[rrama]

User description

Description

Milestone 2 of migrating snyk-eclipse-plugin's S3 publishing off static AWS keys onto CircleCI OIDC (IDE-2483). Stacked on #460 (milestone 1, the build-sign job).

Adds a publish-preview CircleCI job that assumes the snyk-assets-eclipse-writer IAM role via CircleCI OIDC and uploads the signed p2 repository (built by build-sign, consumed via a CircleCI workspace rather than rebuilt) to s3://snyk-assets/eclipse/preview/, replacing the GitHub Actions preview publish step that used static AWS_ACCESS_KEY_ID/AWS_SECRET_ACCESS_KEY secrets.

Removes ci.yml's preview-publish machinery (the -P sign build variant, keystore decode step, S3 upload step) in this same PR, so there is never a window where both paths could publish preview simultaneously. release.yml (stable) is untouched — migrated in a later milestone once preview is confirmed working end-to-end.

The milestone-1 approval gate (Approve signing job) is renamed to Approve preview release and now authorizes the whole preview pipeline — sign and publish — as a single approval, rather than gating each step separately. build-sign additionally requires security-scans and the repository secrets scan to pass before it can execute, so a preview release can't proceed if either check is failing.

ProdSec prescribed the explicit human approval here — it changes which identity the pipeline runs as, which is what grants it access to the restricted CircleCI context holding the signing/publishing credentials.

Verified end-to-end on real CircleCI OIDC runs (where the branch filter was temporarily widened for the testing):

• Correctly rejected (AccessDenied on AssumeRoleWithWebIdentity) when run from a branch not in the IAM role's trust policy.
• Published successfully from an allowed branch — sts get-caller-identity confirmed the assumed role ARN, and the resulting published jar's signing certificate (owner/issuer/serial/SHA-256 fingerprint) and full content matched the pre-migration artifact exactly, aside from the expected build-timestamp bump.

.github/upload-to-s3.sh also had the wrong default bucket name (snyk-test, dead code since the job always overrode it) — fixed to snyk-assets, which let publish-preview's explicit environment: block (bucket + region, both now redundant with the script's own defaults) be dropped entirely.

Out of scope for this PR (tracked as later milestones on IDE-2483): migrating release.yml's stable publish to CircleCI OIDC, and removing the static AWS key GitHub secrets / deactivating the IAM access key — release.yml still needs them until it's migrated too.

Checklist

• Read and understood the Code of Conduct and Contributing Guidelines.
• Tests added and all succeed — N/A, CI-config-only change; verified via the real OIDC publish runs linked above
• Linted
• CHANGELOG.md updated
• README.md updated, if user-facing

Screenshots / GIFs

N/A — CI config change.

🤖 Generated with Claude Code

PR Stack — Merge Order

flowchart LR
    main(["main"])
    PR1["#460 build-sign\nCircleCI signing"]
    PR2["#462 publish-preview ← YOU ARE HERE\nCircleCI OIDC publish"]
    PR3["#463 stable-release scaffold\nworkflow + build-sign-stable"]
    PR4["#468 publish-stable\nOIDC publish, DO NOT MERGE yet"]
    PR5["#465 remove legacy workflow\nDO NOT MERGE yet"]
    main --> PR1 --> PR2 --> PR3 --> PR4 --> PR5
    style PR2 fill:#ffd700,color:#000

Loading

Depends on: #460

---

PR Type

Enhancement

---

Description

• Migrate preview publishing to CircleCI using OIDC.

• Replace static AWS secrets with IAM role assumption.

• Enhance build-sign job dependencies and approval gates.

• Remove redundant preview publish logic from GitHub Actions.

---

Diagram Walkthrough

flowchart LR
  subgraph gh["GitHub Actions"]
    ci_yml["ci.yml"]
  end
  subgraph cci["CircleCI"]
    config_yml[".circleci/config.yml"]
    approval_gate["Approve Preview Release Gate"]
    build_sign_job["Build Sign Job"]
    publish_preview_job["Publish Preview Job"]
    oidc_auth["OIDC Authentication"]
  end
  AWS_S3["AWS S3 Bucket"]
  AWS_IAM_Role["snyk-assets-eclipse-writer IAM Role"]

  ci_yml -- "no longer publishes preview" --> config_yml
  approval_gate -- "approves entire preview pipeline" --> build_sign_job
  build_sign_job -- "outputs artifacts" --> publish_preview_job
  publish_preview_job -- "uses" --> oidc_auth
  oidc_auth -- "assumes role" --> AWS_IAM_Role
  AWS_IAM_Role -- "grants access" --> AWS_S3
  publish_preview_job -- "uploads to" --> AWS_S3

Loading

File Walkthrough

Relevant files

Configuration changes

config.yml CircleCI configuration for OIDC preview publishing.            .circleci/config.yml Added aws-cli orb for AWS interactions. Introduced a new publish-preview job that leverages OIDC for AWS authentication via a specific IAM role. The build-sign job now persists necessary artifacts to the workspace. Renamed the approval gate to Approve preview release and enhanced job dependencies for build-sign. Added the publish-preview job to the CICD workflow. +46/-3    ci.yml Removed GitHub Actions preview publishing logic.                  .github/workflows/ci.yml Removed steps for keystore decoding, signed builds, and S3 uploads related to preview releases. Simplified the build job for non-main branches. The logic for signing and publishing previews is no longer handled by GitHub Actions. +1/-32

---

Note

Medium Risk
Changes how preview artifacts reach production S3 (new IAM/OIDC path and removed GHA publish), though gated by human approval and role verification.

