refactor(release): reusable CI actions and review hardening

Fabiana Severin · Fabiana Severin · commit f00150c1ef60 · 2026-07-28T18:13:49.000+01:00
- Extract resolve-release-version and configure-release-aws-credentials composite actions shared by both release workflows
- Fetch signing key + Sonatype token inside the publish step so secrets never cross $GITHUB_ENV; scrub settings.xml and keyring on exit
- Guard releases to the main branch; cut OIDC role session to 300s
- Set RIC to 2.12.0-SNAPSHOT so the release pipeline can publish it
diff --git a/.github/actions/configure-release-aws-credentials/action.yml b/.github/actions/configure-release-aws-credentials/action.yml
@@ -0,0 +1,27 @@
+name: "Configure AWS credentials for release (OIDC)"
+description: >
+  Assumes the release OIDC role via aws-actions/configure-aws-credentials so the
+  job can read the signing key and Sonatype token from Secrets Manager. Pinning
+  of the underlying action lives here so it is updated in one place.
+
+inputs:
+  aws-region:
+    description: "AWS region to operate in."
+    required: true
+  role-to-assume:
+    description: "ARN of the OIDC role to assume."
+    required: true
+  role-session-name:
+    description: "Session name for the assumed role (helps distinguish callers in CloudTrail)."
+    required: true
+
+runs:
+  using: composite
+  steps:
+    - uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
+      with:
+        aws-region: ${{ inputs.aws-region }}
+        role-to-assume: ${{ inputs.role-to-assume }}
+        role-session-name: ${{ inputs.role-session-name }}
+        # Short-lived: the job only needs the role briefly to read two secrets.
+        role-duration-seconds: 300
diff --git a/.github/actions/resolve-release-version/action.yml b/.github/actions/resolve-release-version/action.yml
@@ -0,0 +1,54 @@
+name: "Resolve and validate release version"
+description: >
+  Reads the module POM version (the source of truth), verifies it is a
+  -SNAPSHOT, and derives the effective release version (the optional override,
+  or the POM version with -SNAPSHOT stripped). Exports CURRENT_VERSION and
+  EFFECTIVE_RELEASE_VERSION to the job environment for subsequent steps.
+
+inputs:
+  module:
+    description: "Module directory containing the pom.xml to release."
+    required: true
+  release-version-override:
+    description: "Optional release version; defaults to the POM version without -SNAPSHOT."
+    required: false
+    default: ""
+  validate-module-dir:
+    description: "Fail if the module directory or its pom.xml is missing (use for the choice-driven workflow)."
+    required: false
+    default: "false"
+
+runs:
+  using: composite
+  steps:
+    - name: Resolve and validate release version
+      shell: bash
+      env:
+        MODULE: ${{ inputs.module }}
+        RELEASE_VERSION_OVERRIDE: ${{ inputs.release-version-override }}
+        VALIDATE_MODULE_DIR: ${{ inputs.validate-module-dir }}
+      run: |
+        if [[ "$VALIDATE_MODULE_DIR" == "true" ]]; then
+          if [[ ! -d "$MODULE" ]]; then
+            echo "::error::Module directory '$MODULE' does not exist"
+            exit 1
+          fi
+          if [[ ! -f "$MODULE/pom.xml" ]]; then
+            echo "::error::No pom.xml found in '$MODULE'"
+            exit 1
+          fi
+        fi
+
+        # The POM version is the source of truth and must be a SNAPSHOT.
+        CURRENT_VERSION=$(mvn -q -DforceStdout help:evaluate -Dexpression=project.version --file "$MODULE/pom.xml")
+        CURRENT_VERSION="${CURRENT_VERSION//[$'\r\n']/}"
+        if [[ "$CURRENT_VERSION" != *-SNAPSHOT ]]; then
+          echo "::error::POM version '$CURRENT_VERSION' is not a SNAPSHOT"
+          exit 1
+        fi
+
+        # Optional override; default strips -SNAPSHOT.
+        EFFECTIVE_RELEASE_VERSION="${RELEASE_VERSION_OVERRIDE:-${CURRENT_VERSION%-SNAPSHOT}}"
+
+        echo "CURRENT_VERSION=$CURRENT_VERSION" >> "$GITHUB_ENV"
+        echo "EFFECTIVE_RELEASE_VERSION=$EFFECTIVE_RELEASE_VERSION" >> "$GITHUB_ENV"
diff --git a/.github/workflows/release-runtime-interface-client.yml b/.github/workflows/release-runtime-interface-client.yml
@@ -57,6 +57,16 @@ jobs:
     runs-on: ${{ matrix.runner }}
     timeout-minutes: 45
     steps:
+      # Manual (workflow_dispatch) releases must only run from main, never from
+      # an arbitrary branch that could carry unreviewed release logic. Guarding
+      # the first job blocks the whole pipeline (release needs build-natives).
+      - name: Verify release branch
+        run: |
+          if [[ "$GITHUB_REF_NAME" != "main" ]]; then
+            echo "::error::Releases must run from the main branch, got '$GITHUB_REF_NAME'"
+            exit 1
+          fi
+
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
 
