chore: harden GitHub Actions for platform compliance

.github/dependabot.yml

@@ -0,0 +1,10 @@
+version: 2
+updates:
+  - package-ecosystem: "github-actions"
+    directory: "/"
+    schedule:
+      interval: "weekly"
+  - package-ecosystem: "maven"
+    directory: "/"
+    schedule:
+      interval: "weekly"

.github/workflows/pr-lint.yml

@@ -3,13 +3,22 @@ on:
   pull_request_target:
     types: [ opened, edited, synchronize, reopened ]
 
+permissions:
+  contents: read
+  pull-requests: read
+
 jobs:
   validate:
     name: Validate title
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-x64
     steps:
-      - uses: amannn/action-semantic-pull-request@v4
+      - uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+      - uses: twilio/sdk-actions/semantic-pr-title@09631bfa50f14d276170d45bc4f49a80da201cc6 # main @ 09631bf — sdk-actions#10; repin to the v1.1.0 tag once cut
         with:
-          types: chore docs fix feat test misc
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          types: |
+            chore
+            docs
+            fix
+            feat
+            misc
+            test

.github/workflows/test-and-deploy.yml

@@ -13,23 +13,27 @@ on:
 jobs:
   test:
     name: Test
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-x64
+    if: github.repository_owner == 'sendgrid'
     timeout-minutes: 20
+    permissions:
+      contents: read
     strategy:
       matrix:
         java: [ 8, 11 ]
     env:
       DOCKER_LOGIN: ${{ secrets.DOCKER_USERNAME && secrets.DOCKER_AUTH_TOKEN }}
     steps:
       - name: Checkout sendgrid-java
-        uses: actions/checkout@v2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
 
+      # Plain CLI login: docker/login-action is not on this org's action allowlist.
       - name: Login to Docker Hub
         if: env.DOCKER_LOGIN
-        uses: docker/login-action@v1
-        with:
-          username: ${{ secrets.DOCKER_USERNAME }}
-          password: ${{ secrets.DOCKER_AUTH_TOKEN }}
+        env:
+          DOCKER_USERNAME: ${{ secrets.DOCKER_USERNAME }}
+          DOCKER_AUTH_TOKEN: ${{ secrets.DOCKER_AUTH_TOKEN }}
+        run: echo "$DOCKER_AUTH_TOKEN" | docker login -u "$DOCKER_USERNAME" --password-stdin
 
       - name: Install Docker Compose
         run: |
@@ -41,17 +45,22 @@ jobs:
 
   deploy:
     name: Deploy
-    if: success() && github.ref_type == 'tag'
+    if: success() && github.ref_type == 'tag' && github.repository_owner == 'sendgrid'
     needs: [ test ]
-    runs-on: ubuntu-latest
+    runs-on: ubuntu-x64
+    permissions:
+      contents: write
     steps:
       - name: Checkout sendgrid-java
-        uses: actions/checkout@v2
+        uses: actions/checkout@08c6903cd8c0fde910a37f88322edcfb5dd907a8 # v5.0.0
+        with:
+          # The release action verifies refs/tags/<tag> in the local clone.
+          fetch-depth: 0
 
       - name: Set up Sonatype Maven
-        uses: actions/setup-java@v2
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
         with:
-          java-version: 8
+          java-version: '8'
           distribution: temurin
           server-id: central
           server-username: MAVEN_USERNAME
@@ -63,12 +72,11 @@ jobs:
         run: make install
 
       - name: Create GitHub Release
-        uses: sendgrid/dx-automator/actions/release@main
+        uses: twilio/sdk-actions/github-release@9b1c3222c9ffe38aadedb11c5b9f5a172b5e9951 # v1
         with:
           assets: sendgrid-java.jar
-          footer: '**[Maven](https://mvnrepository.com/artifact/com.sendgrid/sendgrid-java/${version})**'
-        env:
-          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          changelog-file: CHANGELOG.md
+          footer: '**[Maven](https://mvnrepository.com/artifact/com.sendgrid/sendgrid-java/${{ github.ref_name }})**'
 
       - name: Publish to Maven
         env:
@@ -77,25 +85,25 @@ jobs:
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
         run: mvn clean deploy -DskipTests=true -B -U -Prelease
 
