Skip to content

Commit 86cf791

Browse files
mwojcik-dropboxcursoragent
mwojcik-dropbox
and
cursoragent
committed
Update Java SDK templates to fetch CI secrets from AWS SM.
Keep generated Java v1/v2 workflows aligned with the published dropbox-sign-java OIDC migration. Co-authored-by: Cursor <cursoragent@cursor.com>
1 parent 8f19bc6 commit 86cf791

6 files changed

Lines changed: 148 additions & 36 deletions

File tree

‎sdks/java-v1/.github/workflows/close-and-release-repository.yml‎

Lines changed: 26 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,13 @@ on:
88

99
jobs:
1010
closeAndReleaseRepository:
11+
if: >-
12+
github.repository == 'hellosign/dropbox-sign-java'
13+
&& github.ref == 'refs/heads/v1'
1114
runs-on: ubuntu-latest
15+
permissions:
16+
id-token: write
17+
contents: read
1218
steps:
1319
- name: Checkout
1420
uses: actions/checkout@v3
@@ -19,10 +25,26 @@ jobs:
1925
distribution: 'zulu'
2026
java-version: 11
2127

28+
- name: Configure AWS credentials for Maven secrets (OIDC)
29+
uses: aws-actions/configure-aws-credentials@v6
30+
with:
31+
role-to-assume: arn:aws:iam::521590706193:role/oidc-github-hellosign-dropbox-sign-java-branch-v1
32+
aws-region: us-west-2
33+
34+
- name: Get Maven Central secrets from AWS Secrets Manager
35+
uses: aws-actions/aws-secretsmanager-get-secrets@v3
36+
with:
37+
secret-ids: |
38+
SONATYPE_USERNAME,sdk-release-maven-central-token-username
39+
SONATYPE_PASSWORD,sdk-release-maven-central-token-password
40+
SIGNING_KEY,sdk-release-signing-key
41+
SIGNING_PASSWORD,sdk-release-signing-password
42+
parse-json-secrets: false
43+
2244
- name: Publish Release to Maven Central
2345
run: ./gradlew publishAndReleaseToMavenCentral --no-daemon --no-parallel --no-configuration-cache --stacktrace
2446
env:
25-
ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.SONATYPE_USERNAME }}
26-
ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.SONATYPE_PASSWORD }}
27-
ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.SIGNING_KEY }}
28-
ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.SIGNING_PASSWORD }}
47+
ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ env.SONATYPE_USERNAME }}
48+
ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ env.SONATYPE_PASSWORD }}
49+
ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ env.SIGNING_KEY }}
50+
ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ env.SIGNING_PASSWORD }}

‎sdks/java-v1/.github/workflows/github-actions.yml‎

Lines changed: 47 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
# This workflow will build the project, run integration tests, and release.
2-
# Because secrets are not available on external forks, this job is expected to fail
3-
# on external pull requests.
2+
# Secret-backed jobs fetch credentials from AWS Secrets Manager using GitHub OIDC.
43

54
name: Build, Check, Publish
65

@@ -15,15 +14,31 @@ on:
1514
jobs:
1615
build:
1716
runs-on: ubuntu-latest
17+
permissions:
18+
id-token: write
19+
contents: read
1820
steps:
1921
- name: Checkout Repo
2022
uses: actions/checkout@v3
2123

24+
- name: Configure AWS credentials for Docker Hub secrets (OIDC)
25+
if: github.event_name != 'pull_request'
26+
uses: aws-actions/configure-aws-credentials@v6
27+
with:
28+
role-to-assume: arn:aws:iam::301904545275:role/oidc-github-hellosign-dropbox-sign-java-branch-v1
29+
aws-region: us-west-2
30+
31+
- name: Get Docker Hub secrets from AWS Secrets Manager
32+
if: github.event_name != 'pull_request'
33+
uses: aws-actions/aws-secretsmanager-get-secrets@v3
34+
with:
35+
secret-ids: |
36+
DOCKER_USERNAME,github-actions/hellosign/shared/docker-username
37+
DOCKER_TOKEN,github-actions/hellosign/shared/docker-token
38+
parse-json-secrets: false
39+
2240
- name: Build SDK
2341
run: ./run-build
24-
env:
25-
DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
26-
DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
2742

2843
- name: Ensure no changes in Generated Code
2944
run: ./bin/check-clean-git-status
@@ -37,6 +52,9 @@ jobs:
3752
&& github.ref == 'refs/heads/v1'
3853
&& github.event_name != 'pull_request'
3954
needs: [ build ]
55+
permissions:
56+
id-token: write
57+
contents: read
4058
steps:
4159
- name: Checkout
4260
uses: actions/checkout@v3
@@ -50,23 +68,39 @@ jobs:
5068
- name: Retrieve version
5169
run: echo "PACKAGE_VERSION=$(cat VERSION)" >> $GITHUB_ENV
5270

