Complete API conformance and production hardening #11
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| workflow_dispatch: | |
| push: | |
| branches: [main] | |
| tags: ['v*'] | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| jobs: | |
| verify: | |
| name: Verify (JDK 25) | |
| if: ${{ github.ref_type != 'tag' }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up JDK 25 | |
| uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 | |
| with: | |
| distribution: temurin | |
| java-version: '25' | |
| check-latest: true | |
| cache: maven | |
| - name: Verify SDK | |
| run: mvn -B -ntp verify | |
| - name: Upload Surefire reports | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: surefire-reports | |
| path: target/surefire-reports/ | |
| if-no-files-found: ignore | |
| - name: Upload artifacts | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: assinafy-sdk-jars | |
| path: target/*.jar | |
| if-no-files-found: error | |
| publish: | |
| name: Publish release artifact | |
| if: ${{ github.ref_type == 'tag' }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| environment: release | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up JDK 25 | |
| uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 | |
| with: | |
| distribution: temurin | |
| java-version: '25' | |
| check-latest: true | |
| cache: maven | |
| - name: Validate release tag | |
| run: | | |
| project_version="$(mvn -q -DforceStdout help:evaluate -Dexpression=project.version)" | |
| expected_tag="v${project_version}" | |
| if [ "${GITHUB_REF_NAME}" != "${expected_tag}" ]; then | |
| echo "::error::Release tag must be ${expected_tag}." | |
| exit 1 | |
| fi | |
| - name: Validate deployment configuration | |
| env: | |
| MAVEN_DEPLOY_URL: ${{ secrets.MAVEN_DEPLOY_URL }} | |
| DEPLOY_TOKEN: ${{ secrets.MAVEN_DEPLOY_TOKEN }} | |
| run: | | |
| if [ -z "${MAVEN_DEPLOY_URL}" ] || [ -z "${DEPLOY_TOKEN}" ]; then | |
| echo "::error::Maven deployment secrets are not configured." | |
| exit 1 | |
| fi | |
| - name: Configure Maven settings | |
| env: | |
| DEPLOY_TOKEN: ${{ secrets.MAVEN_DEPLOY_TOKEN }} | |
| run: | | |
| mkdir -p ~/.m2 | |
| cat > ~/.m2/settings.xml <<'EOF' | |
| <settings> | |
| <servers> | |
| <server> | |
| <id>release-registry</id> | |
| <configuration> | |
| <httpHeaders> | |
| <property> | |
| <name>Deploy-Token</name> | |
| <value>${env.DEPLOY_TOKEN}</value> | |
| </property> | |
| </httpHeaders> | |
| </configuration> | |
| </server> | |
| </servers> | |
| </settings> | |
| EOF | |
| - name: Deploy artifact | |
| env: | |
| MAVEN_DEPLOY_URL: ${{ secrets.MAVEN_DEPLOY_URL }} | |
| DEPLOY_TOKEN: ${{ secrets.MAVEN_DEPLOY_TOKEN }} | |
| run: | | |
| mvn -B -ntp deploy \ | |
| "-DaltDeploymentRepository=release-registry::${MAVEN_DEPLOY_URL}" | |
| - name: Upload release artifacts | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: assinafy-sdk-release-jars | |
| path: target/*.jar | |
| if-no-files-found: error | |
| sandbox: | |
| name: Sandbox API integration | |
| if: ${{ github.event_name == 'workflow_dispatch' }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| environment: sandbox | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up JDK 25 | |
| uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5.7.0 | |
| with: | |
| distribution: temurin | |
| java-version: '25' | |
| check-latest: true | |
| cache: maven | |
| - name: Verify against sandbox | |
| env: | |
| ASSINAFY_API_KEY: ${{ secrets.ASSINAFY_API_KEY }} | |
| ASSINAFY_ACCOUNT_ID: ${{ secrets.ASSINAFY_ACCOUNT_ID }} | |
| ASSINAFY_TEST_EMAIL_PRIMARY: ${{ secrets.ASSINAFY_TEST_EMAIL_PRIMARY }} | |
| ASSINAFY_TEST_EMAIL_SECONDARY: ${{ secrets.ASSINAFY_TEST_EMAIL_SECONDARY }} | |
| ASSINAFY_BASE_URL: https://sandbox.assinafy.com.br/v1 | |
| run: | | |
| if [ -z "${ASSINAFY_API_KEY}" ] || [ -z "${ASSINAFY_ACCOUNT_ID}" ] \ | |
| || [ -z "${ASSINAFY_TEST_EMAIL_PRIMARY}" ] || [ -z "${ASSINAFY_TEST_EMAIL_SECONDARY}" ]; then | |
| echo "::error::Sandbox API secrets are not configured." | |
| exit 1 | |
| fi | |
| mvn -B -ntp -Plive-api verify | |
| - name: Upload integration reports | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: failsafe-reports | |
| path: target/failsafe-reports/ | |
| if-no-files-found: error |