Enforce Java OpenSSF Gold quality gates and license evidence

.github/PULL_REQUEST_TEMPLATE.md

@@ -0,0 +1,19 @@
+## Summary
+
+Describe the user-visible result.
+
+## Verification
+
+- [ ] I ran the relevant tests.
+- [ ] I added regression coverage for corrected defects.
+- [ ] I ran every required gate.
+- [ ] I preserved public API contracts.
+- [ ] I checked the diff for secrets and private implementation details.
+- [ ] I signed every commit with `git commit --signoff`.
+- [ ] A different human will review this nontrivial maintainer change.
+
+## Contract Impact
+
+State any API, compatibility, security, or release impact.
+
+Xquik is an independent third-party service. Not affiliated with X Corp. "Twitter" and "X" are trademarks of X Corp.

.github/workflows/ci.yml

@@ -15,15 +15,64 @@ on:
       - "stl-preview-head/**"
       - "stl-preview-base/**"
 
-permissions: {}
+permissions:
+  contents: read
 
 concurrency:
-  group: ci-${{ github.workflow }}-${{ github.ref }}
+  group: java-ci-${{ github.event.pull_request.number || github.ref }}
   cancel-in-progress: true
 
 jobs:
-  verify:
-    name: Verify
+  lint:
+    name: Lint & Licensing
+    runs-on: ubuntu-24.04
+    timeout-minutes: 20
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Java
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+        with:
+          distribution: temurin
+          java-version: "26"
+
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+        with:
+          cache-cleanup: always
+
+      - name: Check Java & Kotlin
+        run: ./scripts/lint
+
+      - name: Check shell scripts
+        run: >-
+          shellcheck
+          bin/check-release-environment
+          bin/check-release-workflow
+          bin/verify-release-signature
+          scripts/audit
+          scripts/build
+          scripts/check-reproducible
+          scripts/coverage
+          scripts/fast-format
+          scripts/format
+          scripts/java-format
+          scripts/kotlin-format
+          scripts/lint
+          scripts/test
+          scripts/upload-artifacts
+
+      - name: Check workflows
+        run: go run github.com/rhysd/actionlint/cmd/actionlint@v1.7.12
+
+      - name: Check repository licensing
+        uses: fsfe/reuse-action@676e2d560c9a403aa252096d99fcab3e1132b0f5 # v6.0.0
+
+  build:
+    name: Build
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     steps:
@@ -52,11 +101,136 @@ jobs:
         with:
           cache-cleanup: always
 
-      - name: Run lints
-        run: ./scripts/lint
-
       - name: Build SDK
         run: ./scripts/build
 
-      - name: Run tests
+  test:
+    name: Tests
+    runs-on: ubuntu-24.04
+    timeout-minutes: 30
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Java 25 for shrinkers
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+        with:
+          distribution: oracle
+          java-version: "25"
+
+      - name: Save shrinker Java home
+        run: echo "SHRINKER_JAVA_HOME=$JAVA_HOME" >> "$GITHUB_ENV"
+
+      - name: Set up Java 26
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+        with:
+          distribution: temurin
+          java-version: "26"
+
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+        with:
+          cache-cleanup: always
+
+      - name: Run all tests without skips
         run: ./scripts/test
+
+  coverage:
+    name: Coverage
+    runs-on: ubuntu-24.04
+    timeout-minutes: 25
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Java
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+        with:
+          distribution: temurin
+          java-version: "26"
+
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+        with:
+          cache-cleanup: always
+
+      - name: Enforce maintained-source coverage
+        run: ./scripts/coverage
+
+      - name: Upload coverage evidence
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: java-coverage
+          path: |
+            build/reports/jacoco/coverage/coverage.xml
+            build/reports/jacoco/coverage-raw/coverage.xml
+          retention-days: 14
+
+  dynamic-analysis:
+    name: Dynamic Analysis
+    runs-on: ubuntu-24.04
+    timeout-minutes: 15
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Java
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+        with:
+          distribution: temurin
+          java-version: "26"
+
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+        with:
+          cache-cleanup: always
+
+      - name: Fuzz untrusted retry headers
+        env:
+          JAZZER_FUZZ: "1"
+        run: >-
+          ./gradlew
+          :x-twitter-scraper-java-core:test
+          --tests '*RetryAfterFuzzTest'
+          --no-build-cache
+          --no-configuration-cache
+
+  supply-chain:
+    name: Dependency & Build Security
+    runs-on: ubuntu-24.04
+    timeout-minutes: 35
+    steps:
+      - name: Check out repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+        with:
+          persist-credentials: false
+
+      - name: Set up Java
+        uses: actions/setup-java@03ad4de0992f5dab5e18fcb136590ce7c4a0ac95 # v5.6.0
+        with:
+          distribution: temurin
+          java-version: "26"
+
+      - name: Set up Gradle
+        uses: gradle/actions/setup-gradle@3f131e8634966bd73d06cc69884922b02e6faf92 # v6.2.0
+        with:
+          cache-cleanup: always
+
+      - name: Audit dependencies and licenses
+        run: ./scripts/audit
+
+      - name: Verify reproducible Maven artifacts
+        run: ./scripts/check-reproducible
+
+      - name: Upload dependency license evidence
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: java-dependency-licenses
+          path: build/reports/dependency-license
+          retention-days: 14