71+
- name: Configure AWS credentials for Maven secrets (OIDC)
72+
uses: aws-actions/configure-aws-credentials@v6
73+
with:
74+
role-to-assume: arn:aws:iam::521590706193:role/oidc-github-hellosign-dropbox-sign-java-branch-v1
75+
aws-region: us-west-2
76+
77+
- name: Get Maven Central secrets from AWS Secrets Manager
78+
uses: aws-actions/aws-secretsmanager-get-secrets@v3
79+
with:
80+
secret-ids: |
81+
SONATYPE_USERNAME,sdk-release-maven-central-token-username
82+
SONATYPE_PASSWORD,sdk-release-maven-central-token-password
83+
SIGNING_KEY,sdk-release-signing-key
84+
SIGNING_PASSWORD,sdk-release-signing-password
85+
parse-json-secrets: false
86+
5387
- name: Publish to Maven Central
5488
run: ./gradlew publishAndReleaseToMavenCentral --no-daemon --no-parallel --no-configuration-cache --stacktrace
5589
if: "!endsWith(env.PACKAGE_VERSION, '-SNAPSHOT')"
5690
env:
57-
ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.SONATYPE_USERNAME }}
58-
ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.SONATYPE_PASSWORD }}
59-
ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.SIGNING_KEY }}
60-
ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.SIGNING_PASSWORD }}
91+
ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ env.SONATYPE_USERNAME }}
92+
ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ env.SONATYPE_PASSWORD }}
93+
ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ env.SIGNING_KEY }}
94+
ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ env.SIGNING_PASSWORD }}
6195

6296
- name: Publish Snapshot
6397
run: ./gradlew publishToMavenCentral --no-daemon --no-parallel --no-configuration-cache --stacktrace
6498
if: "endsWith(env.PACKAGE_VERSION, '-SNAPSHOT')"
6599
env:
66-
ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.SONATYPE_USERNAME }}
67-
ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.SONATYPE_PASSWORD }}
68-
ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.SIGNING_KEY }}
69-
ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.SIGNING_PASSWORD }}
100+
ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ env.SONATYPE_USERNAME }}
101+
ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ env.SONATYPE_PASSWORD }}
102+
ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ env.SIGNING_KEY }}
103+
ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ env.SIGNING_PASSWORD }}
70104

71105
# This job runs on merging to "v1" branch
72106
# Creates a new tag using the value in the VERSION file

‎sdks/java-v1/run-build‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ set -e
77
DIR=$(cd `dirname $0` && pwd)
88
WORKING_DIR="/app/java"
99

10-
if [[ -n "$GITHUB_ACTIONS" ]]; then
10+
if [[ -n "$GITHUB_ACTIONS" && -n "${DOCKER_USERNAME:-}" && -n "${DOCKER_TOKEN:-}" ]]; then
1111
printf "\nLogging in to docker.com ...\n"
1212
echo "${DOCKER_TOKEN}" | docker login -u "${DOCKER_USERNAME}" --password-stdin
1313
fi

‎sdks/java-v2/.github/workflows/close-and-release-repository.yml‎

Lines changed: 26 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,13 @@ on:
88

99
jobs:
1010
closeAndReleaseRepository:
11+
if: >-
12+
github.repository == 'hellosign/dropbox-sign-java'
13+
&& github.ref == 'refs/heads/main'
1114
runs-on: ubuntu-latest
15+
permissions:
16+
id-token: write
17+
contents: read
1218
steps:
1319
- name: Checkout
1420
uses: actions/checkout@v3
@@ -19,10 +25,26 @@ jobs:
1925
distribution: 'zulu'
2026
java-version: 11
2127

28+
- name: Configure AWS credentials for Maven secrets (OIDC)
29+
uses: aws-actions/configure-aws-credentials@v6
30+
with:
31+
role-to-assume: arn:aws:iam::521590706193:role/oidc-github-hellosign-dropbox-sign-java-branch-main
32+
aws-region: us-west-2
33+
34+
- name: Get Maven Central secrets from AWS Secrets Manager
35+
uses: aws-actions/aws-secretsmanager-get-secrets@v3
36+
with:
37+
secret-ids: |
38+
SONATYPE_USERNAME,sdk-release-maven-central-token-username
39+
SONATYPE_PASSWORD,sdk-release-maven-central-token-password
40+
SIGNING_KEY,sdk-release-signing-key
41+
SIGNING_PASSWORD,sdk-release-signing-password
42+
parse-json-secrets: false
43+
2244
- name: Publish Release to Maven Central
2345
run: ./gradlew publishAndReleaseToMavenCentral --no-daemon --no-parallel --no-configuration-cache --stacktrace
2446
env:
25-
ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.SONATYPE_USERNAME }}
26-
ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.SONATYPE_PASSWORD }}
27-
ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.SIGNING_KEY }}
28-
ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.SIGNING_PASSWORD }}
47+
ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ env.SONATYPE_USERNAME }}
48+
ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ env.SONATYPE_PASSWORD }}
49+
ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ env.SIGNING_KEY }}
50+
ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ env.SIGNING_PASSWORD }}

‎sdks/java-v2/.github/workflows/github-actions.yml‎

Lines changed: 47 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
# This workflow will build the project, run integration tests, and release.
2-
# Because secrets are not available on external forks, this job is expected to fail
3-
# on external pull requests.
2+
# Secret-backed jobs fetch credentials from AWS Secrets Manager using GitHub OIDC.
43

