From b6a46f51f603ff7540382c94f317c34bdb4c9e0a Mon Sep 17 00:00:00 2001 From: Alejandro Rosas Date: Thu, 29 Oct 2026 17:02:46 +0400 Subject: [PATCH 1/2] docs(release): releases publish straight from the repository Alex approved the 1.0.0 release on 2026-10-29 and asked that every release publish straight from the repository. The pre-launch rule (no tag or publish before 2026-11-01 without his approval) is replaced: merging the release-please pull request is the release approval. docs/DESIGN.md section 13 records the same, identically in all seven SDK repositories. Co-Authored-By: Claude Opus 5.5 --- AGENTS.md | 2 +- CLAUDE.md | 2 +- docs/DESIGN.md | 7 ++++--- 3 files changed, 6 insertions(+), 5 deletions(-) diff --git a/AGENTS.md b/AGENTS.md index cc1c5bf..6b68a2e 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -18,7 +18,7 @@ Gradle with the Kotlin DSL and the wrapper committed, JUnit 5, errorprone, Spotl - `openapi/verification.json`, `openapi/account.json` and `openapi/webhook-vectors.json` are upstream copies; never edit them by hand. Only the spec sync workflow updates them. - Keep the SDKs in sync (HARD RULE). Any public API change in `service-didit-verification` or `service-didit-auth` must reach the OpenAPI documents in mintlify-docs, and from there every server SDK through the spec sync pull request. A change to hand-written core behaviour that DESIGN.md describes (client options, errors, retries, pagination, webhooks, Authentication) is made in all seven SDK repositories, one pull request each, and DESIGN.md is updated in all seven in the same words. - Feature parity across languages: a capability shipped in one server SDK ships in the other six. -- Never publish a package, push a release tag or make this repository public without Alex's explicit approval; nothing is released before the 2026-11-01 Didit release. +- Releases publish straight from this repository (Alex, 2026-10-29): merging the release-please pull request is the release approval, and the release workflow then creates the vX.Y.Z tag and publishes to the registry. Never push a release tag, create a release or publish by hand outside that flow, and never store a registry token where trusted publishing works. - Unit tests never touch the network. Live smoke tests run only when `DIDIT_SANDBOX_API_KEY` is set. - Never commit secrets, API keys or real customer data. Fixtures are synthetic. - `CHANGELOG.md` is generated by release-please from conventional commits; never edit it by hand. diff --git a/CLAUDE.md b/CLAUDE.md index cc1c5bf..6b68a2e 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -18,7 +18,7 @@ Gradle with the Kotlin DSL and the wrapper committed, JUnit 5, errorprone, Spotl - `openapi/verification.json`, `openapi/account.json` and `openapi/webhook-vectors.json` are upstream copies; never edit them by hand. Only the spec sync workflow updates them. - Keep the SDKs in sync (HARD RULE). Any public API change in `service-didit-verification` or `service-didit-auth` must reach the OpenAPI documents in mintlify-docs, and from there every server SDK through the spec sync pull request. A change to hand-written core behaviour that DESIGN.md describes (client options, errors, retries, pagination, webhooks, Authentication) is made in all seven SDK repositories, one pull request each, and DESIGN.md is updated in all seven in the same words. - Feature parity across languages: a capability shipped in one server SDK ships in the other six. -- Never publish a package, push a release tag or make this repository public without Alex's explicit approval; nothing is released before the 2026-11-01 Didit release. +- Releases publish straight from this repository (Alex, 2026-10-29): merging the release-please pull request is the release approval, and the release workflow then creates the vX.Y.Z tag and publishes to the registry. Never push a release tag, create a release or publish by hand outside that flow, and never store a registry token where trusted publishing works. - Unit tests never touch the network. Live smoke tests run only when `DIDIT_SANDBOX_API_KEY` is set. - Never commit secrets, API keys or real customer data. Fixtures are synthetic. - `CHANGELOG.md` is generated by release-please from conventional commits; never edit it by hand. diff --git a/docs/DESIGN.md b/docs/DESIGN.md index dfd5287..f4bffe4 100644 --- a/docs/DESIGN.md +++ b/docs/DESIGN.md @@ -247,9 +247,10 @@ Ruby: `net/http` from the standard library, `jwt` only for Authentication. - Semantic versioning; a breaking change to the public SDK surface