Release 1.7.0: remove the speculative WebhookVerifier #19
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: CI | |
| on: | |
| workflow_dispatch: | |
| schedule: | |
| - cron: '17 9 * * 1' | |
| push: | |
| branches: [main] | |
| tags: ['v*'] | |
| pull_request: | |
| branches: [main] | |
| permissions: | |
| contents: read | |
| # Supersede only pull-request runs. Pushes, tags, and the scheduled sandbox run must finish: | |
| # the sandbox job writes real records and cleans up after itself. | |
| concurrency: | |
| group: ${{ github.workflow }}-${{ github.event_name }}-${{ github.ref }} | |
| cancel-in-progress: ${{ github.event_name == 'pull_request' }} | |
| env: | |
| MAVEN_ARGS: -B -ntp | |
| jobs: | |
| verify: | |
| name: Verify (JDK 25) | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up JDK 25 | |
| uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 | |
| with: | |
| distribution: temurin | |
| java-version: '25' | |
| check-latest: true | |
| cache: maven | |
| - name: Verify SDK | |
| run: ./mvnw verify | |
| - name: Upload Surefire reports | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: surefire-reports | |
| path: target/surefire-reports/ | |
| if-no-files-found: ignore | |
| - name: Upload artifacts | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: assinafy-sdk-jars | |
| path: target/*.jar | |
| if-no-files-found: error | |
| publish: | |
| name: Publish release artifact | |
| if: ${{ github.ref_type == 'tag' }} | |
| needs: verify | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 20 | |
| environment: release | |
| permissions: | |
| contents: write | |
| packages: write | |
| id-token: write | |
| attestations: write | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up JDK 25 | |
| uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 | |
| with: | |
| distribution: temurin | |
| java-version: '25' | |
| check-latest: true | |
| cache: maven | |
| server-id: github | |
| - name: Validate release tag | |
| run: | | |
| project_version="$(./mvnw -q -DforceStdout org.apache.maven.plugins:maven-help-plugin:3.5.2:evaluate -Dexpression=project.version)" | |
| expected_tag="v${project_version}" | |
| if [ "${GITHUB_REF_NAME}" != "${expected_tag}" ]; then | |
| echo "::error::Release tag must be ${expected_tag}." | |
| exit 1 | |
| fi | |
| - name: Publish to GitHub Packages | |
| env: | |
| GITHUB_TOKEN: ${{ github.token }} | |
| run: ./mvnw deploy | |
| - name: Attest build provenance | |
| uses: actions/attest-build-provenance@4d101475d8b20a2381f78447822ac1eab6504dd8 # v4.2.2 | |
| with: | |
| subject-path: target/*.jar | |
| - name: Create GitHub release | |
| env: | |
| GH_TOKEN: ${{ github.token }} | |
| run: | | |
| gh release create "${GITHUB_REF_NAME}" target/*.jar \ | |
| --repo "${GITHUB_REPOSITORY}" \ | |
| --title "${GITHUB_REF_NAME}" \ | |
| --notes "See CHANGELOG.md for the changes in ${GITHUB_REF_NAME}." | |
| - name: Upload release artifacts | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: assinafy-sdk-release-jars | |
| path: target/*.jar | |
| if-no-files-found: error | |
| sandbox: | |
| name: Sandbox API integration | |
| if: ${{ github.event_name == 'workflow_dispatch' || github.event_name == 'schedule' }} | |
| runs-on: ubuntu-latest | |
| timeout-minutes: 15 | |
| environment: sandbox | |
| concurrency: | |
| group: assinafy-sandbox-api | |
| cancel-in-progress: false | |
| queue: max | |
| steps: | |
| - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1 | |
| with: | |
| persist-credentials: false | |
| - name: Set up JDK 25 | |
| uses: actions/setup-java@dd06d9cba3e5552c54d9f8ea23572deb30010f7c # v6.0.0 | |
| with: | |
| distribution: temurin | |
| java-version: '25' | |
| check-latest: true | |
| cache: maven | |
| - name: Verify against sandbox | |
| env: | |
| ASSINAFY_API_KEY: ${{ secrets.ASSINAFY_API_KEY }} | |
| ASSINAFY_ACCOUNT_ID: ${{ secrets.ASSINAFY_ACCOUNT_ID }} | |
| ASSINAFY_TEST_EMAIL_PRIMARY: ${{ secrets.ASSINAFY_TEST_EMAIL_PRIMARY }} | |
| ASSINAFY_TEST_EMAIL_SECONDARY: ${{ secrets.ASSINAFY_TEST_EMAIL_SECONDARY }} | |
| ASSINAFY_BASE_URL: https://sandbox.assinafy.com.br/v1 | |
| run: | | |
| if [ -z "${ASSINAFY_API_KEY}" ] || [ -z "${ASSINAFY_ACCOUNT_ID}" ]; then | |
| echo "::error::Sandbox API secrets are not configured." | |
| exit 1 | |
| fi | |
| ./mvnw -Plive-api verify | |
| - name: Upload integration reports | |
| if: always() | |
| uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1 | |
| with: | |
| name: failsafe-reports | |
| path: target/failsafe-reports/ | |
| if-no-files-found: error |