
+          provider-name: github-actions-segmentio
+
+      - name: Deploy to Maven Central
+        env:
+          CI_DEPLOY_USERNAME: ${{ secrets.CI_DEPLOY_USERNAME }}
+          CI_DEPLOY_PASSWORD: ${{ secrets.CI_DEPLOY_PASSWORD }}
+          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+        run: |
+          mvn -B deploy \
+            -DskipTests \
+            -Dgpg.passphrase="$GPG_PASSPHRASE" \
+            -P release

.github/workflows/e2e-tests.yml

@@ -1,66 +1,73 @@
-# E2E Tests for analytics-java
-# Copy this file to: analytics-java/.github/workflows/e2e-tests.yml
-#
-# This workflow:
-# 1. Checks out the SDK and sdk-e2e-tests repos
-# 2. Builds the SDK and e2e-cli
-# 3. Runs the e2e test suite
-
 name: E2E Tests
 
 on:
   push:
-    branches: [main, master]
+    branches: [master]
   pull_request:
-    branches: [main, master]
+    branches: [master]
+  schedule:
+    - cron: '0 6 * * 1-5'
   workflow_dispatch:
     inputs:
       e2e_tests_ref:
         description: 'Branch or ref of sdk-e2e-tests to use'
         required: false
         default: 'main'
 
+permissions:
+  id-token: write
+  contents: read
+
+env:
+  ARTIFACTORY_URL: ${{ vars.ARTIFACTORY_URL }}
+
 jobs:
   e2e-tests:
-    # Skip on fork PRs where repo secrets aren't available
-    if: ${{ github.event_name != 'pull_request' || github.event.pull_request.head.repo.full_name == github.repository }}
-    runs-on: ubuntu-latest
+    name: E2E Test Suite
+    if: ${{ github.event_name != 'pull_request' || !github.event.pull_request.head.repo.fork }}
+    runs-on: ubuntu-x64
 
     steps:
       - name: Checkout SDK
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           path: sdk
 
       - name: Checkout sdk-e2e-tests
-        uses: actions/checkout@v4
+        uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4
         with:
           repository: segmentio/sdk-e2e-tests
           ref: ${{ inputs.e2e_tests_ref || 'main' }}
-          token: ${{ secrets.E2E_TESTS_TOKEN }}
           path: sdk-e2e-tests
 
-      - name: Setup Java
-        uses: actions/setup-java@v4
+      - name: Set up JDK 11
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4
         with:
           distribution: 'temurin'
           java-version: '11'
+          cache: maven
+
+      - name: Artifactory OIDC
+        uses: twilio/sdk-actions/artifactory-oidc@c94e420aa64ea686ff25bb03d4c66cdaf8e523e4 # main
+        with:
+          ecosystem: maven
+          provider-name: github-actions-segmentio
 
       - name: Setup Node.js
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@39370e3970a6d050c480ffad4ff0ed4d3fdee5af # v4
         with:
           node-version: '20'
 
       - name: Build Java SDK and e2e-cli
         working-directory: sdk
-        run: mvn package -pl e2e-cli -am -DskipTests
+        run: mvn -B package -pl e2e-cli -am -DskipTests
 
       - name: Find e2e-cli jar
         id: find-jar
         working-directory: sdk
         run: |
           JAR_PATH=$(find e2e-cli/target -name "e2e-cli-*-jar-with-dependencies.jar" | head -1)
-          echo "jar_path=$JAR_PATH" >> $GITHUB_OUTPUT
+          echo "jar_path=$JAR_PATH" >> "$GITHUB_OUTPUT"
 
       - name: Run E2E tests
         working-directory: sdk-e2e-tests
@@ -71,7 +78,7 @@ jobs:
 
       - name: Upload test results
         if: always()
-        uses: actions/upload-artifact@v4
+        uses: actions/upload-artifact@ea165f8d65b6e75b540449e92b4886f43607fa02 # v4
         with:
           name: e2e-test-results
           path: sdk-e2e-tests/test-results/

analytics-cli/src/main/kotlin/cli/JavadocStub.java

@@ -1,8 +1,6 @@
 package cli;
 
-/**
- * Placeholder class to generate a Javadoc JAR for the CLI artifact.
- */
+/** Placeholder class to generate a Javadoc JAR for the CLI artifact. */
 public final class JavadocStub {
   private JavadocStub() {}
 }

analytics-core/pom.xml

@@ -51,12 +51,6 @@
       <artifactId>gson</artifactId>
       <version>${gson.version}</version>
     </dependency>
-    <dependency>
-      <groupId>com.google.code.findbugs</groupId>
-      <artifactId>findbugs</artifactId>
-      <version>${findbugs.version}</version>
-      <scope>provided</scope>
-    </dependency>
     <dependency>
       <groupId>com.google.auto.value</groupId>
       <artifactId>auto-value</artifactId>

analytics/pom.xml

@@ -66,12 +66,6 @@
       <artifactId>retrofit-mock</artifactId>
       <version>${retrofit.version}</version>
     </dependency>
-    <dependency>
-      <groupId>com.google.code.findbugs</groupId>
-      <artifactId>findbugs</artifactId>
-      <version>${findbugs.version}</version>
-      <scope>provided</scope>
-    </dependency>
     <dependency>
       <groupId>com.segment.backo</groupId>
       <artifactId>backo</artifactId>
@@ -119,7 +113,8 @@
       <plugin>
         <groupId>org.codehaus.mojo</groupId>
         <artifactId>templating-maven-plugin</artifactId>
-        <version>1.0.0</version>
+        <!-- 1.0.0 resolves maven-core 2.2.1, which curation refuses. -->
+        <version>3.1.1</version>
         <executions>
           <execution>
             <goals>