Overview
Moves Eclipse plugin preview publishing from GitHub Actions to CircleCI, using OIDC to assume snyk-assets-eclipse-writer instead of static AWS keys.

CircleCI gains a publish-preview job that attaches the signed p2 repo from build-sign (now persisted to a workspace) and runs .github/upload-to-s3.sh preview after verifying the assumed-role ARN. The approval gate is renamed to Approve preview release and gates sign + publish together; build-sign on main also waits on all OS tests plus security and secrets scans.

GitHub Actions ci.yml no longer decodes the keystore, runs -P sign, or uploads to S3—only unsiged ./mvnw clean verify across the matrix. The upload script’s default bucket changes from snyk-test to snyk-assets (stable publish via release.yml is unchanged).

^{Reviewed by Cursor Bugbot for commit 323d056. Bugbot is set up for automated code reviews on this repo. Configure here.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Description updated to latest commit (4ccb3ab)

[rrama]

• ci: delete release-legacy.yml, move upload-to-s3.sh into .circleci/ [IDE-2483] #465
• ci: add publish-stable job with CircleCI OIDC, rename release.yml to legacy fallback [IDE-2483] #468
• ci: add stable-release workflow scaffold on CircleCI OIDC [IDE-2483] #463
• ci: move publish-preview job to CircleCI [IDE-2483] #462 👈 (View in Graphite)
• ci: add build-sign job to CircleCI CICD workflow [IDE-2483] #460
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[nick-y-snyk]

Two things I'd like settled before this merges, plus a couple of smaller ones.

1. Approving an old pipeline rolls preview back. Details in the inline comment on the approval gate.
2. Preview no longer publishes on its own. Before this PR every push to main published preview. Now nothing ships until someone clicks Approve preview release, and unapproved holds pile up on older commits. That changes the process for the whole team, so it's worth calling out in the PR description and in Slack when this lands.

Smaller:

• ci.yml now runs the full Maven build on all three OSes for pushes to main. It used to skip the build on macOS and Windows there, and on PRs it duplicates the CircleCI test matrix. The only thing it does that CircleCI doesn't is the PMD lint. Follow-up idea: cut ci.yml down to PMD, or move PMD into CircleCI.
• Nit: upload-to-s3.sh defaults AWS_S3_BUCKET_NAME to snyk-test. The job sets it, so nothing breaks, but defaulting to snyk-assets would let the environment: block go (the script already defaults the region). Two blocks once #468 lands.

[rrama]

Preview no longer publishes on its own. Before this PR every push to main published preview. Now nothing ships until someone clicks Approve preview release, and unapproved holds pile up on older commits. That changes the process for the whole team, so it's worth calling out in the PR description and in Slack when this lands.

The approval button was requested by ProdSec, as it changes who the pipeline is run as, which ensure permissions to the context. I had also asked the same Q, but they just wanted a standard way across the org, even though I don't see us having many people outside the CircleCI context push to main and if they do, we can just re-run the failed step to run it as us with access to the context. I have updated the PR description and will post to Slack after.

ci.yml now runs the full Maven build on all three OSes for pushes to main. It used to skip the build on macOS and Windows there, and on PRs it duplicates the CircleCI test matrix.

I think it is better to have it run all OSes on main, we don't require your branch to be up-to-date with main when we merge, so it may find issues. Made apparent in the PR description.

The only thing it does that CircleCI doesn't is the PMD lint. Follow-up idea: cut ci.yml down to PMD, or move PMD into CircleCI.

Good follow-on task, not for me to figure out today.

Nit: upload-to-s3.sh defaults AWS_S3_BUCKET_NAME to snyk-test. The job sets it, so nothing breaks, but defaulting to snyk-assets would let the environment: block go (the script already defaults the region). Two blocks once #468 lands.

Good call. Have changed.

[nick-y-snyk]

Thanks for the replies. Waiting to see whether the preview rollback ever happens is fine, given how quiet main is. One small correction: the guard wouldn't have held back your change, because the newer main HEAD contains your commit, so approving the newest pipeline ships it too. The only cost is waiting for that pipeline's tests.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 PR contains tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 3 relevant code sections from 3 files (average relevance: 0.74) RELEASE.md (lines 1-81) pom.xml (lines 101-175) README.md (lines 1-42)

🤖 Repository instructions applied (from AGENTS.md)