Release: Java 1.0.0, Node 1.0.0, Python 1.1.0

.gitattributes

@@ -0,0 +1 @@
+* text=auto eol=lf

.github/dependabot.yml

@@ -12,7 +12,10 @@ updates:
       actions:
         patterns: ["*"]
 
-  # Python runtime/dev deps in python/pyproject.toml.
+  # Python: runtime deps in python/pyproject.toml and the pinned dev/build/publish
+  # tooling in python/requirements/dev.txt. One entry covers both, because Dependabot
+  # scans a directory recursively for pyproject.toml and requirements *.txt files; a
+  # second entry for python/requirements produced a duplicate PR for every bump.
   - package-ecosystem: pip
     directory: /python
     schedule:
@@ -21,12 +24,29 @@ updates:
       python:
         patterns: ["*"]
 
-  # Pinned dev/build/publish tooling in python/requirements/dev.txt (ruff, pytest,
-  # build, twine). Dependabot discovers the *.txt files in this directory.
-  - package-ecosystem: pip
-    directory: /python/requirements
+  # Node runtime/dev dependencies in node/package.json.
+  - package-ecosystem: npm
+    directory: /node
+    schedule:
+      interval: weekly
+    groups:
+      node:
+        patterns: ["*"]
+
+  # Java runtime and test dependencies in java/pom.xml.
+  - package-ecosystem: maven
+    directory: /java
+    schedule:
+      interval: weekly
+    groups:
+      java:
+        patterns: ["*"]
+
+  # Standalone Java example build plugins.
+  - package-ecosystem: maven
+    directory: /java/examples
     schedule:
       interval: weekly
     groups:
-      tooling:
+      java-examples:
         patterns: ["*"]

.github/workflows/java-release.yml

@@ -0,0 +1,110 @@
+name: Publish Java package to Maven Central
+
+# A java-v* release tests every supported Java version, then signs the artifacts and
+# publishes them to Maven Central through the Central Portal, after approval.
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+# cancel-in-progress: false — cancelling mid-upload can leave a deployment half done.
+concurrency:
+  group: java-release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  # Source of truth for the test matrix: java.supported.versions in pom.xml.
+  # java-v* releases only — test/publish inherit this via `needs`.
+  versions:
+    name: java versions
+    if: startsWith(github.ref_name, 'java-v')
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      data: ${{ steps.set.outputs.data }}
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Load supported versions from pom.xml
+        id: set
+        run: echo "data=$(python3 scripts/java_dev.py list-supported-versions)" >> "$GITHUB_OUTPUT"
+
+  # Full support matrix gates the release. Ubuntu only: the CI workflow already covers
+  # Windows and macOS. No dependency caching in release jobs.
+  test:
+    name: test (Java ${{ matrix.java-version }})
+    needs: versions
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    strategy:
+      fail-fast: false  # report every version, not just the first failure
+      matrix:
+        java-version: ${{ fromJson(needs.versions.outputs.data).all }}
+    defaults:
+      run:
+        working-directory: java
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Java ${{ matrix.java-version }}
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        with:
+          distribution: corretto
+          java-version: ${{ matrix.java-version }}
+
+      - name: Build and test
+        run: mvn --batch-mode --no-transfer-progress install
+
+      - name: Run installed-artifact integration tests
+        run: mvn --batch-mode --no-transfer-progress --file integration-tests/pom.xml verify
+
+  publish:
+    name: publish to Maven Central
+    needs: [versions, test]
+    # A fork that copies this workflow and its tags cannot publish.
+    if: startsWith(github.ref_name, 'java-v') && github.repository_owner == 'aws'
+    runs-on: ubuntu-latest
+    # Publishing can take up to 60 minutes and the smoke test up to ~45.
+    timeout-minutes: 120
+    # Holds the Central token and signing key. Its required-reviewer gate is the
+    # approval to publish.
+    environment: maven
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      # Tag must match the pom version, which must not be a SNAPSHOT, and the
+      # CHANGELOG must have an entry.
+      - name: Verify the tag matches the pom version
+        run: python3 scripts/java_dev.py verify "$GITHUB_REF_NAME"
+
+      # Writes a settings.xml whose `central` server and GPG passphrase read the
+      # environment variables named below, and imports the signing key.
+      - name: Set up Java with the Central credentials and signing key
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        with:
+          distribution: corretto
+          java-version: ${{ fromJson(needs.versions.outputs.data).max }}
+          server-id: central
+          server-username: CENTRAL_TOKEN_USERNAME
+          server-password: CENTRAL_TOKEN_PASSWORD
+          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
+          gpg-passphrase: MAVEN_GPG_PASSPHRASE
+
+      # Tests already ran in the test job. The plugin uploads, waits for validation,
+      # publishes, and fails this step if any of that fails.
+      - name: Sign and publish to Maven Central
+        env:
+          CENTRAL_TOKEN_USERNAME: ${{ secrets.CENTRAL_TOKEN_USERNAME }}
+          CENTRAL_TOKEN_PASSWORD: ${{ secrets.CENTRAL_TOKEN_PASSWORD }}
+          MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+        run: mvn --batch-mode --no-transfer-progress --file java/pom.xml -P release -DskipTests deploy
+
+      # Retries for up to ~45 minutes: Maven Central lags behind a publish.
+      - name: Smoke-test Maven Central
+        run: python3 scripts/java_dev.py smoke "${GITHUB_REF_NAME#java-v}"