is a major version. - Releases are cut by release-please from conventional commits; `CHANGELOG.md` is generated and never edited by hand. -- Release workflows publish with trusted publishing or provenance where the registry supports it (PyPI and RubyGems trusted publishing, npm provenance, Maven Central via the Central Portal with signed artifacts, NuGet with a scoped key and the `Didit` prefix reserved, Packagist auto-update from tags, Go module tags). -- Nothing is published before Alex approves the first release, and not before the 2026-11-01 release; until then versions stay `0.x` pre-release in the repository. -- The repository stays private until that first release. +- Release workflows publish with trusted publishing where the registry supports it (PyPI, npm with provenance, RubyGems and NuGet), Maven Central through the Central Portal with signed artifacts (token and signing key in the `maven-central` environment), Packagist through its GitHub hook, and Go module tags announced to proxy.golang.org. +- 1.0.0 shipped on 2026-10-29 with Alex's approval, and the repositories are public. +- Every release after that publishes straight from the repository: merging the release-please pull request is the approval, and the workflow creates the vX.Y.Z tag and publishes. +- A release created with `GITHUB_TOKEN` does not trigger other workflows, so a repository that publishes from a separate `release.yml` has release-please start it with `workflow_dispatch` for the new tag. No personal access token is stored. ## 14. Documentation and positioning From f72337f632335a85f0ad037a829ebc656d9fe439 Mon Sep 17 00:00:00 2001 From: Alejandro Rosas Date: Thu, 29 Oct 2026 17:15:03 +0400 Subject: [PATCH 2/2] docs(release): drop the pre-launch release policy everywhere The SDK is released (1.0.0 on 2026-10-29) and merging the release pull request is the release approval, so the leftover pre-launch text is replaced: the README banners, the agent status line, the CONTRIBUTING release sections and the workflow comments no longer describe a private, unreleased repository or a reviewer gate on the publish environments (which have no required reviewers). docs/DESIGN.md section 2.1 records the completed didit-sdk PyPI transfer and the terms agreed with Agustin Saiz, identically in all seven repositories. Co-Authored-By: Claude Opus 5.5 --- .github/workflows/release-please.yml | 6 +++--- AGENTS.md | 2 +- CLAUDE.md | 2 +- CONTRIBUTING.md | 10 +++++----- README.md | 2 -- docs/DESIGN.md | 5 ++--- 6 files changed, 12 insertions(+), 15 deletions(-) diff --git a/.github/workflows/release-please.yml b/.github/workflows/release-please.yml index 9e3cefc..1db97dc 100644 --- a/.github/workflows/release-please.yml +++ b/.github/workflows/release-please.yml @@ -1,9 +1,9 @@ -# Release plumbing (DESIGN 13). Off until the repository variable RELEASES_ENABLED is "true": -# nothing is published before Alex approves the first release, and not before 2026-11-01. +# Release plumbing (DESIGN 13). Runs while the repository variable RELEASES_ENABLED is "true" (set +# since the 1.0.0 release on 2026-10-29). Merging the release pull request is the approval. # # On each push to main, release-please keeps a release pull request up to date (version bump and # CHANGELOG.md from conventional commits). Merging it creates the tag and the GitHub release; the -# publish job then waits for an approval on the "maven-central" environment, builds, signs and +# publish job then runs in the "maven-central" environment (its secrets, no reviewers), builds, signs and # uploads to Maven Central through the Central Portal, and attests the jars (build provenance). # Publishing runs in this workflow because a release created with the default token does not # start other workflows. diff --git a/AGENTS.md b/AGENTS.md index 6b68a2e..f7d5153 100644 --- a/AGENTS.md +++ b/AGENTS.md @@ -1,7 +1,7 @@ # Didit Java / Kotlin SDK (`sdk-java`) The official Didit server-side library for Java / Kotlin: `me.didit:didit-java` on Maven Central. -Status: in development, not released. +Status: released (1.0.0 on 2026-10-29). Merging the release-please pull request publishes the next version. ## Read first diff --git a/CLAUDE.md b/CLAUDE.md index 6b68a2e..f7d5153 100644 --- a/CLAUDE.md +++ b/CLAUDE.md @@ -1,7 +1,7 @@ # Didit Java / Kotlin SDK (`sdk-java`) The official Didit server-side library for Java / Kotlin: `me.didit:didit-java` on Maven Central. -Status: in development, not released. +Status: released (1.0.0 on 2026-10-29). Merging the release-please pull request publishes