From 9198a4b57bc6e33e56dc4f18089be0a952a4f6ef Mon Sep 17 00:00:00 2001 From: Thomas Nymand Date: Thu, 18 Jun 2026 14:25:15 +0200 Subject: [PATCH] REF-5: Create GitHub based pipeline and fix the build toolchain Add a GitHub Actions workflow (Temurin 11 + Maven cache) running mvn clean install on push and PRs to master. Make the build reproducible on JDK 11 (required by the hsqldb 2.7.1 test dependency) while keeping the published artifact Java 8 compatible: - maven-compiler-plugin 3.3 -> 3.8.1, source/target 1.8 -> release 8 - demo: pin oiosaml3.java to ${project.version} instead of a stale version - ignore HSQLDB mem.* scratch files left by DatabaseSessionHandlerTest Restore certificate revocation tests: the previous test PKI was taken down, so replace REVOKED_CERTIFICATE with a new revoked cert from the live cti-gov.dk PKI and re-enable CRLCheckerTest. Co-Authored-By: Claude Opus 4.8 (1M context) --- .github/workflows/build.yml | 29 ++++++++++++++++ .gitignore | 10 ++++++ demo/pom.xml | 2 +- oiosaml/pom.xml | 8 +++-- .../gov/oio/saml/service/CRLCheckerTest.java | 12 +++---- .../dk/gov/oio/saml/util/TestConstants.java | 34 +------------------ pom.xml | 8 +++-- 7 files changed, 55 insertions(+), 48 deletions(-) create mode 100644 .github/workflows/build.yml diff --git a/.github/workflows/build.yml b/.github/workflows/build.yml new file mode 100644 index 0000000..a9ee71b --- /dev/null +++ b/.github/workflows/build.yml @@ -0,0 +1,29 @@ +name: Build + +on: + push: + branches: + - master + - 'feature/**' + - 'hotfix/**' + pull_request: + branches: + - master + +jobs: + build: + runs-on: ubuntu-latest + + steps: + - name: Check out repository + uses: actions/checkout@v4 + + - name: Set up JDK 11 (Temurin) + uses: actions/setup-java@v4 + with: + distribution: temurin + java-version: '11' + cache: maven + + - name: Build and test + run: mvn -B clean install diff --git a/.gitignore b/.gitignore index 4640ee0..14dd99d 100644 --- a/.gitignore +++ b/.gitignore @@ -8,3 +8,13 @@ velocity.log .DS_Store .run/ velocity.log.* + +# HSQLDB scratch files generated by DatabaseSessionHandlerTest +mem.lobs +mem.log +mem.properties +mem.script + +# Local-only working notes (not for the shared repo) +CLAUDE.md +TODO.md diff --git a/demo/pom.xml b/demo/pom.xml index 292c8cf..6b591d4 100644 --- a/demo/pom.xml +++ b/demo/pom.xml @@ -53,7 +53,7 @@ dk.digst oiosaml3.java - 3.2.2-SNAPSHOT + ${project.version} diff --git