Skip to content

Commit f7f2ad4

Browse files
mwojcik-dropboxcursoragent
mwojcik-dropbox
and
cursoragent
authored
Backport SDK GitHub Actions workflows (#574)
Co-authored-by: Cursor <cursoragent@cursor.com>
1 parent cf1d068 commit f7f2ad4

9 files changed

Lines changed: 298 additions & 114 deletions

File tree

‎sdks/dotnet/.github/workflows/github-actions.yml‎

Lines changed: 38 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
# This workflow will build the project, run integration tests, and release.
2-
# Because secrets are not available on external forks, this job is expected to fail
3-
# on external pull requests.
2+
# Secret-backed jobs fetch credentials from AWS Secrets Manager using GitHub OIDC.
43

54
name: Build, Check, Publish
65

@@ -13,22 +12,44 @@ on:
1312
jobs:
1413
build:
1514
runs-on: ubuntu-latest
15+
permissions:
16+
id-token: write
17+
contents: read
1618
steps:
1719
- name: Checkout Repo
1820
uses: actions/checkout@v3
1921

22+
- name: Configure AWS credentials for Docker Hub secrets (OIDC)
23+
if: github.event_name != 'pull_request'
24+
uses: aws-actions/configure-aws-credentials@v6
25+
with:
26+
role-to-assume: arn:aws:iam::301904545275:role/oidc-github-hellosign-dropbox-sign-dotnet-branch-main
27+
aws-region: us-west-2
28+
29+
- name: Get Docker Hub secrets from AWS Secrets Manager
30+
if: github.event_name != 'pull_request'
31+
uses: aws-actions/aws-secretsmanager-get-secrets@v3
32+
with:
33+
secret-ids: |
34+
DOCKER_USERNAME,github-actions/hellosign/shared/docker-username
35+
DOCKER_TOKEN,github-actions/hellosign/shared/docker-token
36+
parse-json-secrets: false
37+
2038
- name: Build SDK
2139
run: ./run-build
22-
env:
23-
DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
24-
DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
2540

2641
- name: Ensure no changes in Generated Code
2742
run: ./bin/check-clean-git-status
2843

2944
publish:
3045
runs-on: ubuntu-latest
31-
if: github.repository == 'hellosign/dropbox-sign-dotnet'
46+
permissions:
47+
contents: read
48+
id-token: write
49+
if: >-
50+
github.repository == 'hellosign/dropbox-sign-dotnet'
51+
&& github.ref == 'refs/heads/main'
52+
&& github.event_name != 'pull_request'
3253
needs: [ build ]
3354
env:
3455
BUILD_CONFIG: 'Release'
@@ -54,13 +75,18 @@ jobs:
5475
- name: Run pack
5576
run: dotnet pack --configuration ${BUILD_CONFIG} ${SOLUTION}.sln
5677

57-
# This runs on merging to "main" branch
58-
# Builds and publishes package to nuget.org
78+
- name: NuGet login with trusted publishing
79+
uses: NuGet/login@v1
80+
id: nuget-login
81+
with:
82+
user: HelloSign
83+
5984
- name: Publish to nuget
60-
if: github.ref == 'refs/heads/main' && github.event_name != 'pull_request'
61-
run: dotnet nuget push src/${SOLUTION}/bin/Release/*.nupkg -k ${NUGET_API_KEY} -s https://api.nuget.org/v3/index.json
62-
env:
63-
NUGET_API_KEY: ${{ secrets.NUGET_API_KEY }}
85+
run: >-
86+
dotnet nuget push
87+
src/${SOLUTION}/bin/Release/*.nupkg
88+
--api-key ${{ steps.nuget-login.outputs.NUGET_API_KEY }}
89+
--source https://api.nuget.org/v3/index.json
6490
6591
# This job runs on merging to "main" branch
6692
# Creates a new tag using the value in the VERSION file

‎sdks/java-v1/.github/workflows/close-and-release-repository.yml‎

Lines changed: 26 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,13 @@ on:
88

99
jobs:
1010
closeAndReleaseRepository:
11+
if: >-
12+
github.repository == 'hellosign/dropbox-sign-java'
13+
&& github.ref == 'refs/heads/v1'
1114
runs-on: ubuntu-latest
15+
permissions:
16+
id-token: write
17+
contents: read
1218
steps:
1319
- name: Checkout
1420
uses: actions/checkout@v3
@@ -19,10 +25,26 @@ jobs:
1925
distribution: 'zulu'
2026
java-version: 11
2127