.github/workflows/java.yml

@@ -0,0 +1,79 @@
+name: Java CI
+
+on:
+  push:
+    branches: [main, release-2]
+    paths:
+      - "java/**"
+      - "scripts/java_dev.py"
+      - ".github/workflows/java.yml"
+  pull_request:
+    paths:
+      - "java/**"
+      - "scripts/java_dev.py"
+      - ".github/workflows/java.yml"
+
+permissions:
+  contents: read
+
+jobs:
+  versions:
+    name: Java versions
+    runs-on: ubuntu-latest
+    outputs:
+      data: ${{ steps.set.outputs.data }}
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Load supported versions from pom.xml
+        id: set
+        run: echo "data=$(python3 scripts/java_dev.py list-supported-versions)" >> "$GITHUB_OUTPUT"
+
+  test:
+    name: Java ${{ matrix.java-version }} on ${{ matrix.os }}
+    needs: versions
+    runs-on: ${{ matrix.os }}
+    strategy:
+      fail-fast: false
+      matrix:
+        # Every supported version runs on Linux. Other platforms test the
+        # ends of the range, where runtime differences are most likely.
+        os: [ubuntu-latest]
+        java-version: ${{ fromJson(needs.versions.outputs.data).all }}
+        include:
+          - os: windows-latest
+            java-version: "${{ fromJson(needs.versions.outputs.data).min }}"
+          - os: windows-latest
+            java-version: "${{ fromJson(needs.versions.outputs.data).max }}"
+          - os: macos-14
+            java-version: "${{ fromJson(needs.versions.outputs.data).min }}"
+          - os: macos-14
+            java-version: "${{ fromJson(needs.versions.outputs.data).max }}"
+
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Java ${{ matrix.java-version }}
+        uses: actions/setup-java@c5195efecf7bdfc987ee8bae7a71cb8b11521c00 # v4.7.1
+        with:
+          distribution: corretto
+          java-version: ${{ matrix.java-version }}
+          cache: maven
+          cache-dependency-path: |
+            java/pom.xml
+            java/examples/pom.xml
+            java/integration-tests/pom.xml
+
+      - name: Build and test
+        working-directory: java
+        run: mvn --batch-mode --no-transfer-progress install
+
+      - name: Build documentation examples
+        working-directory: java
+        run: mvn --batch-mode --no-transfer-progress --file examples/pom.xml verify
+
+      - name: Run installed-artifact integration tests
+        working-directory: java
+        run: mvn --batch-mode --no-transfer-progress --file integration-tests/pom.xml verify

