[rrama]

Description

Milestone 1 of migrating snyk-eclipse-plugin's S3 publishing off static AWS keys onto CircleCI OIDC (IDE-2483).

Adds a build-sign CircleCI job that decodes the KEYSTORE/KEYSTORE_SHA secrets, verifies the checksum, and runs ./mvnw clean verify -P sign (confirmed green) — proving the Maven signing profile works with the keystore secrets copied from GitHub Actions into CircleCI. Each of KEYSTORE, KEYSTORE_SHA, KEYSTORE_PASS fails the step loudly if unset or empty, rather than surfacing as a confusing jarsigner error later.

build-sign only runs on main, gated behind a manual approval step (Approve signing job). The CircleCI context holding the signing secrets is restricted, so without an approval gate, any contributor's merge to main would trigger a job that uses those secrets unattended. The gate lets code still build and test normally for every contributor, but requires an explicit approval before the signing step itself runs.

Out of scope for this PR (tracked as later milestones on IDE-2483): S3 publish itself, the aws-cli OIDC orb, and removing the GitHub Actions publish steps.

Checklist

• Read and understood the Code of Conduct and Contributing Guidelines.
• Tests added and all succeed — N/A, CI-config-only change; the new job itself is the verification
• Linted
• CHANGELOG.md updated
• README.md updated, if user-facing

Screenshots / GIFs

N/A — CI config change.

PR Stack — Merge Order

flowchart LR
    main(["main"])
    PR1["#460 build-sign ← YOU ARE HERE\nCircleCI signing"]
    PR2["#462 publish-preview\nCircleCI OIDC publish"]
    PR3["#463 stable-release scaffold\nworkflow + build-sign-stable"]
    PR4["#468 publish-stable\nOIDC publish, DO NOT MERGE yet"]
    PR5["#465 remove legacy workflow\nDO NOT MERGE yet"]
    main --> PR1 --> PR2 --> PR3 --> PR4 --> PR5
    style PR1 fill:#ffd700,color:#000

Loading

🤖 Generated with Claude Code

---

Note

Low Risk
CI and workflow-only change; signing secrets are gated behind manual approval on main with no application or runtime behavior changes.

Overview
Adds a build-sign CircleCI job (main only) that decodes and checksum-validates signing keystore secrets, then runs ./mvnw clean verify -P sign using the restricted snyk-eclipse-plugin-signing context. Secret env vars (KEYSTORE, KEYSTORE_SHA, KEYSTORE_PASS) are checked up front so missing values fail clearly instead of deep in jarsigner.

The CICD workflow now includes a manual Approve signing job approval step before build-sign, so merges to main still run the existing test jobs for everyone, but using signing credentials requires an explicit approver. This is the first CI milestone toward moving Eclipse plugin publishing off static AWS keys (S3/OIDC work is later).

^{Reviewed by Cursor Bugbot for commit 88f538c. Bugbot is set up for automated code reviews on this repo. Configure here.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[rrama]

• ci: delete release-legacy.yml, move upload-to-s3.sh into .circleci/ [IDE-2483] #465
• ci: add publish-stable job with CircleCI OIDC, rename release.yml to legacy fallback [IDE-2483] #468
• ci: add stable-release workflow scaffold on CircleCI OIDC [IDE-2483] #463
• ci: move publish-preview job to CircleCI [IDE-2483] #462
• ci: add build-sign job to CircleCI CICD workflow [IDE-2483] #460 👈 (View in Graphite)
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[nick-y-snyk]

Looks good. The up-front variable checks and the checksum verification make failures easy to read, and keystore.jks stays out of the workspace.

Nit: the KEYSTORE_PASS check runs after the keystore is decoded. Moving it up next to the other two means a missing password fails before any work happens.

[rrama]

Nit: the KEYSTORE_PASS check runs after the keystore is decoded. Moving it up next to the other two means a missing password fails before any work happens.

I'd argue it's cleaner to have it right next to the use and the work done isn't real costly work anyway.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 2 relevant code sections from 2 files (average relevance: 0.76) RELEASE.md (lines 1-81) pom.xml (lines 1-175)

🤖 Repository instructions applied (from AGENTS.md)