Secure Maven Central releases with the shared PlaytikaOSS workflow

[Periecle]

Replace the existing Maven publisher, which runs repository build code with publication/signing credentials, with the protected shared PlaytikaOSS workflow. The caller pins shared commit 414efe1258d11ba5dcd2f9de4a9fcf82bd915c38; review and merge playtika-workflows #6 before enabling it.

The shared workflow verifies the exact release tag commit on protected main, approved actors and the protected Environment. It builds without publication secrets, attests the unsigned bundle, and rechecks authorization/provenance after independent approval before the official JReleaser action signs and publishes. The publisher runs no caller build code and has no GitHub write token. Manual publication and release-time source pushes are removed.

Repository configuration: JDK 8, Maven group com.playtika.graphqlcodegen, example tag graphqlcodegen-maven-plugin-1.13 → Maven version 1.13, Environment tag-only policy graphqlcodegen-maven-plugin-[0-9]*.[0-9]*. Release tests run in the credential-free build job.

• Add the Apache Maven 3.3.4 script-only wrapper with SHA-256 verification of the pinned Maven 3.9.16 distribution.

• Preserve prefixed two-component tags (graphqlcodegen-maven-plugin-1.13 → Maven 1.13) and attach source/Javadoc JARs required for Central.

• Replace retired actions/cache@v1 CI with pinned official checkout/setup-java actions and setup-java Maven caching; CI verifies tests and publication artifacts with Maven signing disabled.

Validation: caller policy execution, input/pin/permission checks, XML parsing, actionlint and diff checks passed. The shared workflow's 20 security regression tests pass locally and in GitHub Actions. Local Maven version update and unsigned file-repository deployment passed on JDK 8, staging 4 POM/JAR artifacts. Tests were skipped for that staging check. Staged POM coordinates, source/Javadoc companion artifacts and the fixed publisher's archive validation passed.

Before enabling releases, follow .github/RELEASING.md: configure RELEASE_ACTORS, protected branch/version tags, and a maven-central Environment with independent reviewers, self-review prevention, administrator bypass disabled, the exact tag policy above and all five publication/signing secrets. Remove repository-level copies and exclude this repository from organization copies of those secrets. This PR remains a draft until the shared dependency, onboarding and required CI are reviewed.

The official JReleaser 1.26.0 signing and packaging dry run also passed with a disposable test key and dummy credentials. No live Central deployment was performed.

[coderabbitai]

Important

Draft PR not reviewed

Draft PRs are not automatically reviewed by default.

• Trigger a manual review

To automatically review draft PRs, update your CodeRabbit configuration:

reviews:
  auto_review:
    drafts: true

• Autofix · Keep fixing CodeRabbit findings and required CI, and resolving merge conflicts

---

Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out.

❤️ Share

• X
• Mastodon
• Reddit
• LinkedIn

---

_{Comment @coderabbitai help to get the list of available commands.}