-      - name: Submit metric to Datadog
-        uses: sendgrid/dx-automator/actions/datadog-release-metric@main
-        env:
-          DD_API_KEY: ${{ secrets.DATADOG_API_KEY }}
+#      - name: Submit metric to Datadog
+#        uses: sendgrid/dx-automator/actions/datadog-release-metric@08b601b726671445abc798ed59881766ec8fefc6 # main
+#        env:
+#          DD_API_KEY: ${{ secrets.DATADOG_API_KEY }}
 
-  notify-on-failure:
-    name: Slack notify on failure
-    if: failure() && github.event_name != 'pull_request' && (github.ref == 'refs/heads/main' || github.ref_type == 'tag')
-    needs: [ test, deploy ]
-    runs-on: ubuntu-latest
-    steps:
-      - uses: rtCamp/action-slack-notify@v2
-        env:
-          SLACK_COLOR: failure
-          SLACK_ICON_EMOJI: ':github:'
-          SLACK_MESSAGE: ${{ format('Test *{0}*, Deploy *{1}*, {2}/{3}/actions/runs/{4}', needs.test.result, needs.deploy.result, github.server_url, github.repository, github.run_id) }}
-          SLACK_TITLE: Action Failure - ${{ github.repository }}
-          SLACK_USERNAME: GitHub Actions
-          SLACK_MSG_AUTHOR: twilio-dx
-          SLACK_FOOTER: Posted automatically using GitHub Actions
-          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
-          MSG_MINIMAL: true
+#  notify-on-failure:
+#    name: Slack notify on failure
+#    if: failure() && github.event_name != 'pull_request' && (github.ref == 'refs/heads/main' || github.ref_type == 'tag')
+#    needs: [ test, deploy ]
+#    runs-on: ubuntu-x64
+#    steps:
+#      - uses: rtCamp/action-slack-notify@e31e87e03dd19038e411e38ae27cbad084a90661 # v2.3.3
+#        env:
+#          SLACK_COLOR: failure
+#          SLACK_ICON_EMOJI: ':github:'
+#          SLACK_MESSAGE: ${{ format('Test *{0}*, Deploy *{1}*, {2}/{3}/actions/runs/{4}', needs.test.result, needs.deploy.result, github.server_url, github.repository, github.run_id) }}
+#          SLACK_TITLE: Action Failure - ${{ github.repository }}
+#          SLACK_USERNAME: GitHub Actions
+#          SLACK_MSG_AUTHOR: twilio-dx
+#          SLACK_FOOTER: Posted automatically using GitHub Actions
+#          SLACK_WEBHOOK: ${{ secrets.SLACK_WEBHOOK }}
+#          MSG_MINIMAL: true

Dockerfile

@@ -1,19 +1,14 @@
-ARG version=latest
-FROM openjdk:$version
+ARG version=8
+FROM maven:3.9-eclipse-temurin-${version}
 
-# version <= 11
 RUN apt-get update \
-    && apt-get install -y make maven || true
-COPY prism/prism/nginx/cert.crt /usr/local/share/ca-certificates/cert.crt
-RUN update-ca-certificates || true
+    && apt-get install -y --no-install-recommends make \
+    && rm -rf /var/lib/apt/lists/*
 
-# version > 11
-RUN yum update -y \
-    && yum install -y make wget || true
-RUN wget http://repos.fedorapeople.org/repos/dchen/apache-maven/epel-apache-maven.repo -O /etc/yum.repos.d/epel-apache-maven.repo \
-    && yum install -y maven || true
-RUN keytool -import -trustcacerts -cacerts -storepass changeit -noprompt \
-    -alias api.sendgrid.com -file /usr/local/share/ca-certificates/cert.crt || true
+# Trust the mock server's api.sendgrid.com certificate (see mock-server/).
+COPY mock-server/nginx/cert.crt /tmp/api.sendgrid.com.crt
+RUN keytool -importcert -noprompt -storepass changeit -alias api.sendgrid.com \
+    -file /tmp/api.sendgrid.com.crt -keystore "$(find "$JAVA_HOME" -name cacerts | head -1)"
 
 WORKDIR /app
 COPY . .