a/oiosaml/pom.xml b/oiosaml/pom.xml index 94a5bd5..9f58a0c 100644 --- a/oiosaml/pom.xml +++ b/oiosaml/pom.xml @@ -69,10 +69,12 @@ org.apache.maven.plugins maven-compiler-plugin - 3.3 + 3.8.1 - 1.8 - 1.8 + + 8 diff --git a/oiosaml/src/test/java/dk/gov/oio/saml/service/CRLCheckerTest.java b/oiosaml/src/test/java/dk/gov/oio/saml/service/CRLCheckerTest.java index 3bdf065..d3ca909 100644 --- a/oiosaml/src/test/java/dk/gov/oio/saml/service/CRLCheckerTest.java +++ b/oiosaml/src/test/java/dk/gov/oio/saml/service/CRLCheckerTest.java @@ -18,8 +18,7 @@ public class CRLCheckerTest extends BaseServiceTest { @DisplayName("Test revocation check on valid certificate using OCSP") - @Test - public void testOcspCheckOnValidCertificate() throws Exception { + @Test public void testOcspCheckOnValidCertificate() throws Exception { OIOSAML3Service.getConfig().setCRLCheckEnabled(false); OIOSAML3Service.getConfig().setOcspCheckEnabled(true); @@ -36,8 +35,7 @@ public void testOcspCheckOnValidCertificate() throws Exception { } @DisplayName("Test revocation check on valid certificate using CRL") - @Test - public void testCrlCheckOnValidCertificate() throws Exception { + @Test public void testCrlCheckOnValidCertificate() throws Exception { OIOSAML3Service.getConfig().setCRLCheckEnabled(true); OIOSAML3Service.getConfig().setOcspCheckEnabled(false); @@ -54,8 +52,7 @@ public void testCrlCheckOnValidCertificate() throws Exception { } @DisplayName("Test revocation check on revoked certificate using OCSP") - @Test - public void testOcspCheckOnRevokedCertificate() throws Exception { + @Test public void testOcspCheckOnRevokedCertificate() throws Exception { OIOSAML3Service.getConfig().setCRLCheckEnabled(false); OIOSAML3Service.getConfig().setOcspCheckEnabled(true); @@ -73,8 +70,7 @@ public void testOcspCheckOnRevokedCertificate() throws Exception { } @DisplayName("Test revocation check on revoked certificate using CRL") - @Test - public void testCrlCheckOnRevokedCertificate() throws Exception { + @Test public void testCrlCheckOnRevokedCertificate() throws Exception { OIOSAML3Service.getConfig().setCRLCheckEnabled(true); OIOSAML3Service.getConfig().setOcspCheckEnabled(false); diff --git a/oiosaml/src/test/java/dk/gov/oio/saml/util/TestConstants.java b/oiosaml/src/test/java/dk/gov/oio/saml/util/TestConstants.java index 1f4e751..87c2226 100644 --- a/oiosaml/src/test/java/dk/gov/oio/saml/util/TestConstants.java +++ b/oiosaml/src/test/java/dk/gov/oio/saml/util/TestConstants.java @@ -150,37 +150,5 @@ public class TestConstants { public static final String VALID_CERTIFICATE = "MIIGkzCCBMegAwIBAgIUdxCsIBOOtB5tqNtriG1TMHD9dqYwQQYJKoZIhvcNAQEKMDSgDzANBglghkgBZQMEAgEFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgEFAKIDAgEgMGsxLTArBgNVBAMMJERlbiBEYW5za2UgU3RhdCBPQ0VTIHVkc3RlZGVuZGUtQ0EgMTETMBEGA1UECwwKVGVzdCAtIGN0aTEYMBYGA1UECgwPRGVuIERhbnNrZSBTdGF0MQswCQYDVQQGEwJESzAeFw0yMzA4MTgxMDI2NThaFw0yNjA4MTcxMDI2NTdaMIGpMSUwIwYDVQQDDBxqYXZhLnJlZmVyZW5jZWltcGxlbWVudGVyaW5nMTcwNQYDVQQFEy5VSTpESy1POkc6MmRjZjc5MTktYjI4Mi00NGQxLWI5ODAtM2I3MzcwMGE3ZGQ0MSEwHwYDVQQKDBhEaWdpdGFsaXNlcmluZ3NzdHlyZWxzZW4xFzAVBgNVBGEMDk5UUkRLLTM0MDUxMTc4MQswCQYDVQQGEwJESzCCAaIwDQYJKoZIhvcNAQEBBQADggGPADCCAYoCggGBAKNAf9uAhuz3bEjPPFrBa39HCF6S64pSzGRr5yYm3lCBElYJvHzDr9lMKgbv8rKglIVgjWh+PzUjiwIlGjrqAbYa2Hg08Vw2H60GQSFP8rGsshgR+E5Ca2nb9kUcQXAQJl9ScG9squCPRNkdp8vSblRwv/3N0ksjxdZk1wdZ86bOqTsFEjpzhFdBXXSMl4tbhE7WOruKc0QqjUkzXJyp4qwyB2XA75+jsvtRHN/luOzCkUxLhEkFrbg+B6IWqjUuO132xC8d5+T8Y39K6rs4BYOIgQRJOg0OlA5844CC/WBLtAYgMiu1ucZ4mbVWOmm2F86WVRBdmwlN0CFORXihHiYNZfHpA0rPOSncDDMrrGZ7vuvvXxMfIiHlAniSw4eHaEqtaXqwDyNZbfcXgYkszQd7ZV7YMfAjkDo82Qn+Qz+Oc9qq0Syhd9pdUJ/Q26CjFDiaNSg+hDUUJTxowQAktX3AuwBcDeuMoc2yOGmg2xOf/3bIwJSNm8/b+y0wKfY2FwIDAQABo4IBhjCCAYIwDAYDVR0TAQH/BAIwADAfBgNVHSMEGDAWgBR/KJ/ZcZlC4nXn1zV2Lk0IJW12XjB7BggrBgEFBQcBAQRvMG0wQwYIKwYBBQUHMAKGN2h0dHA6Ly9jYTEuY3RpLWdvdi5kay9vY2VzL2lzc3VpbmcvMS9jYWNlcnQvaXNzdWluZy5jZXIwJgYIKwYBBQUHMAGGGmh0dHA6Ly9jYTEuY3RpLWdvdi5kay9vY3NwMCEGA1UdIAQaMBgwCAYGBACPegEBMAwGCiqBUIEpAQEBAwcwOwYIKwYBBQUHAQMELzAtMCsGCCsGAQUFBwsCMB8GBwQAi+xJAQIwFIYSaHR0cHM6Ly91aWQuZ292LmRrMEUGA1UdHwQ+MDwwOqA4oDaGNGh0dHA6Ly9jYTEuY3RpLWdvdi5kay9vY2VzL2lzc3VpbmcvMS9jcmwvaXNzdWluZy5jcmwwHQYDVR0OBBYEFNKFKxc70Coluez0ieqiVuK+a01oMA4GA1UdDwEB/wQEAwIFoDBBBgkqhkiG9w0BAQowNKAPMA0GCWCGSAFlAwQCAQUAoRwwGgYJKoZIhvcNAQEIMA0GCWCGSAFlAwQCAQUAogMCASADggGBAIkUbY8meqO9xQQ2gyMS4rfmqW3bV52YGs07DqG0zuVew7W7RMAJWqDLUj5ltMWK7wULcCBS1tjtxOrvMBCoAE42oQfF/EzLRYKr7VgsMyOgUiTk2t6LvyF5A1OGHOUP3lxQKX3viDURXUeoI4QZ3mxbHUg4sQXdXg2hOEhQOarOhWLdV3MzUkA9ZkwjmycXkbLBVdTbr/fODUU0jeDDlaixKXsGI66qg8Ou86nDkyW7wCxQ9QVwJ5YGogy9ZSc6sLt8XSv3+wFlXD/81EzWfqe5BdWX8cukLtSzdzg3SzJifB4IJ6GIQ58+NVLPEMezwZCLODzVkvdJfyWRxJrDijSVCza515qNW52yfYPYkTb+vdvKcFmwO1gCeK0vT21udVkp1grhNzwb8Cj/tq3OZ+IamZXkjL1go9GzSQQ31IbXHEI/oaPLEeX6j9E8X69wVtSti8SWPw0WgoeOglJM5A6fmlJIGhCBPk2klhH3IIU3+tjuz7iyFHZg7gbPhNHdow=="; - public static final