.github/workflows/codeql.yml

@@ -11,14 +11,18 @@ on:
 permissions:
   contents: read
 
+concurrency:
+  group: codeql-${{ github.event.pull_request.number || github.ref }}
+  cancel-in-progress: true
+
 jobs:
   analyze:
     name: Analyze Java & Kotlin
     runs-on: ubuntu-24.04
     timeout-minutes: 30
     permissions:
       contents: read
-      security-events: write
+      security-events: write # Required to upload CodeQL results.
     steps:
       - name: Check out source
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.github/workflows/publish-sonatype.yml

@@ -69,5 +69,12 @@ jobs:
         env:
           ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.X_TWITTER_SCRAPER_SONATYPE_USERNAME || secrets.SONATYPE_USERNAME }}
           ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.X_TWITTER_SCRAPER_SONATYPE_PASSWORD || secrets.SONATYPE_PASSWORD }}
+          ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.X_TWITTER_SCRAPER_SONATYPE_GPG_SIGNING_KEY || secrets.GPG_SIGNING_KEY }}
+          ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.X_TWITTER_SCRAPER_SONATYPE_GPG_SIGNING_PASSWORD || secrets.GPG_SIGNING_PASSWORD }}
           GPG_SIGNING_KEY: ${{ secrets.X_TWITTER_SCRAPER_SONATYPE_GPG_SIGNING_KEY || secrets.GPG_SIGNING_KEY }}
           GPG_SIGNING_PASSWORD: ${{ secrets.X_TWITTER_SCRAPER_SONATYPE_GPG_SIGNING_PASSWORD || secrets.GPG_SIGNING_PASSWORD }}
+
+      - name: Verify published signature
+        env:
+          RELEASE_REF: ${{ github.event_name == 'workflow_dispatch' && inputs.release_ref || github.ref_name }}
+        run: ./bin/verify-release-signature "$RELEASE_REF"

.github/workflows/release-doctor.yml

@@ -2,6 +2,11 @@ name: Release Doctor
 
 on:
   workflow_dispatch:
+    inputs:
+      release_ref:
+        description: Optional public release tag to verify
+        required: false
+        type: string
 
 permissions:
   contents: read
@@ -41,4 +46,10 @@ jobs:
           GPG_SIGNING_PASSWORD: ${{ secrets.X_TWITTER_SCRAPER_SONATYPE_GPG_SIGNING_PASSWORD || secrets.GPG_SIGNING_PASSWORD }}
 
       - name: Build local Maven artifacts
-        run: ./gradlew publishToMavenLocal -PpublishLocal --no-daemon --stacktrace
+        run: ./gradlew publishToMavenLocal -PpublishLocal --no-configuration-cache --no-daemon --stacktrace
+
+      - name: Verify public release signature
+        if: inputs.release_ref != ''
+        env:
+          RELEASE_REF: ${{ inputs.release_ref }}
+        run: ./bin/verify-release-signature "$RELEASE_REF"

.github/workflows/scorecard.yml

@@ -6,7 +6,11 @@ on:
   schedule:
     - cron: "29 3 * * 6"
 
-permissions: read-all
+permissions: {}
+
+concurrency:
+  group: scorecard-${{ github.ref }}
+  cancel-in-progress: true
 
 jobs:
   analysis:
@@ -15,8 +19,8 @@ jobs:
     timeout-minutes: 20
     permissions:
       contents: read
-      security-events: write
-      id-token: write
+      security-events: write # Required to upload the SARIF report.
+      id-token: write # Required to publish signed Scorecard results.
     steps:
       - name: Check out source
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1

.gitignore

@@ -1,5 +1,6 @@
 .prism.log
 .stdy.log
+.cifuzz-corpus/
 .gradle
 .idea
 .kotlin