54
name: Build, Check, Publish
65

@@ -15,15 +14,31 @@ on:
1514
jobs:
1615
build:
1716
runs-on: ubuntu-latest
17+
permissions:
18+
id-token: write
19+
contents: read
1820
steps:
1921
- name: Checkout Repo
2022
uses: actions/checkout@v3
2123

24+
- name: Configure AWS credentials for Docker Hub secrets (OIDC)
25+
if: github.event_name != 'pull_request'
26+
uses: aws-actions/configure-aws-credentials@v6
27+
with:
28+
role-to-assume: arn:aws:iam::301904545275:role/oidc-github-hellosign-dropbox-sign-java-branch-main
29+
aws-region: us-west-2
30+
31+
- name: Get Docker Hub secrets from AWS Secrets Manager
32+
if: github.event_name != 'pull_request'
33+
uses: aws-actions/aws-secretsmanager-get-secrets@v3
34+
with:
35+
secret-ids: |
36+
DOCKER_USERNAME,github-actions/hellosign/shared/docker-username
37+
DOCKER_TOKEN,github-actions/hellosign/shared/docker-token
38+
parse-json-secrets: false
39+
2240
- name: Build SDK
2341
run: ./run-build
24-
env:
25-
DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
26-
DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
2742

2843
- name: Ensure no changes in Generated Code
2944
run: ./bin/check-clean-git-status
@@ -37,6 +52,9 @@ jobs:
3752
&& github.ref == 'refs/heads/main'
3853
&& github.event_name != 'pull_request'
3954
needs: [ build ]
55+
permissions:
56+
id-token: write
57+
contents: read
4058
steps:
4159
- name: Checkout
4260
uses: actions/checkout@v3
@@ -50,23 +68,39 @@ jobs:
5068
- name: Retrieve version
5169
run: echo "PACKAGE_VERSION=$(cat VERSION)" >> $GITHUB_ENV
5270

71+
- name: Configure AWS credentials for Maven secrets (OIDC)
72+
uses: aws-actions/configure-aws-credentials@v6
73+
with:
74+
role-to-assume: arn:aws:iam::521590706193:role/oidc-github-hellosign-dropbox-sign-java-branch-main
75+
aws-region: us-west-2
76+
77+
- name: Get Maven Central secrets from AWS Secrets Manager
78+
uses: aws-actions/aws-secretsmanager-get-secrets@v3
79+
with:
80+
secret-ids: |
81+
SONATYPE_USERNAME,sdk-release-maven-central-token-username
82+
SONATYPE_PASSWORD,sdk-release-maven-central-token-password
83+
SIGNING_KEY,sdk-release-signing-key
84+
SIGNING_PASSWORD,sdk-release-signing-password
85+
parse-json-secrets: false
86+
5387
- name: Publish to Maven Central
5488
run: ./gradlew publishAndReleaseToMavenCentral --no-daemon --no-parallel --no-configuration-cache --stacktrace
5589
if: "!endsWith(env.PACKAGE_VERSION, '-SNAPSHOT')"
5690
env:
57-
ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.SONATYPE_USERNAME }}
58-
ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.SONATYPE_PASSWORD }}
59-
ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.SIGNING_KEY }}
60-
ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.SIGNING_PASSWORD }}
91+
ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ env.SONATYPE_USERNAME }}
92+
ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ env.SONATYPE_PASSWORD }}
93+
ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ env.SIGNING_KEY }}
94+
ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ env.SIGNING_PASSWORD }}
6195

6296
- name: Publish Snapshot
6397
run: ./gradlew publishToMavenCentral --no-daemon --no-parallel --no-configuration-cache --stacktrace
6498
if: "endsWith(env.PACKAGE_VERSION, '-SNAPSHOT')"
6599
env:
66-
ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.SONATYPE_USERNAME }}
67-
ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.SONATYPE_PASSWORD }}
68-
ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.SIGNING_KEY }}
69-
ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.SIGNING_PASSWORD }}
100+
ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ env.SONATYPE_USERNAME }}
101+
ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ env.SONATYPE_PASSWORD }}
102+
ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ env.SIGNING_KEY }}
103+
ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ env.SIGNING_PASSWORD }}
70104

71105
# This job runs on merging to "main" branch
72106
# Creates a new tag using the value in the VERSION file

‎sdks/java-v2/run-build‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,7 @@ set -e
77
DIR=$(cd `dirname $0` && pwd)
88
WORKING_DIR="/app/java"
99

10-
if [[ -n "$GITHUB_ACTIONS" ]]; then
10+
if [[ -n "$GITHUB_ACTIONS" && -n "${DOCKER_USERNAME:-}" && -n "${DOCKER_TOKEN:-}" ]]; then
1111
printf "\nLogging in to docker.com ...\n"
1212
echo "${DOCKER_TOKEN}" | docker login -u "${DOCKER_USERNAME}" --password-stdin
1313
fi

0 commit comments

Comments
 (0)