Release 4.0.0 — v4 major version

.github/actions/maven-publish/action.yml

@@ -21,12 +21,14 @@ runs:
       uses: actions/checkout@v4
 
     - name: Set up Java
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # pin@v4
       with:
         distribution: 'temurin'
-        java-version: '11'
+        java-version: ${{ inputs.java-version }}
+        cache: 'gradle'
 
-    - uses: gradle/wrapper-validation-action@56b90f209b02bf6d1deae490e9ef18b21a389cd4 # pin@1.1.0
+    - name: Set up Gradle
+      uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # pin@v5
 
     - name: Publish Android/Java Packages to Maven
       shell: bash
@@ -36,4 +38,3 @@ runs:
         MAVEN_PASSWORD: ${{ inputs.ossr-token }}
         SIGNING_KEY: ${{ inputs.signing-key}}
         SIGNING_PASSWORD: ${{ inputs.signing-password}}
-

.github/actions/setup/action.yml

@@ -5,34 +5,25 @@ inputs:
   java:
     description: The Java version to use
     required: false
-    default: 8.0.382-tem
-  gradle:
-    description: The Gradle version to use
-    required: false
-    default: 6.7.1
-  kotlin:
-    description: The Kotlin version to use
-    required: false
-    default: 1.6.21
+    default: '17'
 
 runs:
   using: composite
 
   steps:
     - name: Set up Java
-      uses: actions/setup-java@v4
+      uses: actions/setup-java@c1e323688fd81a25caa38c78aa6df2d33d3e20d9 # pin@v4
       with:
         distribution: 'temurin'
-        java-version: '11'
+        java-version: ${{ inputs.java }}
+        cache: 'gradle'
 
-    - run: |
-        curl -s "https://get.sdkman.io" | bash
-        source "/home/runner/.sdkman/bin/sdkman-init.sh"
-        sdk install gradle ${{ inputs.gradle }} && sdk default gradle ${{ inputs.gradle }}
-        sdk install kotlin ${{ inputs.kotlin }} && sdk default kotlin ${{ inputs.kotlin }}
-      shell: bash
+    - name: Set up Gradle
+      uses: gradle/actions/setup-gradle@4d9f0ba0025fe599b4ebab900eb7f3a1d93ef4c2 # pin@v5
+      with:
+        gradle-version: wrapper
+        cache-cleanup: on-success
 
-    - run: ./gradlew androidDependencies
+    - name: Download dependencies
+      run: ./gradlew androidDependencies
       shell: bash
-
-    - uses: gradle/wrapper-validation-action@56b90f209b02bf6d1deae490e9ef18b21a389cd4 # pin@1.1.0

.github/workflows/codeql.yml

@@ -36,13 +36,13 @@ jobs:
         run: exit 0 # Skip unnecessary test runs for dependabot and merge queues. Artifically flag as successful, as this is a required check for branch protection.
 
       - name: Set up Java
-        uses: actions/setup-java@v5
+        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5.4.0
         with:
           distribution: 'temurin'
-          java-version: '11'
+          java-version: '17'
 
       - name: Checkout
-        uses: actions/checkout@v6
+        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - name: Initialize CodeQL
         uses: github/codeql-action/init@v4

.github/workflows/java-release.yml

@@ -24,13 +24,13 @@ on:
 
 jobs:
   release:
-    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/'))
+    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/') && github.event.pull_request.base.ref == 'v4_development')
     runs-on: ubuntu-latest
     environment: release
 
     steps:
       # Checkout the code
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
         with:
           fetch-depth: 0
 

.github/workflows/release.yml

@@ -4,6 +4,8 @@ on:
   pull_request:
     types:
       - closed
+    branches:
+      - v4_development
   workflow_dispatch:
 
 permissions:
@@ -16,23 +18,42 @@ permissions:
 
