diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 9e3cefc..1db97dc 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -1,9 +1,9 @@ -# Release plumbing (DESIGN 13). Off until the repository variable RELEASES_ENABLED is "true": -# nothing is published before Alex approves the first release, and not before 2026-11-01. +# Release plumbing (DESIGN 13). Runs while the repository variable RELEASES_ENABLED is "true" (set +# since the 1.0.0 release on 2026-10-29). Merging the release pull request is the approval. # # On each push to main, release-please keeps a release pull request up to date (version bump and # CHANGELOG.md from conventional commits). Merging it creates the tag and the GitHub release; the -# publish job then waits for an approval on the "maven-central" environment, builds, signs and +# publish job then runs in the "maven-central" environment (its secrets, no reviewers), builds, signs and # uploads to Maven Central through the Central Portal, and attests the jars (build provenance). # Publishing runs in this workflow because a release created with the default token does not # start other workflows. diff --git a/AGENTS.md b/AGENTS.md index cc1c5bf..f7d5153 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -1,7 +1,7 @@ # Didit Java / Kotlin SDK (`sdk-java`) The official Didit server-side library for Java / Kotlin: `me.didit:didit-java` on Maven Central. -Status: in development, not released. +Status: released (1.0.0 on 2026-10-29). Merging the release-please pull request publishes the next version. ## Read first @@ -18,7 +18,7 @@ Gradle with the Kotlin DSL and the wrapper committed, JUnit 5, errorprone, Spotl - `openapi/verification.json`, `openapi/account.json` and `openapi/webhook-vectors.json` are upstream copies; never edit them by hand. Only the spec sync workflow updates them. - Keep the SDKs in sync (HARD RULE). Any public API change in `service-didit-verification` or `service-didit-auth` must reach the OpenAPI documents in mintlify-docs, and from there every server SDK through the spec sync pull request. A change to hand-written core behaviour that DESIGN.md describes (client options, errors, retries, pagination, webhooks, Authentication) is made in all seven SDK repositories, one pull request each, and DESIGN.md is updated in all seven in the same words. - Feature parity across languages: a capability shipped in one server SDK ships in the other six. -- Never publish a package, push a release tag or make this repository public without Alex's explicit approval; nothing is released before the 2026-11-01 Didit release. +- Releases publish straight from this repository (Alex, 2026-10-29): merging the release-please pull request is the release approval, and the release workflow then creates the vX.Y.Z tag and publishes to the registry. Never push a release tag, create a release or publish by hand outside that flow, and never store a registry token where trusted publishing works. - Unit tests never touch the network. Live smoke tests run only when `DIDIT_SANDBOX_API_KEY` is set. - Never commit secrets, API keys or real customer data. Fixtures are synthetic. - `CHANGELOG.md` is generated by release-please from conventional commits; never edit it by hand. diff --git a/CLAUDE.md b/CLAUDE.md index cc1c5bf..f7d5153 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -1,7 +1,7 @@ # Didit Java / Kotlin SDK (`sdk-java`) The official Didit server-side library for Java / Kotlin: `me.didit:didit-java` on Maven Central. -Status: in development, not released. +Status: released (1.0.0 on 2026-10-29). Merging the release-please pull request publishes the next version. ## Read first @@ -18,7 +18,7 @@ Gradle with the Kotlin DSL and the wrapper committed, JUnit 5, errorprone, Spotl - `openapi/verification.json`, `openapi/account.json` and `openapi/webhook-vectors.json` are upstream copies; never edit them by hand. Only the spec sync workflow updates them. - Keep the SDKs in sync (HARD RULE). Any public API change in `service-didit-verification` or `service-didit-auth` must reach the OpenAPI documents in mintlify-docs, and from there every server SDK through the spec sync pull request. A change to hand-written core behaviour that DESIGN.md describes (client options, errors, retries, pagination, webhooks, Authentication) is made in all seven SDK repositories, one pull request each, and DESIGN.md is updated in all seven in the same words. - Feature parity across languages: a capability shipped in one server SDK ships in the other six. -- Never publish a package, push a release tag or make this repository public without Alex's explicit approval; nothing is released before the 2026-11-01 Didit release. +- Releases publish straight from this repository (Alex, 2026-10-29): merging the release-please pull request is the release approval, and the release workflow then creates the vX.Y.Z tag and publishes to the registry. Never push a release tag, create a release or publish by hand outside that flow, and never store a registry token where trusted publishing works. - Unit tests never touch the network. Live smoke tests run only when `DIDIT_SANDBOX_API_KEY` is set. - Never commit secrets, API keys or real customer data. Fixtures are synthetic. - `CHANGELOG.md` is generated by release-please from conventional commits; never edit it by hand. diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 6d9d049..6131eb3 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -50,16 +50,16 @@ You can push commits to the sync branch (for example hand-written webhook or Aut Releases are cut by release-please from conventional commits; `CHANGELOG.md` is generated and never edited by hand. Nothing is published before Alex approves the first release, and not before 2026-11-01; until then versions stay `0.x`. -1. The