From 9a2edae29467e7b4cc8710bb061ef1e0e4323dc9 Mon Sep 17 00:00:00 2001 From: Davide Vacca Date: Tue, 7 Jul 2026 17:34:15 +0200 Subject: [PATCH 1/5] ci: use distributed lock for integration tests Replace concurrency group with onfido-actions/lock acquire/release steps to prevent parallel integration test execution across SDK repositories. The lock uses a git branch in onfido/ci-lock as an atomic mutex. A should-run-integration-tests step centralizes the condition check, keeping subsequent steps DRY. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/maven.yml | 22 ++++++++++++++++------ 1 file changed, 16 insertions(+), 6 deletions(-) diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml index 32f2ee1..e4169df 100644 --- a/.github/workflows/maven.yml +++ b/.github/workflows/maven.yml @@ -45,12 +45,21 @@ jobs: ${{ runner.os }}-maven- - name: Build with Maven run: mvn -B package --file pom.xml -Dmaven.test.skip - - name: Run integration tests with API token auth + - name: Should run integration tests + id: should-run-integration-tests if: ${{ github.repository_owner == 'onfido' && (github.event_name == 'pull_request' || github.event_name == 'release' || github.event_name == 'workflow_dispatch' || github.event_name == 'schedule') }} + run: echo "result=true" >> "$GITHUB_OUTPUT" + - name: Acquire integration test lock + if: steps.should-run-integration-tests.outputs.result == 'true' + uses: onfido/onfido-actions/lock/acquire@main + with: + github-token: ${{ secrets.CI_LOCK_TOKEN }} + - name: Run integration tests with API token auth + if: steps.should-run-integration-tests.outputs.result == 'true' run: mvn test env: ONFIDO_API_TOKEN: ${{ secrets.ONFIDO_API_TOKEN }} @@ -60,11 +69,7 @@ jobs: ONFIDO_SAMPLE_MOTION_ID_1: ${{ secrets.ONFIDO_SAMPLE_MOTION_ID_1 }} ONFIDO_SAMPLE_MOTION_ID_2: ${{ secrets.ONFIDO_SAMPLE_MOTION_ID_2 }} - name: Run integration tests with OAuth client credentials auth - if: ${{ github.repository_owner == 'onfido' && - (github.event_name == 'pull_request' || - github.event_name == 'release' || - github.event_name == 'workflow_dispatch' || - github.event_name == 'schedule') }} + if: steps.should-run-integration-tests.outputs.result == 'true' run: mvn test env: ONFIDO_OAUTH_CLIENT_ID: ${{ secrets.ONFIDO_OAUTH_CLIENT_ID }} @@ -74,6 +79,11 @@ jobs: ONFIDO_SAMPLE_VIDEO_ID_2: ${{ secrets.ONFIDO_SAMPLE_VIDEO_ID_2 }} ONFIDO_SAMPLE_MOTION_ID_1: ${{ secrets.ONFIDO_SAMPLE_MOTION_ID_1 }} ONFIDO_SAMPLE_MOTION_ID_2: ${{ secrets.ONFIDO_SAMPLE_MOTION_ID_2 }} + - name: Release integration test lock + if: always() && steps.should-run-integration-tests.outputs.result == 'true' + uses: onfido/onfido-actions/lock/release@main + with: + github-token: ${{ secrets.CI_LOCK_TOKEN }} publish: runs-on: ubuntu-latest From d7cd2aabe93d14d7827718f1604783a57e0e91ad Mon Sep 17 00:00:00 2001 From: Davide Vacca Date: Wed, 8 Jul 2026 09:50:56 +0200 Subject: [PATCH 2/5] test: temporarily target add-lock-action branch for lock actions This commit should be reverted before merging. --- .github/workflows/maven.yml | 4 ++-- 1 file changed, 2 insertions(+), 2 deletions(-) diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml index e4169df..3c6925b 100644 --- a/.github/workflows/maven.yml +++ b/.github/workflows/maven.yml @@ -55,7 +55,7 @@ jobs: run: echo "result=true" >> "$GITHUB_OUTPUT" - name: Acquire integration test lock if: steps.should-run-integration-tests.outputs.result == 'true' - uses: onfido/onfido-actions/lock/acquire@main + uses: onfido/onfido-actions/lock/acquire@add-lock-action with: github-token: ${{ secrets.CI_LOCK_TOKEN }} - name: Run integration tests with API token auth @@ -81,7 +81,7 @@ jobs: ONFIDO_SAMPLE_MOTION_ID_2: ${{ secrets.ONFIDO_SAMPLE_MOTION_ID_2 }} - name: Release integration test lock if: always() && steps.should-run-integration-tests.outputs.result == 'true' - uses: onfido/onfido-actions/lock/release@main + uses: onfido/onfido-actions/lock/release@add-lock-action with: github-token: ${{ secrets.CI_LOCK_TOKEN }} From 1eeec688c0cc45b32233c036c48c6ec7d1fcf5dc Mon Sep 17 00:00:00 2001 From: Davide Vacca Date: Thu, 9 Jul 2026 09:21:03 +0200 Subject: [PATCH 3/5] ci: use shared should-run-integration-tests action Use onfido-actions/should-run-integration-tests to determine when to run integration tests. This adds support for running tests on push events from merged fork PRs (where secrets aren't available pre-merge). Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/maven.yml | 8 ++------ 1 file changed, 2 insertions(+), 6 deletions(-) diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml index 3c6925b..5511057 100644 --- a/.github/workflows/maven.yml +++ b/.github/workflows/maven.yml @@ -47,12 +47,8 @@ jobs: run: mvn -B package --file pom.xml -Dmaven.test.skip - name: Should run integration tests id: should-run-integration-tests - if: ${{ github.repository_owner == 'onfido' && - (github.event_name == 'pull_request' || - github.event_name == 'release' || - github.event_name == 'workflow_dispatch' || - github.event_name == 'schedule') }} - run: echo "result=true" >> "$GITHUB_OUTPUT" + if: ${{ github.repository_owner == 'onfido' }} + uses: onfido/onfido-actions/should-run-integration-tests@add-lock-action - name: Acquire integration test lock if: steps.should-run-integration-tests.outputs.result == 'true' uses: onfido/onfido-actions/lock/acquire@add-lock-action From 38a01b4cd7606fb16fcfc38619277125fd21fba2 Mon Sep 17 00:00:00 2001 From: Davide Vacca Date: Fri, 10 Jul 2026 12:12:42 +0200 Subject: [PATCH 4/5] ci: use GitHub App for lock authentication Replace CI_LOCK_TOKEN with GitHub App credentials (ONFIDO_CI_LOCK_APP_ID, ONFIDO_CI_LOCK_PRIVATE_KEY, ONFIDO_CI_LOCK_INSTALLATION_ID) for the distributed lock mechanism. Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/maven.yml | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml index 5511057..306a539 100644 --- a/.github/workflows/maven.yml +++ b/.github/workflows/maven.yml @@ -53,7 +53,8 @@ jobs: if: steps.should-run-integration-tests.outputs.result == 'true' uses: onfido/onfido-actions/lock/acquire@add-lock-action with: - github-token: ${{ secrets.CI_LOCK_TOKEN }} + app-id: ${{ secrets.ONFIDO_CI_LOCK_APP_ID }} + app-private-key: ${{ secrets.ONFIDO_CI_LOCK_PRIVATE_KEY }} - name: Run integration tests with API token auth if: steps.should-run-integration-tests.outputs.result == 'true' run: mvn test @@ -79,7 +80,8 @@ jobs: if: always() && steps.should-run-integration-tests.outputs.result == 'true' uses: onfido/onfido-actions/lock/release@add-lock-action with: - github-token: ${{ secrets.CI_LOCK_TOKEN }} + app-id: ${{ secrets.ONFIDO_CI_LOCK_APP_ID }} + app-private-key: ${{ secrets.ONFIDO_CI_LOCK_PRIVATE_KEY }} publish: runs-on: ubuntu-latest From 263e53759675c1b88630b9f94738c2c669fe5f2b Mon Sep 17 00:00:00 2001 From: Davide Vacca Date: Fri, 10 Jul 2026 16:17:14 +0200 Subject: [PATCH 5/5] ci: point lock actions to onfido-actions@main Co-authored-by: Copilot <223556219+Copilot@users.noreply.github.com> --- .github/workflows/maven.yml | 6 +++--- 1 file changed, 3 insertions(+), 3 deletions(-) diff --git a/.github/workflows/maven.yml b/.github/workflows/maven.yml index 306a539..00b6959 100644 --- a/.github/workflows/maven.yml +++ b/.github/workflows/maven.yml @@ -48,10 +48,10 @@ jobs: - name: Should run integration tests id: should-run-integration-tests if: ${{ github.repository_owner == 'onfido' }} - uses: onfido/onfido-actions/should-run-integration-tests@add-lock-action + uses: onfido/onfido-actions/should-run-integration-tests@main - name: Acquire integration test lock if: steps.should-run-integration-tests.outputs.result == 'true' - uses: onfido/onfido-actions/lock/acquire@add-lock-action + uses: onfido/onfido-actions/lock/acquire@main with: app-id: ${{ secrets.ONFIDO_CI_LOCK_APP_ID }} app-private-key: ${{ secrets.ONFIDO_CI_LOCK_PRIVATE_KEY }} @@ -78,7 +78,7 @@ jobs: ONFIDO_SAMPLE_MOTION_ID_2: ${{ secrets.ONFIDO_SAMPLE_MOTION_ID_2 }} - name: Release integration test lock if: always() && steps.should-run-integration-tests.outputs.result == 'true' - uses: onfido/onfido-actions/lock/release@add-lock-action + uses: onfido/onfido-actions/lock/release@main with: app-id: ${{ secrets.ONFIDO_CI_LOCK_APP_ID }} app-private-key: ${{ secrets.ONFIDO_CI_LOCK_PRIVATE_KEY }}