28+
- name: Configure AWS credentials for Maven secrets (OIDC)
29+
uses: aws-actions/configure-aws-credentials@v6
30+
with:
31+
role-to-assume: arn:aws:iam::521590706193:role/oidc-github-hellosign-dropbox-sign-java-branch-v1
32+
aws-region: us-west-2
33+
34+
- name: Get Maven Central secrets from AWS Secrets Manager
35+
uses: aws-actions/aws-secretsmanager-get-secrets@v3
36+
with:
37+
secret-ids: |
38+
SONATYPE_USERNAME,sdk-release-maven-central-token-username
39+
SONATYPE_PASSWORD,sdk-release-maven-central-token-password
40+
SIGNING_KEY,sdk-release-signing-key
41+
SIGNING_PASSWORD,sdk-release-signing-password
42+
parse-json-secrets: false
43+
2244
- name: Publish Release to Maven Central
2345
run: ./gradlew publishAndReleaseToMavenCentral --no-daemon --no-parallel --no-configuration-cache --stacktrace
2446
env:
25-
ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.SONATYPE_USERNAME }}
26-
ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.SONATYPE_PASSWORD }}
27-
ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.SIGNING_KEY }}
28-
ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.SIGNING_PASSWORD }}
47+
ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ env.SONATYPE_USERNAME }}
48+
ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ env.SONATYPE_PASSWORD }}
49+
ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ env.SIGNING_KEY }}
50+
ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ env.SIGNING_PASSWORD }}

‎sdks/java-v1/.github/workflows/github-actions.yml‎

Lines changed: 47 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
# This workflow will build the project, run integration tests, and release.
2-
# Because secrets are not available on external forks, this job is expected to fail
3-
# on external pull requests.
2+
# Secret-backed jobs fetch credentials from AWS Secrets Manager using GitHub OIDC.
43

54
name: Build, Check, Publish
65

@@ -15,15 +14,31 @@ on:
1514
jobs:
1615
build:
1716
runs-on: ubuntu-latest
17+
permissions:
18+
id-token: write
19+
contents: read
1820
steps:
1921
- name: Checkout Repo
2022
uses: actions/checkout@v3
2123

24+
- name: Configure AWS credentials for Docker Hub secrets (OIDC)
25+
if: github.event_name != 'pull_request'
26+
uses: aws-actions/configure-aws-credentials@v6
27+
with:
28+
role-to-assume: arn:aws:iam::301904545275:role/oidc-github-hellosign-dropbox-sign-java-branch-v1
29+
aws-region: us-west-2
30+
31+
- name: Get Docker Hub secrets from AWS Secrets Manager
32+
if: github.event_name != 'pull_request'
33+
uses: aws-actions/aws-secretsmanager-get-secrets@v3
34+
with:
35+
secret-ids: |
36+
DOCKER_USERNAME,github-actions/hellosign/shared/docker-username
37+
DOCKER_TOKEN,github-actions/hellosign/shared/docker-token
38+
parse-json-secrets: false
39+
2240
- name: Build SDK
2341
run: ./run-build
24-
env:
25-
DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
26-
DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
2742

2843
- name: Ensure no changes in Generated Code
2944
run: ./bin/check-clean-git-status
@@ -37,6 +52,9 @@ jobs:
3752
&& github.ref == 'refs/heads/v1'
3853
&& github.event_name != 'pull_request'
3954
needs: [ build ]
55+
permissions:
56+
id-token: write
57+
contents: read
4058
steps:
4159
- name: Checkout
4260
uses: actions/checkout@v3
@@ -50,23 +68,39 @@ jobs:
5068
- name: Retrieve version
5169
run: echo "PACKAGE_VERSION=$(cat VERSION)" >> $GITHUB_ENV
5270