       - name: Set up JDK 8
@@ -66,15 +76,11 @@ jobs:
           distribution: corretto
           cache: maven
 
-      - name: Resolve release version
-        run: |
-          CURRENT_VERSION=$(mvn -q -DforceStdout help:evaluate -Dexpression=project.version --file "$MODULE/pom.xml")
-          CURRENT_VERSION="${CURRENT_VERSION//[$'\r\n']/}"
-          if [[ "$CURRENT_VERSION" != *-SNAPSHOT ]]; then
-            echo "::error::POM version '$CURRENT_VERSION' is not a SNAPSHOT"
-            exit 1
-          fi
-          echo "EFFECTIVE_RELEASE_VERSION=${RELEASE_VERSION_INPUT:-${CURRENT_VERSION%-SNAPSHOT}}" >> "$GITHUB_ENV"
+      - name: Resolve and validate release version
+        uses: ./.github/actions/resolve-release-version
+        with:
+          module: ${{ env.MODULE }}
+          release-version-override: ${{ env.RELEASE_VERSION_INPUT }}
 
       # -DskipTests: only installed so the module compiles, not released here.
       - name: Install intra-repo dependencies
@@ -124,17 +130,14 @@ jobs:
           distribution: corretto
           cache: maven
 
-      - name: Validate inputs and resolve versions
-        run: |
-          CURRENT_VERSION=$(mvn -q -DforceStdout help:evaluate -Dexpression=project.version --file "$MODULE/pom.xml")
-          CURRENT_VERSION="${CURRENT_VERSION//[$'\r\n']/}"
-          if [[ "$CURRENT_VERSION" != *-SNAPSHOT ]]; then
-            echo "::error::POM version '$CURRENT_VERSION' is not a SNAPSHOT"
-            exit 1
-          fi
-
-          EFFECTIVE_RELEASE_VERSION="${RELEASE_VERSION_INPUT:-${CURRENT_VERSION%-SNAPSHOT}}"
+      - name: Resolve and validate release version
+        uses: ./.github/actions/resolve-release-version
+        with:
+          module: ${{ env.MODULE }}
+          release-version-override: ${{ env.RELEASE_VERSION_INPUT }}
 
+      - name: Resolve next development version and tag
+        run: |
           # Next development version: use the override, or bump the patch.
           if [[ -n "$DEVELOPMENT_VERSION_INPUT" ]]; then
             if [[ "$DEVELOPMENT_VERSION_INPUT" != *-SNAPSHOT ]]; then
@@ -147,7 +150,6 @@ jobs:
             NEXT_DEV_VERSION="${MA}.${MI}.$((PA + 1))-SNAPSHOT"
           fi
 
-          echo "EFFECTIVE_RELEASE_VERSION=$EFFECTIVE_RELEASE_VERSION" >> "$GITHUB_ENV"
           echo "NEXT_DEV_VERSION=$NEXT_DEV_VERSION" >> "$GITHUB_ENV"
           echo "TAG_NAME=${MODULE}-${EFFECTIVE_RELEASE_VERSION}" >> "$GITHUB_ENV"
           echo "::notice::Releasing $MODULE $EFFECTIVE_RELEASE_VERSION (next dev $NEXT_DEV_VERSION)"
@@ -190,20 +192,32 @@ jobs:
 
       - name: Configure AWS credentials (OIDC)
         if: ${{ github.event.inputs.skip_publish != 'true' }}
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
+        uses: ./.github/actions/configure-release-aws-credentials
         with:
           aws-region: ${{ env.AWS_REGION }}
           role-to-assume: ${{ env.OIDC_ROLE_ARN }}
           role-session-name: GitHubActionsRicMavenCentralRelease
-          role-duration-seconds: 3600
 