String REVOKED_CERTIFICATE = "MIIGKDCCBRCgAwIBAgIEW607HjANBgkqhkiG9w0BAQsFADBIMQswCQYDVQQGEwJE" + - "SzESMBAGA1UECgwJVFJVU1QyNDA4MSUwIwYDVQQDDBxUUlVTVDI0MDggU3lzdGVt" + - "dGVzdCBYWElJIENBMB4XDTE5MTIxNjE0MzQxN1oXDTIyMTIxNjE0MzM0N1owgZIx" + - "CzAJBgNVBAYTAkRLMScwJQYDVQQKDB5ORVRTIERBTklEIEEvUyAvLyBDVlI6MzA4" + - "MDg0NjAxWjAgBgNVBAUTGUNWUjozMDgwODQ2MC1GSUQ6NDUzMjc0NzMwNgYDVQQD" + - "DC9UVSBHRU5FUkVMIEZPQ0VTIHNww6ZycmV0IChmdW5rdGlvbnNjZXJ0aWZpa2F0" + - "KTCCASIwDQYJKoZIhvcNAQEBBQADggEPADCCAQoCggEBAJqKd1cVjcteIQ0jfcn2" + - "lmjZS3lNzqYAjCKs7MhPAB4P8FSpxzn4hW6azYK0Vsy8NGBTijuQYHI2zSCgpIBO" + - "C7DnuF1+JdpoqzPdSt967/3efmQe60JXKeyHViMJqCgB+vBmbvhAVl9v2qDWhj5H" + - "m2CSC7SvLCffuFITinO2ZTgTNjvEYqqRm6k/G8E7F4rpuRB25DdCkt8NlOUoT7aN" + - "+0lH/2UH9vyDaGCXreesLyAEbBOW+w5NxZFS88bvFGlIqg5CujInwbUjATRl2Wm8" + - "FnZ9WkbJ7VdceXHcNkz/QiLIYHZt0aGEz6cXvBc8zSSmV4D1shHLz376Uhm01873" + - "1X0CAwEAAaOCAs0wggLJMA4GA1UdDwEB/wQEAwIDuDCBlwYIKwYBBQUHAQEEgYow" + - "gYcwPAYIKwYBBQUHMAGGMGh0dHA6Ly9vY3NwLnN5c3RlbXRlc3QyMi50cnVzdDI0" + - "MDguY29tL3Jlc3BvbmRlcjBHBggrBgEFBQcwAoY7aHR0cDovL2YuYWlhLnN5c3Rl" + - "bXRlc3QyMi50cnVzdDI0MDguY29tL3N5c3RlbXRlc3QyMi1jYS5jZXIwggEgBgNV" + - "HSAEggEXMIIBEzCCAQ8GDSsGAQQBgfRRAgQGBAMwgf0wLwYIKwYBBQUHAgEWI2h0" + - "dHA6Ly93d3cudHJ1c3QyNDA4LmNvbS9yZXBvc2l0b3J5MIHJBggrBgEFBQcCAjCB" + - "vDAMFgVEYW5JRDADAgEBGoGrRGFuSUQgdGVzdCBjZXJ0aWZpa2F0ZXIgZnJhIGRl" + - "bm5lIENBIHVkc3RlZGVzIHVuZGVyIE9JRCAxLjMuNi4xLjQuMS4zMTMxMy4yLjQu" + - "Ni40LjMuIERhbklEIHRlc3QgY2VydGlmaWNhdGVzIGZyb20gdGhpcyBDQSBhcmUg" + - "aXNzdWVkIHVuZGVyIE9JRCAxLjMuNi4xLjQuMS4zMTMxMy4yLjQuNi40LjMuMIGt" + - "BgNVHR8EgaUwgaIwPaA7oDmGN2h0dHA6Ly9jcmwuc3lzdGVtdGVzdDIyLnRydXN0" + - "MjQwOC5jb20vc3lzdGVtdGVzdDIyMS5jcmwwYaBfoF2kWzBZMQswCQYDVQQGEwJE" + - "SzESMBAGA1UECgwJVFJVU1QyNDA4MSUwIwYDVQQDDBxUUlVTVDI0MDggU3lzdGVt" + - "dGVzdCBYWElJIENBMQ8wDQYDVQQDDAZDUkwyMTQwHwYDVR0jBBgwFoAUq6gBRBmw" + - "s0OZ2vp8zNIAGAPnPL8wHQYDVR0OBBYEFJddclhedsyHjXSrF7JG81IPRuz9MAkG" + - "A1UdEwQCMAAwDQYJKoZIhvcNAQELBQADggEBAJSf6/PJ4fGW4LYtgA/758n51KN0" + - "ccY+80Qk0Fc01/chDHSXCbyVkQm7/02dggnV/VWrnKy1IY5dSu5rJ45Aijg4zADZ" + - "/1eeeaSRvRiYz2+jIIPuGkMbHUdDJM6RuCertu/Pq2IQFIB0t/4EahVxTJcWmWY0" + - "j3TQWARCJfoE2baAD/xKasUNAItq9w8T6AhxFb1g2A4fUVhdKDIqA+SLNzc0VO9V" + - "xhvTIY8nNgEWuW8XKeUXPk/z4WNojNlO2NiHBJzyhEvptvIUvgshbLYD4vJZwry3" + - "9dk+tZf4c/vNlk57P2hcK4sPtqrxlKxrvZFeOA0Jn9PVbn0KWw/lOxx3w24="; + public static final String REVOKED_CERTIFICATE = "MIIGizCCBL+gAwIBAgIUNtX5gOHMima7NNCirR0xYtZD5dQwQQYJKoZIhvcNAQEKMDSgDzANBglghkgBZQMEAgEFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgEFAKIDAgEgMGsxLTArBgNVBAMMJERlbiBEYW5za2UgU3RhdCBPQ0VTIHVkc3RlZGVuZGUtQ0EgMTETMBEGA1UECwwKVGVzdCAtIGN0aTEYMBYGA1UECgwPRGVuIERhbnNrZSBTdGF0MQswCQYDVQQGEwJESzAeFw0yMzA3MDQwODQyMjZaFw0yNjA3MDMwODQyMjVaMIGDMRAwDgYDVQQDDAdSZXZva2VkMTcwNQYDVQQFEy5VSTpESy1POkc6Mjc1ODFhMzktYjYxNC00YzYxLWJlY2UtOWIyYjA5Zjg1NzJhMRAwDgYDVQQKDAdpZDIgQS9TMRcwFQYDVQRhDA5OVFJESy00NDE2MDMxNTELMAkGA1UEBhMCREswggGiMA0GCSqGSIb3DQEBAQUAA4IBjwAwggGKAoIBgQDGFxjnzy3gKPLBt2Lj4ALK2uHAMFB8CZc4DaJDdn6YWNOdL4bvi2Ip0Nf87A9IZT3KzLsyju5pqQOaJ1MlwTB11Hlwne4DHUOo8EZhMAS2/oWtTf+scmbDXR0Edv05ecteReabO7tRyQcbxacirX20rT8jTVLtvWfzCHobvbCK9wWTXiaYYZXZykrHbCrRikuHz7DtyefznKRC36wC3sBzptA4ncdDnhiwOoDizZ46toMYahDLj2P1VDIh+2XyWKPV5rxTlZkY3b+H235tdRtjkX+kTfUDFBVt8PrU7/Pq1D1NHIQsvoHmSsUHwK0QqDGeCbj6qQMs5p5PhBksKdh7Xkfsoh6oTwvXRdbLmjcuc7rIoUB2QidfgltZ2bqSpGX+xvg4uQCKCgqn6TlXUCpDrLKKplE0MnYIyNuWrS/Grj11GJnmfTAsAVkXgM8dSXsBhf0JmMBMXLRTUuz1axxeNy3e29fXDEuoXPoTZ8a9EFTzgA/1l9n67qolWlZV5C8CAwEAAaOCAaQwggGgMAwGA1UdEwEB/wQCMAAwHwYDVR0jBBgwFoAUfyif2XGZQuJ159c1di5NCCVtdl4wewYIKwYBBQUHAQEEbzBtMEMGCCsGAQUFBzAChjdodHRwOi8vY2ExLmN0aS1nb3YuZGsvb2Nlcy9pc3N1aW5nLzEvY2FjZXJ0L2lzc3VpbmcuY2VyMCYGCCsGAQUFBzABhhpodHRwOi8vY2ExLmN0aS1nb3YuZGsvb2NzcDAcBgNVHREEFTATgRF0aG9tYXNAbnltYW5kLm5ldDAhBgNVHSAEGjAYMAgGBgQAj3oBATAMBgoqgVCBKQEBAQMHMDsGCCsGAQUFBwEDBC8wLTArBggrBgEFBQcLAjAfBgcEAIvsSQECMBSGEmh0dHBzOi8vdWlkLmdvdi5kazBFBgNVHR8EPjA8MDqgOKA2hjRodHRwOi8vY2ExLmN0aS1nb3YuZGsvb2Nlcy9pc3N1aW5nLzEvY3JsL2lzc3VpbmcuY3JsMB0GA1UdDgQWBBS6ZyVKq8su7B6OPmH0lkvc6nYpqzAOBgNVHQ8BAf8EBAMCBeAwQQYJKoZIhvcNAQEKMDSgDzANBglghkgBZQMEAgEFAKEcMBoGCSqGSIb3DQEBCDANBglghkgBZQMEAgEFAKIDAgEgA4IBgQCNt3wTWs0HKYutrfPxw06SmQdeS/bZDBtiallEYaE9HclkWPFIGii8V0gHYyvV6i90f+Sz9FWjAohhQCaMWVkImKG+8EU4mgAjkSRJa4/GpsB9KKQZs26dNayKTdbL/x9MajgaPBPp+kYuVPOjX6oXgLG8huaJ8GqsjQocGd9JPX4k/ir6S+E4Q4Q3PG89HCX9R+28XjT4R/SUwxIvjnf0eKapS/LZdOgk/e5pxTUDWOZhlmJLlXsDAcwXlQ+0vhX4Euk08RKqAi+jK2n2qKIiAg2UFfgdtg7Fu4hWkbLMH/KFf2U21vdmVZAgiOAPmipkuFOwiJV8Q6k5kIVf+OoxBlkUCK6Z9j3Cxuaa1bOif13Iyv003Gns2GCAULA4i+yloYkWHE1jPi1KaLhpcMbf7eRE9MEmS/JVBNVXpDi1M3Y6s6gltO4xbctJPPpnvopyHEhRQx0zQTxk7FcY5izmI+ld62eCLKtPEvV0oVGXVoUGkUqnz5IZmXpBTXVt+YA="; } diff --git a/pom.xml b/pom.xml index 4c586f7..3093c83 100644 --- a/pom.xml +++ b/pom.xml @@ -16,10 +16,12 @@ org.apache.maven.plugins maven-compiler-plugin - 3.3 + 3.8.1 - 1.8 - 1.8 + + 8