71+
- name: Configure AWS credentials for Maven secrets (OIDC)
72+
uses: aws-actions/configure-aws-credentials@v6
73+
with:
74+
role-to-assume: arn:aws:iam::521590706193:role/oidc-github-hellosign-dropbox-sign-java-branch-v1
75+
aws-region: us-west-2
76+
77+
- name: Get Maven Central secrets from AWS Secrets Manager
78+
uses: aws-actions/aws-secretsmanager-get-secrets@v3
79+
with:
80+
secret-ids: |
81+
SONATYPE_USERNAME,sdk-release-maven-central-token-username
82+
SONATYPE_PASSWORD,sdk-release-maven-central-token-password
83+
SIGNING_KEY,sdk-release-signing-key
84+
SIGNING_PASSWORD,sdk-release-signing-password
85+
parse-json-secrets: false
86+
5387
- name: Publish to Maven Central
5488
run: ./gradlew publishAndReleaseToMavenCentral --no-daemon --no-parallel --no-configuration-cache --stacktrace
5589
if: "!endsWith(env.PACKAGE_VERSION, '-SNAPSHOT')"
5690
env:
57-
ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.SONATYPE_USERNAME }}
58-
ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.SONATYPE_PASSWORD }}
59-
ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.SIGNING_KEY }}
60-
ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.SIGNING_PASSWORD }}
91+
ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ env.SONATYPE_USERNAME }}
92+
ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ env.SONATYPE_PASSWORD }}
93+
ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ env.SIGNING_KEY }}
94+
ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ env.SIGNING_PASSWORD }}
6195

6296
- name: Publish Snapshot
6397
run: ./gradlew publishToMavenCentral --no-daemon --no-parallel --no-configuration-cache --stacktrace
6498
if: "endsWith(env.PACKAGE_VERSION, '-SNAPSHOT')"
6599
env:
66-
ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.SONATYPE_USERNAME }}
67-
ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.SONATYPE_PASSWORD }}
68-
ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.SIGNING_KEY }}
69-
ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.SIGNING_PASSWORD }}
100+
ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ env.SONATYPE_USERNAME }}
101+
ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ env.SONATYPE_PASSWORD }}
102+
ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ env.SIGNING_KEY }}
103+
ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ env.SIGNING_PASSWORD }}
70104

71105
# This job runs on merging to "v1" branch
72106
# Creates a new tag using the value in the VERSION file

‎sdks/java-v2/.github/workflows/close-and-release-repository.yml‎

Lines changed: 26 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,13 @@ on:
88

99
jobs:
1010
closeAndReleaseRepository:
11+
if: >-
12+
github.repository == 'hellosign/dropbox-sign-java'
13+
&& github.ref == 'refs/heads/main'
1114
runs-on: ubuntu-latest
15+
permissions:
16+
id-token: write
17+
contents: read
1218
steps:
1319
- name: Checkout
1420
uses: actions/checkout@v3
@@ -19,10 +25,26 @@ jobs:
1925
distribution: 'zulu'
2026
java-version: 11
2127

28+
- name: Configure AWS credentials for Maven secrets (OIDC)
29+
uses: aws-actions/configure-aws-credentials@v6
30+
with:
31+
role-to-assume: arn:aws:iam::521590706193:role/oidc-github-hellosign-dropbox-sign-java-branch-main
32+
aws-region: us-west-2
33+
34+
- name: Get Maven Central secrets from AWS Secrets Manager
35+
uses: aws-actions/aws-secretsmanager-get-secrets@v3
36+
with:
37+
secret-ids: |
38+
SONATYPE_USERNAME,sdk-release-maven-central-token-username
39+
SONATYPE_PASSWORD,sdk-release-maven-central-token-password
40+
SIGNING_KEY,sdk-release-signing-key
41+
SIGNING_PASSWORD,sdk-release-signing-password
42+
parse-json-secrets: false
43+
2244
- name: Publish Release to Maven Central
2345
run: ./gradlew publishAndReleaseToMavenCentral --no-daemon --no-parallel --no-configuration-cache --stacktrace
2446
env:
25-
ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.SONATYPE_USERNAME }}
26-
ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.SONATYPE_PASSWORD }}
27-
ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.SIGNING_KEY }}
28-
ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.SIGNING_PASSWORD }}
47+
ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ env.SONATYPE_USERNAME }}
48+
ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ env.SONATYPE_PASSWORD }}
49+
ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ env.SIGNING_KEY }}
50+
ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ env.SIGNING_PASSWORD }}

‎sdks/java-v2/.github/workflows/github-actions.yml‎

Lines changed: 47 additions & 13 deletions
Original file line numberDiff line numberDiff line change
@@ -1,6 +1,5 @@
11
# This workflow will build the project, run integration tests, and release.
2-
# Because secrets are not available on external forks, this job is expected to fail
3-
# on external pull requests.
2+
# Secret-backed jobs fetch credentials from AWS Secrets Manager using GitHub OIDC.
43