LICENSE

@@ -1,6 +1,6 @@
 MIT License
 
-Copyright (C) 2025, Twilio SendGrid, Inc. <help@twilio.com>
+Copyright (C) 2026, Twilio SendGrid, Inc. <help@twilio.com>
 
 Permission is hereby granted, free of charge, to any person obtaining a copy of
 this software and associated documentation files (the "Software"), to deal in

Makefile

@@ -15,10 +15,12 @@ test:
 
 test-integ: test
 
-version ?= latest
+version ?= 8
+COMPOSE := $(shell docker compose version >/dev/null 2>&1 && echo "docker compose" || echo "docker-compose")
 test-docker:
-	curl -s https://raw.githubusercontent.com/sendgrid/sendgrid-oai/HEAD/prism/prism-java.sh -o prism.sh
-	version=$(version) bash ./prism.sh
+	version=$(version) $(COMPOSE) -f mock-server/docker-compose.yml up --build --force-recreate \
+		--abort-on-container-exit --exit-code-from helper-runner --remove-orphans; \
+	status=$$?; version=$(version) $(COMPOSE) -f mock-server/docker-compose.yml down --remove-orphans; exit $$status
 
 update-deps:
 	mvn versions:use-latest-releases versions:commit -DallowMajorUpdates=false

mock-server/Dockerfile.prism

@@ -0,0 +1,19 @@
+# Prism mock of the SendGrid v3 API, used by `make test-docker`.
+# Everything is pinned: the base image by digest, the Prism binary by sha256,
+# and the spec is vendored (see README.md in this directory).
+FROM debian:bookworm-slim@sha256:7c7b2c966bc9ee8cedfeef67e0e279108992c77681fa595db4a9d65c06ccc587
+
+ARG PRISM_VERSION=v2.0.17
+ARG PRISM_SHA256=80f37c2aedab2035a20e6025ac552908bce9e5d64a9338a48434e604e5590731
+
+RUN apt-get update \
+    && apt-get install -y --no-install-recommends curl ca-certificates \
+    && curl -fsSL "https://github.com/stoplightio/prism/releases/download/${PRISM_VERSION}/prism_linux_amd64" -o /usr/local/bin/prism \
+    && echo "${PRISM_SHA256}  /usr/local/bin/prism" | sha256sum -c - \
+    && chmod +x /usr/local/bin/prism \
+    && apt-get purge -y curl && apt-get autoremove -y && rm -rf /var/lib/apt/lists/*
+
+COPY oai_stoplight.json /oai_stoplight.json
+
+EXPOSE 4010
+CMD ["prism", "--port", "4010", "mock", "--spec", "/oai_stoplight.json"]

mock-server/README.md

@@ -0,0 +1,15 @@
+# Mock SendGrid API for tests
+
+`make test-docker` runs the test suite against a local mock of `api.sendgrid.com`:
+
+- **prism**: [Prism](https://github.com/stoplightio/prism) v2.0.17 mocking `oai_stoplight.json`.
+  The binary's sha256 is checked in `Dockerfile.prism`.
+- **nginx**: answers TLS as `api.sendgrid.com` with the self-signed test certificate in
+  `nginx/` and proxies to prism. The certificate and key exist only for this mock.
+- **helper-runner**: the repo's root `Dockerfile`, which trusts that certificate and runs
+  `make test-integ`.
+
+`oai_stoplight.json` is vendored from `sendgrid/sendgrid-oai` at commit
+`eb7a825bf06dfec7da2622735c5334c0d35da9fa`, the same commit the previous
+remote `prism-java.sh` script pinned. These files used to be downloaded at test time
+from that repository, which is no longer publicly readable.