-      - name: Fetch signing key and Sonatype credentials
+      # Fetch signing material and publish in a single step so the GPG passphrase
+      # and Sonatype token stay in this shell and never cross a $GITHUB_ENV
+      # boundary, where a later (possibly compromised) step could read them.
+      # -DmultiArch=false builds only the host .so; the aarch_64 .so is already
+      # staged, so the main JAR still bundles all four. build-helper attaches
+      # the staged classifier JARs. Gate already ran, so -DskipTests.
+      - name: Publish to Maven Central
         if: ${{ github.event.inputs.skip_publish != 'true' }}
+        env:
+          IS_JAVA_8: true
         run: |
-          # Shared secrets from LambdaMavenDeploy; nothing stored in GitHub.
+          # Scrub the settings.xml (contains the Sonatype token) and the keyring
+          # on exit, so no sensitive file is left on the runner even on failure.
+          MAVEN_SETTINGS="$RUNNER_TEMP/settings.xml"
+          export GNUPGHOME=$(mktemp -d)
+          trap 'rm -rf "$MAVEN_SETTINGS" "$GNUPGHOME"' EXIT
+
+          # --- Signing key + Sonatype token (shared secrets from LambdaMavenDeploy) ---
           GPG_JSON=$(aws secretsmanager get-secret-value --secret-id maven.gpg.keys --query SecretString --output text)
           CREDS_JSON=$(aws secretsmanager get-secret-value --secret-id maven.sonatype.creds --query SecretString --output text)
-
           GPG_PRIVATE_KEY=$(jq -r '.private' <<< "$GPG_JSON")
           GPG_PASSPHRASE=$(jq -r '.passphrase' <<< "$GPG_JSON")
           SONATYPE_USERNAME=$(jq -r '."maven-central-login"' <<< "$CREDS_JSON")
@@ -213,38 +227,23 @@ jobs:
           echo "::add-mask::$SONATYPE_PASSWORD"
 
           # Import the key with loopback pinentry so Maven can sign non-interactively.
-          GNUPGHOME=$(mktemp -d)
           chmod 700 "$GNUPGHOME"
           echo "allow-loopback-pinentry" > "$GNUPGHOME/gpg-agent.conf"
           echo "pinentry-mode loopback" > "$GNUPGHOME/gpg.conf"
-          export GNUPGHOME
           gpgconf --kill gpg-agent || true
           gpg --batch --import <<< "$GPG_PRIVATE_KEY"
           GPG_KEYNAME=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec:/ {print $5; exit}')
 
           # settings.xml with the Sonatype token (server id "central").
-          SETTINGS="$RUNNER_TEMP/settings.xml"
           {
             echo '<settings><servers><server>'
             echo "<id>central</id>"
             echo "<username>${SONATYPE_USERNAME}</username>"
             echo "<password>${SONATYPE_PASSWORD}</password>"
             echo '</server></servers></settings>'
-          } > "$SETTINGS"
+          } > "$MAVEN_SETTINGS"
 
-          echo "GNUPGHOME=$GNUPGHOME" >> "$GITHUB_ENV"
-          echo "GPG_KEYNAME=$GPG_KEYNAME" >> "$GITHUB_ENV"
-          echo "GPG_PASSPHRASE=$GPG_PASSPHRASE" >> "$GITHUB_ENV"
-          echo "MAVEN_SETTINGS=$SETTINGS" >> "$GITHUB_ENV"
-
-      # -DmultiArch=false builds only the host .so; the aarch_64 .so is already
-      # staged, so the main JAR still bundles all four. build-helper attaches
-      # the staged classifier JARs. Gate already ran, so -DskipTests.
-      - name: Publish to Maven Central
-        if: ${{ github.event.inputs.skip_publish != 'true' }}
-        env:
-          IS_JAVA_8: true
-        run: |
+          # --- Publish ---
           mvn deploy -Prelease -DskipTests -DmultiArch=false \
             -s "$MAVEN_SETTINGS" \
             -Dgpg.keyname="$GPG_KEYNAME" -Dgpg.passphrase="$GPG_PASSPHRASE" \
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
@@ -59,6 +59,15 @@ jobs:
     timeout-minutes: 30
 
     steps:
+      # Manual (workflow_dispatch) releases must only run from main, never from
+      # an arbitrary branch that could carry unreviewed release logic.
+      - name: Verify release branch
+        run: |
+          if [[ "$GITHUB_REF_NAME" != "main" ]]; then
+            echo "::error::Releases must run from the main branch, got '$GITHUB_REF_NAME'"
+            exit 1
+          fi
+
       - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6
         with:
           fetch-depth: 0   # full history for tagging/pushing
@@ -71,41 +80,19 @@ jobs:
           distribution: corretto
           cache: maven
 
