build

feat(signing): L1 signing — RFC 9421, KMS providers, JWKS, webhook verification #93

	name: build

	on:
	pull_request:
	push:
	branches: [main]

	permissions:
	contents: read

	jobs:
	build:
	name: ./gradlew build (JDK 21)
	runs-on: ubuntu-latest
	steps:
	- uses: actions/checkout@v4

	- name: Set up JDK 21
	uses: actions/setup-java@v4
	with:
	java-version: '21'
	distribution: 'temurin'

	- name: Set up Gradle
	uses: gradle/actions/setup-gradle@v4
	with:
	# Wrapper-validation guards against a tampered gradle-wrapper.jar
	# — the standard supply-chain check for OSS Java repos.
	validate-wrappers: true

	- name: Install cosign
	# Schema-bundle fetcher (per D4) shells out to `cosign verify-blob`
	# against the AdCP release workflow's Sigstore signature. Building
	# the adcp module triggers fetchSchemaBundle → cosign.
	uses: sigstore/cosign-installer@v3

	- name: Build all modules
	run: ./gradlew build :build-logic:test --stacktrace

	- name: Verify lockfiles are up to date
	# Regenerate all lockfiles and fail the build if any file changed.
	# updateLocks resolves every resolvable configuration in every subproject
	# (official resolveAndLockAll pattern from Gradle docs). Gradle also
	# rewrites settings-gradle.lockfile when --write-locks is active.
	# Keeps checked-in lockfiles from drifting when dependencies are bumped
	# without running `./gradlew updateLocks --write-locks`.
	run: \|
	./gradlew updateLocks --write-locks -q
	git diff --exit-code -- '**/gradle.lockfile' settings-gradle.lockfile

Provide feedback