 jobs:
   rl-scanner:
-    uses: ./.github/workflows/rl-scanner.yml
-    with:
-      java-version: 8.0.402-zulu
-      artifact-name: 'auth0-release.aar'
-    secrets:
-      RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
-      RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
-      SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
-      PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
-      PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
-      PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
+    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/'))
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
+        with:
+          fetch-depth: 0
+
+      - name: Build with gradle
+        run: ./gradlew :auth0:assembleRelease
+
+      - name: Get version
+        id: get_version
+        run: |
+          version=$(cat .version)
+          echo "version=$version" >> $GITHUB_OUTPUT
+
+      - name: Run RL Scanner
+        uses: auth0/devsecops-tooling/.github/actions/rl-scan@main
+        with:
+          artifact-name: "auth0-android"
+          artifact-path: "${{ github.workspace }}/auth0/build/outputs/aar/auth0-release.aar"
+          version: ${{ steps.get_version.outputs.version }}
+          RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
+          RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
+          SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
+          SIGNAL_HANDLER_DOMAIN: ${{ secrets.SIGNAL_HANDLER_DOMAIN }}
+          PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
+          PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
+          PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
+          PRODSEC_PYTHON_TOOLS_REPO: ${{ secrets.PRODSEC_PYTHON_TOOLS_REPO }}
 
   release:
     uses: ./.github/workflows/java-release.yml
     needs: rl-scanner
     with:
-      java-version: 8.0.402-zulu
+      java-version: '17'
     secrets:
       ossr-username: ${{ secrets.OSSR_USERNAME }}
       ossr-token: ${{ secrets.OSSR_TOKEN }}

.github/workflows/rl-scanner.yml

@@ -1,78 +0,0 @@
-name: RL-Security-Scanner
-run-name: rl-security-scanner
-
-
-on:
-  workflow_call:
-    inputs:
-      java-version:
-        required: true
-        type: string
-      artifact-name:
-        required: true
-        type: string
-    secrets:
-      RLSECURE_LICENSE:
-        required: true
-      RLSECURE_SITE_KEY:
-        required: true
-      SIGNAL_HANDLER_TOKEN:
-        required: true
-      PRODSEC_TOOLS_USER:
-        required: true
-      PRODSEC_TOOLS_TOKEN:
-        required: true
-      PRODSEC_TOOLS_ARN:
-        required: true
-
-
-jobs:
-  rl-scanner:
-    name: Run Reversing Labs Scanner
-    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/'))
-    runs-on: ubuntu-latest
-    outputs:
-      scan-status: ${{ steps.rl-scan-conclusion.outcome }}
-
-
-    steps:
-      - name: Checkout code
-        uses: actions/checkout@v6
-        with:
-          fetch-depth: 0
-
-      - name: Build with gradle
-        shell: bash
-        run: ./gradlew :auth0:assembleRelease
-
-      - name: Get Artifact Version
-        id: get_version
-        run: |
-          version=$(cat .version)
-          echo "version=$version" >> $GITHUB_OUTPUT
-
-      - name: List build contents
-        run: ls -la auth0/build/outputs/aar
-
-      - name: Output build artifact
-        id: output_build_artifact
-        run: |
-          echo "scanfile=$(pwd)/auth0/build/outputs/aar/auth0-release-${{ steps.get_version.outputs.version }}.aar" >> $GITHUB_OUTPUT  
-
-
-      - name: Run Reversing Labs  Scanner
-        id: rl-scan-conclusion
-        uses: ./.github/actions/rl-scanner
-        with:
-          artifact-path: "$(pwd)/auth0/build/outputs/aar/${{ inputs.artifact-name }}"
-          version: "${{ steps.get_version.outputs.version }}"
-        env:
-          RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
-          RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
-          SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
-          PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
-          PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
-          PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
-
-      - name: Output scan result
-        run: echo "scan-status=${{ steps.rl-scan-conclusion.outcome }}" >> $GITHUB_ENV

.github/workflows/test.yml

@@ -6,6 +6,7 @@ on:
   pull_request:
     branches:
       - main
+      - v4_development
   push:
     branches:
       - main
@@ -23,10 +24,10 @@ jobs:
     runs-on: ubuntu-latest
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7.0.0
 
       - uses: ./.github/actions/setup
 
-      - run: ./gradlew clean test jacocoTestReport lint --continue --console=plain --max-workers=1 --no-daemon
+      - run: ./gradlew testReleaseUnitTest jacocoTestReleaseUnitTestReport lintRelease --continue --console=plain
 
-      - uses: codecov/codecov-action@671740ac38dd9b0130fbe1cec585b89eea48d3de # pin@5.5.2
+      - uses: codecov/codecov-action@fb8b3582c8e4def4969c97caa2f19720cb33a72f # pin@7.0.0