-      - name: Validate inputs and resolve versions
-        run: |
-          if [[ ! -d "$MODULE" ]]; then
-            echo "::error::Module directory '$MODULE' does not exist"
-            exit 1
-          fi
-          if [[ ! -f "$MODULE/pom.xml" ]]; then
-            echo "::error::No pom.xml found in '$MODULE'"
-            exit 1
-          fi
-
-          # The POM version is the source of truth and must be a SNAPSHOT.
-          CURRENT_VERSION=$(mvn -q -DforceStdout help:evaluate -Dexpression=project.version --file "$MODULE/pom.xml")
-          CURRENT_VERSION="${CURRENT_VERSION//[$'\r\n']/}"
-          if [[ "$CURRENT_VERSION" != *-SNAPSHOT ]]; then
-            echo "::error::POM version '$CURRENT_VERSION' is not a SNAPSHOT"
-            exit 1
-          fi
-
-          # releaseVersion input is an optional override; default strips -SNAPSHOT.
-          EFFECTIVE_RELEASE_VERSION="${RELEASE_VERSION_INPUT:-${CURRENT_VERSION%-SNAPSHOT}}"
+      - name: Resolve and validate release version
+        uses: ./.github/actions/resolve-release-version
+        with:
+          module: ${{ env.MODULE }}
+          release-version-override: ${{ env.RELEASE_VERSION_INPUT }}
+          validate-module-dir: "true"
 
+      - name: Validate development version override
+        run: |
           if [[ -n "$DEVELOPMENT_VERSION_INPUT" && "$DEVELOPMENT_VERSION_INPUT" != *-SNAPSHOT ]]; then
             echo "::error::developmentVersion '$DEVELOPMENT_VERSION_INPUT' must end with -SNAPSHOT"
             exit 1
           fi
-
-          # Build the release plugin version args once; reused by both paths.
-          RELEASE_ARGS="-DreleaseVersion=$EFFECTIVE_RELEASE_VERSION"
-          if [[ -n "$DEVELOPMENT_VERSION_INPUT" ]]; then
-            RELEASE_ARGS="$RELEASE_ARGS -DdevelopmentVersion=$DEVELOPMENT_VERSION_INPUT"
-          fi
-
-          echo "EFFECTIVE_RELEASE_VERSION=$EFFECTIVE_RELEASE_VERSION" >> "$GITHUB_ENV"
-          echo "RELEASE_ARGS=$RELEASE_ARGS" >> "$GITHUB_ENV"
           echo "::notice::Releasing $MODULE $EFFECTIVE_RELEASE_VERSION (POM currently $CURRENT_VERSION)"
 
       - name: Configure git user
@@ -141,20 +128,28 @@ jobs:
 
       - name: Configure AWS credentials (OIDC)
         if: ${{ github.event.inputs.skip_publish != 'true' }}
-        uses: aws-actions/configure-aws-credentials@7474bc4690e29a8392af63c5b98e7449536d5c3a # v4
+        uses: ./.github/actions/configure-release-aws-credentials
         with:
           aws-region: ${{ env.AWS_REGION }}
           role-to-assume: ${{ env.OIDC_ROLE_ARN }}
           role-session-name: GitHubActionsMavenCentralRelease
-          role-duration-seconds: 3600
 
-      - name: Fetch signing key and Sonatype credentials
+      # Fetch signing material and publish in a single step so the GPG passphrase
+      # and Sonatype token stay in this shell and never cross a $GITHUB_ENV
+      # boundary, where a later (possibly compromised) step could read them.
+      # prepare/perform aren't atomic: prepare locally, publish, push only after.
+      - name: Release (prepare locally, publish, then push)
         if: ${{ github.event.inputs.skip_publish != 'true' }}
         run: |
-          # Shared secrets from LambdaMavenDeploy; nothing stored in GitHub.
+          # Scrub the settings.xml (contains the Sonatype token) and the keyring
+          # on exit, so no sensitive file is left on the runner even on failure.
+          MAVEN_SETTINGS="$RUNNER_TEMP/settings.xml"
+          export GNUPGHOME=$(mktemp -d)
+          trap 'rm -rf "$MAVEN_SETTINGS" "$GNUPGHOME"' EXIT
+
+          # --- Signing key + Sonatype token (shared secrets from LambdaMavenDeploy) ---
           GPG_JSON=$(aws secretsmanager get-secret-value --secret-id maven.gpg.keys --query SecretString --output text)
           CREDS_JSON=$(aws secretsmanager get-secret-value --secret-id maven.sonatype.creds --query SecretString --output text)
-
           GPG_PRIVATE_KEY=$(jq -r '.private' <<< "$GPG_JSON")
           GPG_PASSPHRASE=$(jq -r '.passphrase' <<< "$GPG_JSON")
           SONATYPE_USERNAME=$(jq -r '."maven-central-login"' <<< "$CREDS_JSON")
@@ -164,37 +159,31 @@ jobs:
           echo "::add-mask::$SONATYPE_PASSWORD"
 