54
name: Build, Check, Publish
65

@@ -15,15 +14,31 @@ on:
1514
jobs:
1615
build:
1716
runs-on: ubuntu-latest
17+
permissions:
18+
id-token: write
19+
contents: read
1820
steps:
1921
- name: Checkout Repo
2022
uses: actions/checkout@v3
2123

24+
- name: Configure AWS credentials for Docker Hub secrets (OIDC)
25+
if: github.event_name != 'pull_request'
26+
uses: aws-actions/configure-aws-credentials@v6
27+
with:
28+
role-to-assume: arn:aws:iam::301904545275:role/oidc-github-hellosign-dropbox-sign-java-branch-main
29+
aws-region: us-west-2
30+
31+
- name: Get Docker Hub secrets from AWS Secrets Manager
32+
if: github.event_name != 'pull_request'
33+
uses: aws-actions/aws-secretsmanager-get-secrets@v3
34+
with:
35+
secret-ids: |
36+
DOCKER_USERNAME,github-actions/hellosign/shared/docker-username
37+
DOCKER_TOKEN,github-actions/hellosign/shared/docker-token
38+
parse-json-secrets: false
39+
2240
- name: Build SDK
2341
run: ./run-build
24-
env:
25-
DOCKER_USERNAME: ${{secrets.DOCKER_USERNAME}}
26-
DOCKER_TOKEN: ${{secrets.DOCKER_TOKEN}}
2742

2843
- name: Ensure no changes in Generated Code
2944
run: ./bin/check-clean-git-status
@@ -37,6 +52,9 @@ jobs:
3752
&& github.ref == 'refs/heads/main'
3853
&& github.event_name != 'pull_request'
3954
needs: [ build ]
55+
permissions:
56+
id-token: write
57+
contents: read
4058
steps:
4159
- name: Checkout
4260
uses: actions/checkout@v3
@@ -50,23 +68,39 @@ jobs:
5068
- name: Retrieve version
5169
run: echo "PACKAGE_VERSION=$(cat VERSION)" >> $GITHUB_ENV
5270

71+
- name: Configure AWS credentials for Maven secrets (OIDC)
72+
uses: aws-actions/configure-aws-credentials@v6
73+
with:
74+
role-to-assume: arn:aws:iam::521590706193:role/oidc-github-hellosign-dropbox-sign-java-branch-main
75+
aws-region: us-west-2
76+
77+
- name: Get Maven Central secrets from AWS Secrets Manager
78+
uses: aws-actions/aws-secretsmanager-get-secrets@v3
79+
with:
80+
secret-ids: |
81+
SONATYPE_USERNAME,sdk-release-maven-central-token-username
82+
SONATYPE_PASSWORD,sdk-release-maven-central-token-password
83+
SIGNING_KEY,sdk-release-signing-key
84+
SIGNING_PASSWORD,sdk-release-signing-password
85+
parse-json-secrets: false
86+
5387
- name: Publish to Maven Central
5488
run: ./gradlew publishAndReleaseToMavenCentral --no-daemon --no-parallel --no-configuration-cache --stacktrace
5589
if: "!endsWith(env.PACKAGE_VERSION, '-SNAPSHOT')"
5690
env:
57-
ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.SONATYPE_USERNAME }}
58-
ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.SONATYPE_PASSWORD }}
59-
ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.SIGNING_KEY }}
60-
ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.SIGNING_PASSWORD }}
91+
ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ env.SONATYPE_USERNAME }}
92+
ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ env.SONATYPE_PASSWORD }}
93+
ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ env.SIGNING_KEY }}
94+
ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ env.SIGNING_PASSWORD }}
6195

6296
- name: Publish Snapshot
6397
run: ./gradlew publishToMavenCentral --no-daemon --no-parallel --no-configuration-cache --stacktrace
6498
if: "endsWith(env.PACKAGE_VERSION, '-SNAPSHOT')"
6599
env:
66-
ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.SONATYPE_USERNAME }}
67-
ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.SONATYPE_PASSWORD }}
68-
ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.SIGNING_KEY }}
69-
ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.SIGNING_PASSWORD }}
100+
ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ env.SONATYPE_USERNAME }}
101+
ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ env.SONATYPE_PASSWORD }}
102+
ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ env.SIGNING_KEY }}
103+
ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ env.SIGNING_PASSWORD }}
70104

71105
# This job runs on merging to "main" branch
72106
# Creates a new tag using the value in the VERSION file

0 commit comments

Comments
 (0)