the next version. ## Read first diff --git a/CONTRIBUTING.md b/CONTRIBUTING.md index 6d9d049..6131eb3 100644 --- a/CONTRIBUTING.md +++ b/CONTRIBUTING.md @@ -50,16 +50,16 @@ You can push commits to the sync branch (for example hand-written webhook or Aut Releases are cut by release-please from conventional commits; `CHANGELOG.md` is generated and never edited by hand. Nothing is published before Alex approves the first release, and not before 2026-11-01; until then versions stay `0.x`. -1. The workflow `.github/workflows/release-please.yml` is off until the repository variable `RELEASES_ENABLED` is `true`. +1. The workflow `.github/workflows/release-please.yml` runs while the repository variable `RELEASES_ENABLED` is `true` (set since 1.0.0). Merging the release pull request is the release approval (Alex, 2026-10-29); nobody tags or publishes by hand. 2. On each push to `main`, release-please updates a release pull request (version in `gradle.properties`, `Version.java` and the README, plus `CHANGELOG.md`). -3. Merging it creates the `vX.Y.Z` tag and the GitHub release. The `publish` job then waits for a reviewer of the `maven-central` environment, runs `./gradlew check`, signs and uploads to Maven Central (Central Portal), and attests the jars. +3. Merging it creates the `vX.Y.Z` tag and the GitHub release. The `publish` job then runs in the `maven-central` environment (it holds the secrets; no reviewers), runs `./gradlew check`, signs and uploads to Maven Central (Central Portal), and attests the jars. 4. If a publish fails after the tag exists: when the cause is outside the code (an expired token, a missing secret, a Central Portal outage), fix it and rerun the failed `publish` job of that workflow run. A rerun builds the tag's commit, so it never picks up a fix merged to `main` later; when the code has to change, merge the fix to `main` and release the next patch version instead. -One-time setup by a repository admin, before the first release: +One-time setup (done for 1.0.0 on 2026-10-29): - Maven Central: the `me.didit` namespace verified on central.sonatype.com, and a Central Portal user token. - A GPG signing key, with its public key on a key server. -- Repository secrets `MAVEN_CENTRAL_USERNAME`, `MAVEN_CENTRAL_PASSWORD`, `MAVEN_SIGNING_KEY` (ASCII-armored private key) and `MAVEN_SIGNING_KEY_PASSWORD`. -- A `maven-central` environment with required reviewers and "Prevent self-review". +- Secrets of the `maven-central` environment: `MAVEN_CENTRAL_USERNAME`, `MAVEN_CENTRAL_PASSWORD`, `MAVEN_SIGNING_KEY` (ASCII-armored private key) and `MAVEN_SIGNING_KEY_PASSWORD`. +- A `maven-central` environment holding those secrets, with no required reviewers. The Central Portal token expires on 2027-04-29: generate a new one and replace the two secrets before then. - Optionally `RELEASE_PLEASE_TOKEN` and `SPEC_SYNC_TOKEN` (a GitHub App or fine-grained token), so CI runs on the release and sync pull requests. - Finally, the variable `RELEASES_ENABLED=true`. diff --git a/README.md b/README.md index 1ff5976..125b648 100644 --- a/README.md +++ b/README.md @@ -3,8 +3,6 @@ The official Didit Java library, for Java and Kotlin backends. Identity verification (KYC), business verification (KYB), AML screening, biometrics, transaction monitoring, Travel Rule and customer authentication, from your server, with a typed method for every endpoint of the [Didit API](https://docs.didit.me). -> In development: not released yet. The first release ships with the Didit release of 2026-11-01. - ## Install Java 11 or newer. Gradle (Kotlin DSL): diff --git a/docs/DESIGN.md b/docs/DESIGN.md index f4bffe4..32996e0 100644 --- a/docs/DESIGN.md +++ b/docs/DESIGN.md @@ -33,9 +33,8 @@ The Maven group `me.didit` is the one `sdk-android` already publishes under. PyPI `didit` belongs to an unrelated project from 2013. PyPI `didit-sdk` is a community package by Agustin Saiz (MIT, unofficial, sessions only). -Didit is asking him to transfer the `didit-sdk` project to Didit, so the official SDK ships under that name. -Until the transfer is confirmed, keep `didit-sdk` as the distribution name in `pyproject.toml` and do not publish. -The fallback name, if the transfer does not happen, is `didit-python`. +He transferred the `didit-sdk` project to Didit, and the official SDK published 1.0.0 under that name on 2026-10-29. +As agreed with him, his releases 0.1.0 to 0.4.0 stay published, his PyPI user stays on the project, and the 1.0.0 release notes credit the initial community versions. ## 3. Source of truth: the OpenAPI contract