mock-server/docker-compose.yml

@@ -0,0 +1,33 @@
+# Runs the test suite against a local mock of api.sendgrid.com:
+#   helper-runner -> nginx (TLS as api.sendgrid.com) -> prism (mock of the v3 spec)
+services:
+  helper-runner:
+    build:
+      context: ..
+      args:
+        - version=${version:-8}
+    command: make test-integ
+    depends_on:
+      nginx:
+        condition: service_healthy
+  nginx:
+    image: nginx:1.27-alpine@sha256:65645c7bb6a0661892a8b03b89d0743208a18dd2f3f17a54ef4b76fb8e2f2a10
+    networks:
+      default:
+        aliases:
+          - api.sendgrid.com
+    volumes:
+      - ./nginx:/etc/nginx:ro
+    depends_on:
+      - prism
+    healthcheck:
+      # 2xx-4xx means nginx is up and prism answered; 502 means prism isn't ready yet.
+      test: ["CMD-SHELL", "wget -S -O /dev/null http://127.0.0.1/ 2>&1 | grep -qE '^  HTTP/1\\.[01] [1-4][0-9][0-9]'"]
+      interval: 2s
+      timeout: 2s
+      retries: 30
+  prism:
+    platform: linux/amd64
+    build:
+      context: .
+      dockerfile: Dockerfile.prism

mock-server/nginx/cert.crt

@@ -0,0 +1,23 @@
+-----BEGIN CERTIFICATE-----
+MIIDyDCCArACCQDoRrX2g0xuUDANBgkqhkiG9w0BAQsFADCBpDELMAkGA1UEBhMC
+VVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBGcmFuY2lzY28x
+DzANBgNVBAoMBlR3aWxpbzERMA8GA1UECwwIU2VuZEdyaWQxGTAXBgNVBAMMEGFw
+aS5zZW5kZ3JpZC5jb20xKTAnBgkqhkiG9w0BCQEWGnRlYW1faW50ZXJmYWNlc0B0
+d2lsaW8uY29tMCAXDTIyMDEwNzAwMzAxOFoYDzIxMjExMjE0MDAzMDE4WjCBpDEL
+MAkGA1UEBhMCVVMxEzARBgNVBAgMCkNhbGlmb3JuaWExFjAUBgNVBAcMDVNhbiBG
+cmFuY2lzY28xDzANBgNVBAoMBlR3aWxpbzERMA8GA1UECwwIU2VuZEdyaWQxGTAX
+BgNVBAMMEGFwaS5zZW5kZ3JpZC5jb20xKTAnBgkqhkiG9w0BCQEWGnRlYW1faW50
+ZXJmYWNlc0B0d2lsaW8uY29tMIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8AMIIBCgKC
+AQEAmS9xQ4D19jQ2YyuFzN7zk9xRWeOil7bzkOkgFCCqlhPCzuYlMqgD1F7ImcNo
+XbFw13s8k/18xWqxBynFgtmniuFm/f4g8iAfeBn35i1g3Bf0bpG9gWn6h/dX3YXb
+g0nl0e+bMQG4uD0gccySA/Vt6Y6Tshgu6pVo+yMiWEqQRa0tgqr2WZ8NU0bOrpQz
+U9bOrvKxrWvdmIxIYOmptywTXW3vLi63LpE2iy5dPWFO4JCRBc02XZ84B5EhbfVt
+ojNbFdtW6urt/VkrWbt18bFcoeM3w6/Hba8MF+z8ONS8QjD9CRXleNKDMVLmvEmW
+L0RxO4H1P3O7ar/vPafEDobPGQIDAQABMA0GCSqGSIb3DQEBCwUAA4IBAQA/MNAr
+C+9iCLLn9S2QWXfarI1EAb4AFkGWYtqcvhmLJMqWqzsjEWWpWsSBk/i/kPNzTvNs
+XRj8ZPS61lhJw3rRmP/2LW9M4u6mIBHfiBgtWaMhhAjaFA0ALAsJa/8WmAgUfb5V
+dR73oc1GJtDTKJgZ3cFaKAaimDIxJNHSjpYADCEkdKoVv1b/JxD8JEzI9NmrU5xd
+7T7pG6RVT4xO5flCJM+nO851jUaKVmcKD7lhQe9Z8P0bH+ecFyQDILbOFd8ojBHV
+6hSLw4vZCM5bR7iOFBUYzxaKcXl6FJTKaYXD/UrfFXA95YZieGPKYxoF6AkB0I1C
+9RcmCQkkJZnCRCJX
+-----END CERTIFICATE-----

