[rrama]

Description

Milestone 3 (part 1 of 2) of migrating snyk-eclipse-plugin's S3 publishing off static AWS keys onto CircleCI OIDC (IDE-2483). Stacked on #462 (milestone 2, publish-preview).

Adds a second, fully independent CircleCI workflow (stable-release) alongside the existing CICD workflow, gated by a top-level pipeline parameter run_stable_release (default false) plus a branch check matching main, release/*, and hotfix/* — the same three patterns the snyk-assets-eclipse-writer IAM role's trust policy allows. A normal push runs only CICD as before; stable-release does not schedule at all until a human explicitly sets the parameter to true via CircleCI's Trigger Pipeline UI or the API. This mirrors release.yml's current workflow_dispatch trigger shape — manual, deliberate, decoupled from any specific push — rather than tying a stable release to routine CI approvals.

This PR adds only the workflow scaffold: the full test matrix (test-{linux,macos,windows}-stable, security-scans-stable, secrets scan) and build-sign-stable, reusing the existing build-sign job definition under a name: override — no duplicated script, same job body as CICD's own build-sign. No OIDC role assumption, no S3 upload, no GitHub release yet — that lands in a follow-up stacked PR (M3b) once this scaffold is confirmed to trigger correctly on main and build-sign-stable succeeds under a real manual trigger.

No approval gate on stable-release — the manual pipeline trigger itself is the deliberate act, same as release.yml's workflow_dispatch today. The existing CICD workflow's Approve preview release gate is unchanged. CICD gains a when: not: << pipeline.parameters.run_stable_release >> guard so it doesn't also run in parallel whenever stable-release is manually triggered — its jobs, requires, and filters are otherwise untouched.

Verified on a real pushed branch: CI ran only CICD's normal jobs — stable-release correctly did not schedule at all, confirming the guard works both ways.

Verified with a real manual trigger: renamed this branch to a temporary hotfix/* name and used CircleCI's Trigger Pipeline UI to set run_stable_release: true. The resulting run shows stable-release scheduling correctly, the full test matrix passing, and build-sign-stable succeeding end to end (Decode signing keystore and Maven verify with sign profile both green) — using the restricted snyk-eclipse-plugin-signing context, with no approval gate at all. This confirms CircleCI's restricted-context authorization works correctly for a manually-triggered pipeline: the triggering user's own permission is sufficient, no gate needed.

Checklist

• Read and understood the Code of Conduct and Contributing Guidelines.
• Tests added and all succeed — N/A, CI-config-only change; verified via the real CI run linked above
• Linted
• CHANGELOG.md updated
• README.md updated, if user-facing

Screenshots / GIFs

N/A — CI config change.

🤖 Generated with Claude Code

PR Stack — Merge Order

flowchart LR
    main(["main"])
    PR1["#460 build-sign\nCircleCI signing"]
    PR2["#462 publish-preview\nCircleCI OIDC publish"]
    PR3["#463 stable-release scaffold ← YOU ARE HERE\nworkflow + build-sign-stable"]
    PR4["#468 publish-stable\nOIDC publish, DO NOT MERGE yet"]
    PR5["#465 remove legacy workflow\nDO NOT MERGE yet"]
    main --> PR1 --> PR2 --> PR3 --> PR4 --> PR5
    style PR3 fill:#ffd700,color:#000

Loading

Depends on: #462

---

Note

Low Risk
CI workflow wiring only; no application, auth, or publish logic changes in this PR.

Overview
Introduces a manually triggered stable release path on CircleCI via pipeline parameter run_stable_release (default false), aligned with allowed branches main, release/*, and hotfix/*.

CICD now skips when that parameter is true so routine preview CI does not run alongside a stable release trigger. A new stable-release workflow runs the full test matrix, security scans, and build-sign-stable (reusing the existing build-sign job) when the parameter is set and the branch is allowed—no S3 publish or OIDC publish steps yet (follow-up PR).

An invalid-stable-release-branch workflow fails fast if run_stable_release is true on an unsupported branch.

^{Reviewed by Cursor Bugbot for commit 2832e94. Bugbot is set up for automated code reviews on this repo. Configure here.}

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[rrama]

[AI reply] False positive on this one. CircleCI's own docs show not accepting a bare parameter reference, no nested equal/and/or required:

- when:
    condition:
      not: "<< parameters.foo >>"

(https://github.com/CircleCI-Public/pipeline-preview-docs/blob/master/docs/complex_when.md) — a logic statement is cast to boolean via truthiness rules, so a scalar pipeline-parameter reference is a valid not argument.

Verified two more ways:

• circleci config validate against this branch's exact .circleci/config.yml passes clean.
• In production the guard has already run correctly both directions: a normal push to this branch ran only CICD (https://app.circleci.com/pipelines/gh/snyk/snyk-eclipse-plugin/2061), and a manually-triggered run_stable_release=true pipeline ran only stable-release, with CICD correctly excluded (https://app.circleci.com/pipelines/gh/snyk/snyk-eclipse-plugin/2064).

No change needed.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

^{Reviewed by Cursor Bugbot for commit 0ab2ada. Configure here.}

[rrama]

[AI reply] Leaving this as is — the collision (two different commits producing the identical second-precision tag name) is judged negligible for what's a manually-triggered, human-monitored release process. If it ever did happen, it's easy to spot and fix by hand: delete the bad release/tag on GitHub and re-trigger the pipeline.

[rrama]

• ci: delete release-legacy.yml, move upload-to-s3.sh into .circleci/ [IDE-2483] #465
• ci: add publish-stable job with CircleCI OIDC, rename release.yml to legacy fallback [IDE-2483] #468
• ci: add stable-release workflow scaffold on CircleCI OIDC [IDE-2483] #463 👈 (View in Graphite)
• ci: move publish-preview job to CircleCI [IDE-2483] #462
• ci: add build-sign job to CircleCI CICD workflow [IDE-2483] #460
• main

This stack of pull requests is managed by Graphite. Learn more about stacking.

[nick-y-snyk]

Looks good. Reusing build-sign under a new name: keeps a single job body, and the when guards were tested both ways on real runs.

Nits:

• Triggering with run_stable_release=true on a branch outside main, release/* and hotfix/* matches neither workflow. The pipeline runs nothing and doesn't tell the user the branch isn't allowed. A small workflow that fails with that message would make it obvious. Optional.
• The title is missing [IDE-2483].

[rrama]

Triggering with run_stable_release=true on a branch outside main, release/* and hotfix/* matches neither workflow. The pipeline runs nothing and doesn't tell the user the branch isn't allowed. A small workflow that fails with that message would make it obvious. Optional.

Good call. Done.

The title is missing IDE-2483.

🙈 Added.

[snyk-io]

✅ Snyk checks have passed. No issues have been found so far.

Status	Scan Engine	Critical	High	Medium	Low	Total (0)
✅	Open Source Security	0	0	0	0	0 issues
✅	Licenses	0	0	0	0	0 issues
✅	Code Security	0	0	0	0	0 issues

💻 Catch issues earlier using the plugins for VS Code, JetBrains IDEs, Visual Studio, and Eclipse.

[snyk-pr-review-bot]

PR Reviewer Guide 🔍

🧪 No relevant tests

🔒 No security concerns identified

⚡ No major issues detected

📚 Repository Context Analyzed This review considered 1 relevant code sections from 1 files (average relevance: 0.79) RELEASE.md (lines 1-81)

🤖 Repository instructions applied (from AGENTS.md)