.github/workflows/node-release.yml

@@ -0,0 +1,150 @@
+name: Publish Node package to npm
+
+# The npm trusted publisher must reference this exact filename and the `npm`
+# environment (https://docs.npmjs.com/trusted-publishers).
+
+on:
+  release:
+    types: [published]
+
+permissions:
+  contents: read
+
+# cancel-in-progress: false — cancelling mid-publish can leave a release half done.
+concurrency:
+  group: node-release-${{ github.ref }}
+  cancel-in-progress: false
+
+jobs:
+  # Source of truth for the test matrix: package.json's supportedNodeVersions.
+  # node-v* tags only — test/build/publish inherit this via `needs`.
+  versions:
+    name: node versions
+    if: startsWith(github.ref_name, 'node-v')
+    runs-on: ubuntu-latest
+    timeout-minutes: 5
+    outputs:
+      data: ${{ steps.set.outputs.data }}
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Generate supported versions from package.json
+        id: set
+        working-directory: node
+        run: echo "data=$(npm run --silent list-supported-versions)" >> "$GITHUB_OUTPUT"
+
+  # Full support matrix gates the release. Ubuntu only: the package is pure JavaScript
+  # and the CI workflow already covers Windows and macOS. No dependency caching in
+  # release jobs, per npm's trusted-publishing guidance.
+  test:
+    name: test (Node ${{ matrix.node-version }})
+    needs: versions
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    strategy:
+      fail-fast: false  # report every version, not just the first failure
+      matrix:
+        node-version: ${{ fromJson(needs.versions.outputs.data).all }}
+    defaults:
+      run:
+        working-directory: node
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Node.js ${{ matrix.node-version }}
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+        with:
+          node-version: ${{ matrix.node-version }}
+          package-manager-cache: false
+
+      - name: Install and run the test suite
+        timeout-minutes: 10
+        run: |
+          npm ci
+          npm test
+
+  build:
+    name: build and verify
+    needs: [versions, test]
+    if: startsWith(github.ref_name, 'node-v')
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      - name: Set up Node.js
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+        with:
+          node-version: ${{ fromJson(needs.versions.outputs.data).max }}
+          package-manager-cache: false
+
+      # Tag must match package.json's version, `private` must be gone, CHANGELOG must
+      # have an entry, and repository.url must be set (provenance verifies it).
+      - name: Verify the tag matches the packaged version and the package is publishable
+        working-directory: node
+        run: npm run --silent verify -- "$GITHUB_REF_NAME"
+
+      - name: Build and pack the tarball
+        working-directory: node
+        timeout-minutes: 5
+        run: |
+          npm ci
+          npm run build
+          mkdir pack
+          npm pack --pack-destination pack
+
+      - name: Save the tarball for the publish job
+        uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7.0.1
+        with:
+          name: node-dist
+          path: node/pack/
+          if-no-files-found: error  # an empty artifact silently breaks the publish job
+
+  publish:
+    name: publish
+    needs: [versions, build]
+    # A fork that copies this workflow and its tags can never publish.
+    if: startsWith(github.ref_name, 'node-v') && github.repository_owner == 'aws'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    # Must match the environment name on the npm trusted publisher; carries the
+    # required-reviewer gate so a run alone cannot publish.
+    environment: npm
+    permissions:
+      # Job permissions REPLACE the top-level block, so restate contents: read.
+      contents: read
+      id-token: write  # OIDC token for npm trusted publishing
+    steps:
+      - name: Check out the repository
+        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
+
+      # No NODE_AUTH_TOKEN: auth comes from the OIDC token, which npm >= 11.5.1 uses
+      # automatically.
+      - name: Set up Node.js
+        uses: actions/setup-node@2028fbc5c25fe9cf00d9f06a71cc4710d4507903 # v6.0.0
+        with:
+          node-version: ${{ fromJson(needs.versions.outputs.data).max }}
+          registry-url: https://registry.npmjs.org
+          package-manager-cache: false
+
+      # The newest supported Node bundles npm >= 11.5.1; assert it rather than install
+      # npm from the registry at publish time.
+      - name: Verify again on the publishing runner, including the npm version
+        working-directory: node
+        run: npm run --silent verify -- "$GITHUB_REF_NAME" --require-npm 11.5.1
+
+      - name: Retrieve the tarball from the build job
+        uses: actions/download-artifact@3e5f45b2cfb9172054b4087a40e8e0b5a5461e7c # v8.0.1
+        with:
+          name: node-dist
+          path: node/pack/
+
+      - name: Publish to npm with provenance
+        run: npm publish node/pack/*.tgz --provenance --access public
+
+      # Retries for ~13 minutes (20 x 40s): the registry lags behind a publish.
+      - name: Smoke-test the published package
+        run: python3 scripts/node_dev.py smoke "${GITHUB_REF_NAME#node-v}"