workflow `.github/workflows/release-please.yml` is off until the repository variable `RELEASES_ENABLED` is `true`. +1. The workflow `.github/workflows/release-please.yml` runs while the repository variable `RELEASES_ENABLED` is `true` (set since 1.0.0). Merging the release pull request is the release approval (Alex, 2026-10-29); nobody tags or publishes by hand. 2. On each push to `main`, release-please updates a release pull request (version in `gradle.properties`, `Version.java` and the README, plus `CHANGELOG.md`). -3. Merging it creates the `vX.Y.Z` tag and the GitHub release. The `publish` job then waits for a reviewer of the `maven-central` environment, runs `./gradlew check`, signs and uploads to Maven Central (Central Portal), and attests the jars. +3. Merging it creates the `vX.Y.Z` tag and the GitHub release. The `publish` job then runs in the `maven-central` environment (it holds the secrets; no reviewers), runs `./gradlew check`, signs and uploads to Maven Central (Central Portal), and attests the jars. 4. If a publish fails after the tag exists: when the cause is outside the code (an expired token, a missing secret, a Central Portal outage), fix it and rerun the failed `publish` job of that workflow run. A rerun builds the tag's commit, so it never picks up a fix merged to `main` later; when the code has to change, merge the fix to `main` and release the next patch version instead. -One-time setup by a repository admin, before the first release: +One-time setup (done for 1.0.0 on 2026-10-29): - Maven Central: the `me.didit` namespace verified on central.sonatype.com, and a Central Portal user token. - A GPG signing key, with its public key on a key server. -- Repository secrets `MAVEN_CENTRAL_USERNAME`, `MAVEN_CENTRAL_PASSWORD`, `MAVEN_SIGNING_KEY` (ASCII-armored private key) and `MAVEN_SIGNING_KEY_PASSWORD`. -- A `maven-central` environment with required reviewers and "Prevent self-review". +- Secrets of the `maven-central` environment: `MAVEN_CENTRAL_USERNAME`, `MAVEN_CENTRAL_PASSWORD`, `MAVEN_SIGNING_KEY` (ASCII-armored private key) and `MAVEN_SIGNING_KEY_PASSWORD`. +- A `maven-central` environment holding those secrets, with no required reviewers. The Central Portal token expires on 2027-04-29: generate a new one and replace the two secrets before then. - Optionally `RELEASE_PLEASE_TOKEN` and `SPEC_SYNC_TOKEN` (a GitHub App or fine-grained token), so CI runs on the release and sync pull requests. - Finally, the variable `RELEASES_ENABLED=true`. diff --git a/README.md b/README.md index 1ff5976..125b648 100644 --- a/README.md +++ b/README.md @@ -3,8 +3,6 @@ The official Didit Java library, for Java and Kotlin backends. Identity verification (KYC), business verification (KYB), AML screening, biometrics, transaction monitoring, Travel Rule and customer authentication, from your server, with a typed method for every endpoint of the [Didit API](https://docs.didit.me). -> In development: not released yet. The first release ships with the Didit release of 2026-11-01. - ## Install Java 11 or newer. Gradle (Kotlin DSL): diff --git a/docs/DESIGN.md b/docs/DESIGN.md index dfd5287..32996e0 100644 --- a/docs/DESIGN.md +++ b/docs/DESIGN.md @@ -33,9 +33,8 @@ The Maven group `me.didit` is the one `sdk-android` already publishes under. PyPI `didit` belongs to an unrelated project from 2013. PyPI `didit-sdk` is a community package by Agustin Saiz (MIT, unofficial, sessions only). -Didit is asking him to transfer the `didit-sdk` project to Didit, so the official SDK ships under that name. -Until the transfer is confirmed, keep `didit-sdk` as the distribution name in `pyproject.toml` and do not publish. -The fallback name, if the transfer does not happen, is `didit-python`. +He transferred the `didit-sdk` project to Didit, and the official SDK published 1.0.0 under that name on 2026-10-29. +As agreed with him, his releases 0.1.0 to 0.4.0 stay published, his PyPI user stays on the project, and the 1.0.0 release notes credit the initial community versions. ## 3. Source of truth: the OpenAPI contract @@ -247,9 +246,10 @@ Ruby: `net/http` from the standard library, `jwt` only for Authentication. - Semantic versioning; a breaking change to the public SDK surface is a major version. - Releases are cut by release-please from conventional commits; `CHANGELOG.md` is generated and never edited by hand. -- Release workflows publish with trusted publishing or provenance where the registry supports it (PyPI and RubyGems trusted publishing, npm provenance, Maven Central via the Central Portal with signed artifacts, NuGet with a scoped key and the `Didit` prefix reserved, Packagist auto-update from tags, Go module tags). -- Nothing is published before Alex approves the first release, and not before the 2026-11-01 release; until then versions stay `0.x` pre-release in the repository. -- The repository stays private until that first release. +- Release workflows publish with trusted publishing where the registry supports it (PyPI, npm with provenance, RubyGems and NuGet), Maven Central through the Central Portal with signed artifacts (token and signing key in the `maven-central` environment), Packagist through its GitHub hook, and Go module tags announced to proxy.golang.org. +- 1.0.0 shipped on 2026-10-29 with Alex's approval, and the repositories are public. +- Every release after that publishes straight from the repository: merging the release-please pull request is the approval, and the workflow creates the vX.Y.Z tag and publishes. +- A release created with `GITHUB_TOKEN` does not trigger other workflows, so a repository that publishes from a separate `release.yml` has release-please start it with `workflow_dispatch` for the new tag. No personal access token is stored. ## 14. Documentation and positioning