mock-server/nginx/cert.key

@@ -0,0 +1,28 @@
+-----BEGIN PRIVATE KEY-----
+MIIEvAIBADANBgkqhkiG9w0BAQEFAASCBKYwggSiAgEAAoIBAQCZL3FDgPX2NDZj
+K4XM3vOT3FFZ46KXtvOQ6SAUIKqWE8LO5iUyqAPUXsiZw2hdsXDXezyT/XzFarEH
+KcWC2aeK4Wb9/iDyIB94GffmLWDcF/Rukb2BafqH91fdhduDSeXR75sxAbi4PSBx
+zJID9W3pjpOyGC7qlWj7IyJYSpBFrS2CqvZZnw1TRs6ulDNT1s6u8rGta92YjEhg
+6am3LBNdbe8uLrcukTaLLl09YU7gkJEFzTZdnzgHkSFt9W2iM1sV21bq6u39WStZ
+u3XxsVyh4zfDr8dtrwwX7Pw41LxCMP0JFeV40oMxUua8SZYvRHE7gfU/c7tqv+89
+p8QOhs8ZAgMBAAECggEASPrwVD/Bbu3LJ44ZrdReaYhifZfU48D244gdj1lMzDlX
+62h8OlkPkgMiQRd2xoR+BTsiTkNLSWaeNpJxFfkKOEFQ5xtGqPQi6f49O71M0y7a
+dj8a8OgDwvlVNCXMwgzX4B/uaPewAJ6msXDL8/Tey5Hwzb11xK8wF83SVAwaFgdB
+2eY+crgF9biRiRsX+J6uqqHd4RM37IyQ133voTFBho48h3ORgo4WYu5tsHbwKvGC
+pNDtvuvuwkvp6JuI0A1hr3j+/5981n+4w+rnyORliJmxjTYUzhrJ3UXjlXd9gInj
+6tgKEnyq4j78MRp1VrFTPze3XOgMbhVflpLz22rWsQKBgQDJheFTI255UP+9c82B
+KovkEtWNMwZwxiwmxPzapuUsg+OyJ7rNACuT+kRNkbQovC19nVG6NvwWs7A32Jjt
+YHBmAepnh1a1p4NXkKEtwe/28nEnoKsv/Iaw7fIffr6gAdnlv8NV0K8WrnCuWUJ7
+qgKrHSqXdf2k/yxdCi8gQDzaPQKBgQDCmGwAS9LCOJWBfn7UkSc9aOf7z6ZDcWJw
+smzWJ5zMNEwv4F4D7OO+4JpLoaKyu5jfllXMIELPWfC8J/+RsyDyEe1CED9pxIbJ
+NBhfwJtwriolypXrkkCiRBRjG2Jg5NGdRRNjTbqtct83PxX5HcEjk09JFl2FNp7D
++ma0dpxCDQKBgFLVPurnc29WRehfgycGj/2taC3jvU/5hQhii/RsCWMkyyDdh8Df
+wwnOIuknbMAZqTEqyv8ZvsCuF069Lw7TRyAGxYzMam28bxY9EqM2RiZhPPWm6vaM
+e+iZxZ4AgOZQHHp9OhM59d4C0bo4YkVmejZPhMRA8YMyh8+ucfR1sw2ZAoGADPLp
+lOd2wdfUEwbg17JFAzAc58O8k5ZS757f4SxHocsFGtZ6SxaTXRtDCS9bTTtwg8hU
+Mz4eU//vJgYfWomp8pHA0PmVzqr2MSNXT9/YOBpO0a72ZPOZe3K+TI4A8OOpEycK
+kDwW5P3U3q9C/g290Wk3CG0Fkhy9WdsqxG10Hm0CgYBhw64ATDSZ45KIJUF46HRa
+RAY6oO5z2w2BeEpFugkFaMoziQocudeTMvE+QWneYLs7Tdzip+qbNVXJi6jAfpQQ
+H3z2Bm34QvnuXuM1oWL2l7o10X35BHR0B6+IyL3Z/PHUusO51S+rNGPyKr63TXYI
+Ucx/inqVBb7oeKlSHYmA1w==
+-----END PRIVATE KEY-----