feat(sdk): add comprehensive DPoP (RFC 9449) support (DSPX-3397) #1677
Workflow file for this run
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| name: "Checks" | |
| on: | |
| pull_request: | |
| branches: | |
| - main | |
| - 'release/**' | |
| push: | |
| branches: | |
| - main | |
| merge_group: | |
| branches: | |
| - main | |
| types: | |
| - checks_requested | |
| permissions: | |
| contents: read | |
| jobs: | |
| pr: | |
| name: Validate PR title | |
| if: contains(fromJSON('["pull_request", "pull_request_target"]'), github.event_name) | |
| runs-on: ubuntu-22.04 | |
| permissions: | |
| pull-requests: read | |
| steps: | |
| - name: Conventional Commits Check | |
| if: contains(fromJSON('["pull_request", "pull_request_target"]'), github.event_name) | |
| id: conventional-commits | |
| uses: amannn/action-semantic-pull-request@0723387faaf9b38adef4775cd42cfd5155ed6017 # v5.5.3 | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| with: | |
| # Types include: | |
| # - fix: fixes | |
| # - feat: features and enhancements | |
| # - chore: non-feature or enhancement (i.e. docs, ci, linting, automated, etc) | |
| types: | | |
| fix | |
| feat | |
| chore | |
| revert | |
| # Scopes include: | |
| # - ci: anything related to ci | |
| # - cmdline: changes to cmdline | |
| # - docs: anything related solely to documentation | |
| # - main: bot generated commits | |
| # - sdk: changes to sdk | |
| # - tests: test only changes | |
| # - examples: examples only changes | |
| # - release/v0.\d+: release-please release branch PRs | |
| scopes: | | |
| ci | |
| cmdline | |
| docs | |
| main | |
| sdk | |
| tests | |
| examples | |
| release/v0\.\d+ | |
| mavenverify: | |
| runs-on: ubuntu-latest | |
| steps: | |
| - uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - uses: bufbuild/buf-setup-action@a47c93e0b1648d5651a065437926377d060baa99 # v1.50.0 | |
| with: | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Cache Maven packages | |
| uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 | |
| with: | |
| path: ~/.m2 | |
| key: ${{ runner.os }}-m2-${{ hashFiles('**/pom.xml') }} | |
| restore-keys: ${{ runner.os }}-m2 | |
| - name: Set up JDK | |
| uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1 | |
| with: | |
| java-version: "17" | |
| distribution: "temurin" | |
| server-id: github | |
| - name: Cache SonarCloud packages | |
| uses: actions/cache@5a3ec84eff668545956fd18022155c47e93e2684 # v4.2.3 | |
| with: | |
| path: ~/.sonar/cache | |
| key: ${{ runner.os }}-sonar | |
| restore-keys: ${{ runner.os }}-sonar | |
| - name: Generate sources | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| BUF_INPUT_HTTPS_USERNAME: opentdf-bot | |
| BUF_INPUT_HTTPS_PASSWORD: ${{ secrets.PERSONAL_ACCESS_TOKEN_OPENTDF }} | |
| run: mvn clean --batch-mode clean generate-sources | |
| - name: Tests and enforcer (fips) | |
| run: | | |
| # install the sdk-fips-bc jar so that FIPS mode tests work | |
| mvn --batch-mode install -pl sdk-fips-bc -am \ | |
| -Dmaven.antrun.skip \ | |
| -Dmaven.test.skip | |
| mvn --batch-mode test enforcer:enforce -P 'fips,!non-fips' \ | |
| -Dmaven.antrun.skip | |
| - name: Tests with coverage and javadoc (non-fips) | |
| env: | |
| GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }} | |
| SONAR_TOKEN: ${{ secrets.SONAR_TOKEN }} | |
| run: | | |
| mvn --batch-mode verify \ | |
| org.sonarsource.scanner.maven:sonar-maven-plugin:sonar \ | |
| -Dmaven.antrun.skip -Dsonar.projectKey=opentdf_java-sdk \ | |
| -P 'coverage,non-fips,!fips' | |
| platform-integration: | |
| name: "Platform Integration ${{ matrix.label }}" | |
| runs-on: ubuntu-22.04 | |
| strategy: | |
| matrix: | |
| include: | |
| - label: "" | |
| maven_profile: "" | |
| - label: " (FIPS)" | |
| maven_profile: "-P 'fips,!non-fips'" | |
| steps: | |
| - name: Checkout Java SDK | |
| uses: actions/checkout@11bd71901bbe5b1630ceea73d27597364c9af683 # v4.2.2 | |
| - uses: bufbuild/buf-setup-action@a47c93e0b1648d5651a065437926377d060baa99 # v1.50.0 | |
| with: | |
| github_token: ${{ secrets.GITHUB_TOKEN }} | |
| - name: Set up JDK | |
| uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1 | |
| with: | |
| java-version: "17" | |
| distribution: "temurin" | |
| server-id: github | |
| - name: Check out and start up platform with deps/containers | |
| id: run-platform | |
| uses: opentdf/platform/test/start-up-with-containers@main | |
| with: | |
| platform-ref: main | |
| - name: Get grpcurl | |
| run: go install github.com/fullstorydev/grpcurl/cmd/grpcurl@v1.8.9 | |
| - name: Make sure that the platform is up | |
| run: | | |
| grpcurl -plaintext localhost:8080 list && \ | |
| grpcurl -plaintext localhost:8080 kas.AccessService/PublicKey | |
| - name: Build java SDK${{ matrix.label }} | |
| run: | | |
| mvn --batch-mode clean install -pl cmdline -am ${{ matrix.maven_profile }} -DskipTests | |
| env: | |
| BUF_INPUT_HTTPS_USERNAME: opentdf-bot | |
| BUF_INPUT_HTTPS_PASSWORD: ${{ secrets.PERSONAL_ACCESS_TOKEN_OPENTDF }} | |
| - name: Validate the SDK through the command line interface${{ matrix.label }} | |
| run: | | |
| ../.github/scripts/verify_cmdline_roundtrip.sh | |
| working-directory: cmdline | |
| - name: Encrypt/Decrypt Assertions${{ matrix.label }} | |
| run: | | |
| ../.github/scripts/verify_assertions_basic.sh | |
| ../.github/scripts/verify_assertions_hs256.sh | |
| ../.github/scripts/verify_assertions_rs256.sh | |
| working-directory: cmdline | |
| platform-xtest: | |
| permissions: | |
| contents: read | |
| packages: read | |
| checks: write | |
| pull-requests: write | |
| uses: opentdf/tests/.github/workflows/xtest.yml@main | |
| with: | |
| focus-sdk: java | |
| java-ref: ${{ github.ref }} latest | |
| platform-ref: main latest | |
| ci: | |
| needs: | |
| - platform-integration | |
| - platform-xtest | |
| - mavenverify | |
| - pr | |
| runs-on: ubuntu-latest | |
| if: always() | |
| steps: | |
| - if: contains(needs.*.result, 'failure') | |
| run: echo "Failed due to ${{ contains(needs.*.result, 'failure') }}" && exit 1 |