Secure Maven Central releases with the shared PlaytikaOSS workflow

.gitattributes

@@ -0,0 +1,2 @@
+mvnw text eol=lf
+mvnw.cmd text eol=crlf

.github/RELEASING.md

@@ -0,0 +1,41 @@
+# Maven Central releases
+
+This repository calls [PlaytikaOSS/playtika-workflows](https://github.com/PlaytikaOSS/playtika-workflows)
+at immutable commit `414efe1258d11ba5dcd2f9de4a9fcf82bd915c38`. Both workflow SHA pins must remain identical.
+Review and merge [the shared compatibility change](https://github.com/PlaytikaOSS/playtika-workflows/pull/6)
+before enabling this caller.
+
+The shared workflow checks allowed actors, protected source and an immutable
+release tag, builds without publication secrets, attests the unsigned bundle,
+then uses the official JReleaser action after independent Environment approval.
+Repository build code does not run with publication/signing credentials.
+Manual publication and release-time source pushes are removed.
++
+| Setting | Value |
++| --- | --- |
++| Protected release branch | `main` |
++| Build JDK | `8` |
++| Maven artifact group | `com.playtika.graphqlcodegen` |
++| Example published release tag | `graphqlcodegen-maven-plugin-1.13` |
++| Maven version for that tag | `1.13` |
++| Environment tag-only deployment policy | `graphqlcodegen-maven-plugin-[0-9]*.[0-9]*` |
++
+Follow the [caller onboarding instructions](https://github.com/PlaytikaOSS/playtika-workflows#onboard-each-caller-repository):
++
+1. Allow the pinned shared workflow and its GitHub/JReleaser actions.
++2. Configure `RELEASE_ACTORS` with approved release authors, publishers and rerun actors, including an approved drafting bot when applicable.
++3. Create `maven-central` with required reviewers, prevent self-review, disable administrator bypass, and add only the tag policy above.
++4. Add Environment secrets `MAVEN_CENTRAL_USERNAME`, `MAVEN_CENTRAL_TOKEN`, `GPG_PUBLIC_KEY`, `GPG_PRIVATE_KEY`, and `GPG_PASSPHRASE`. Use Central Portal credentials, not retired OSSRH credentials.
++5. Remove repository-level publication/signing secret duplicates and exclude this repository from organization copies. Protect the release branch with reviews/checks and version tags against update/deletion.
++
+The release build runs tests in its credential-free build job. Require the
+project CI as a branch check as well.
+
+This migration includes the Apache Maven 3.3.4 script-only wrapper with a
+SHA-256-verified Maven 3.9.16 distribution so the shared build can invoke
+`./mvnw` consistently.
+
++Publish the release only after the caller is merged into the release commit's
++branch. Review the validated source SHA and shared workflow pin before approving
++the `maven-central` deployment. Drafts, prereleases, snapshots and unapproved
++actors are rejected. Publication stays blocked until onboarding is complete.

.github/workflows/build.yml

@@ -1,32 +1,27 @@
-
 name: Build project
+
 on:
   push:
-    branches: [ main ]
+    branches: [main]
   pull_request:
-    branches: [ main ]
+    branches: [main]
+
+permissions:
+  contents: read
 
 jobs:
   build:
     runs-on: ubuntu-latest
-
     steps:
-      # Checkout repo using https://github.com/marketplace/actions/checkout
       - name: Checkout
-        uses: actions/checkout@v2
-
-      - name: Set up JDK 1.8
-        uses: actions/setup-java@v1
+        uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
         with:
-          java-version: 1.8
-
-      # See: https://github.com/actions/cache/blob/main/examples.md#java---maven
-      - name: Maven cache and restore deps
-        uses: actions/cache@v1
+          persist-credentials: false
+      - name: Set up JDK
+        uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
         with:
-          path: ~/.m2/repository
-          key: ${{ runner.os }}-maven-${{ hashFiles('**/pom.xml') }}
-          restore-keys: |
-            ${{ runner.os }}-maven-
-      - name: Build with Maven
-        run: mvn clean test -B -U
+          java-version: '8'
+          distribution: corretto
+          cache: maven
+      - name: Build with tests and publication artifacts
+        run: ./mvnw --batch-mode --no-transfer-progress -Dgpg.skip=true clean verify

.github/workflows/release.yml

@@ -1,26 +1,23 @@
-name: Publish package to the Maven Central Repository
+name: Publish to Maven Central
+
 on:
   release:
     types: [published]
+
+permissions: {}
+
 jobs:
-  publish:
-    runs-on: ubuntu-latest
-    steps:
-      - uses: actions/checkout@v2
-      - name: Import GPG Key
-        uses: crazy-max/ghaction-import-gpg@subkey
-        with:
-          gpg_private_key: ${{ secrets.GPG_PRIVATE_KEY }}
-          passphrase: ${{ secrets.GPG_PASSPHRASE }}
-      - name: Set up Maven Central Repository
-        uses: actions/setup-java@v1
-        with:
-          java-version: 1.8
-          server-id: ossrh
-          server-username: MAVEN_USERNAME
-          server-password: MAVEN_PASSWORD
-      - name: Publish package
-        run: mvn --batch-mode deploy
-        env:
-          MAVEN_USERNAME: ${{ secrets.OSSRH_USERNAME }}
-          MAVEN_PASSWORD: ${{ secrets.OSSRH_TOKEN }}
+  release:
+    uses: PlaytikaOSS/playtika-workflows/.github/workflows/maven-central-release.yml@414efe1258d11ba5dcd2f9de4a9fcf82bd915c38
+    permissions:
+      contents: read
+      actions: read
+      id-token: write
+      attestations: write
+    with:
+      workflow-sha: 414efe1258d11ba5dcd2f9de4a9fcf82bd915c38
+      group-id: com.playtika.graphqlcodegen
+      release-branch: main
+      java-version: '8'
+      tag-prefix: 'graphqlcodegen-maven-plugin-'
+      version-components: 2

.mvn/wrapper/maven-wrapper.properties

@@ -0,0 +1,4 @@
+wrapperVersion=3.3.4
+distributionType=only-script
+distributionUrl=https://repo.maven.apache.org/maven2/org/apache/maven/apache-maven/3.9.16/apache-maven-3.9.16-bin.zip
+distributionSha256Sum=5af3b743dd8b876b5c45da33b676251e5f1687712644abb4ee519ca56e1d89ce