           # Import the key with loopback pinentry so Maven can sign non-interactively.
-          GNUPGHOME=$(mktemp -d)
           chmod 700 "$GNUPGHOME"
           echo "allow-loopback-pinentry" > "$GNUPGHOME/gpg-agent.conf"
           echo "pinentry-mode loopback" > "$GNUPGHOME/gpg.conf"
-          export GNUPGHOME
           gpgconf --kill gpg-agent || true
           gpg --batch --import <<< "$GPG_PRIVATE_KEY"
           GPG_KEYNAME=$(gpg --list-secret-keys --with-colons | awk -F: '/^sec:/ {print $5; exit}')
 
           # settings.xml with the Sonatype token (server id "central").
-          SETTINGS="$RUNNER_TEMP/settings.xml"
           {
             echo '<settings><servers><server>'
             echo "<id>central</id>"
             echo "<username>${SONATYPE_USERNAME}</username>"
             echo "<password>${SONATYPE_PASSWORD}</password>"
             echo '</server></servers></settings>'
-          } > "$SETTINGS"
+          } > "$MAVEN_SETTINGS"
 
-          # Pass to later steps (values already masked).
-          echo "GNUPGHOME=$GNUPGHOME" >> "$GITHUB_ENV"
-          echo "GPG_KEYNAME=$GPG_KEYNAME" >> "$GITHUB_ENV"
-          echo "GPG_PASSPHRASE=$GPG_PASSPHRASE" >> "$GITHUB_ENV"
-          echo "MAVEN_SETTINGS=$SETTINGS" >> "$GITHUB_ENV"
+          # --- Release: build args as an array so each value is a single,
+          # properly quoted argument (no word-splitting of untrusted input). ---
+          RELEASE_ARGS=(-DreleaseVersion="$EFFECTIVE_RELEASE_VERSION")
+          if [[ -n "$DEVELOPMENT_VERSION_INPUT" ]]; then
+            RELEASE_ARGS+=(-DdevelopmentVersion="$DEVELOPMENT_VERSION_INPUT")
+          fi
 
-      # prepare/perform aren't atomic: prepare locally, publish, push only after.
-      - name: Release (prepare locally, publish, then push)
-        if: ${{ github.event.inputs.skip_publish != 'true' }}
-        run: |
           # Prepare locally (no push): release commits + tag.
-          mvn release:prepare -DpushChanges=false $RELEASE_ARGS --file "$MODULE/pom.xml"
+          mvn release:prepare -DpushChanges=false "${RELEASE_ARGS[@]}" --file "$MODULE/pom.xml"
 
           # perform forks a fresh build, so pass settings/gpg via -Darguments.
           mvn release:perform -DlocalCheckout=true \
@@ -209,7 +198,11 @@ jobs:
       - name: Dry-run release (prepare only, no publish)
         if: ${{ github.event.inputs.skip_publish == 'true' }}
         run: |
-          mvn release:prepare -DdryRun=true $RELEASE_ARGS --file "$MODULE/pom.xml"
+          RELEASE_ARGS=(-DreleaseVersion="$EFFECTIVE_RELEASE_VERSION")
+          if [[ -n "$DEVELOPMENT_VERSION_INPUT" ]]; then
+            RELEASE_ARGS+=(-DdevelopmentVersion="$DEVELOPMENT_VERSION_INPUT")
+          fi
+          mvn release:prepare -DdryRun=true "${RELEASE_ARGS[@]}" --file "$MODULE/pom.xml"
           mvn release:clean --file "$MODULE/pom.xml" || true
 
       # Nothing was pushed, so this only cleans the runner for a retry.
diff --git a/aws-lambda-java-runtime-interface-client/pom.xml b/aws-lambda-java-runtime-interface-client/pom.xml
