From 1cfd21cccf309738e99c4f82b02d2ef8495f4a32 Mon Sep 17 00:00:00 2001
From: Poovamraj T T <poovamraj@gmail.com>
Date: Tue, 19 Dec 2023 15:07:35 +0100
Subject: [PATCH 1/9] Automate release workflow

---
 .github/actions/get-prerelease/action.yml    | 30 +++++++
 .github/actions/get-release-notes/action.yml | 42 ++++++++++
 .github/actions/get-version/action.yml       | 21 +++++
 .github/actions/maven-publish/action.yml     | 44 ++++++++++
 .github/actions/release-create/action.yml    | 47 +++++++++++
 .github/actions/tag-exists/action.yml        | 36 ++++++++
 .github/workflows/java-release.yml           | 88 ++++++++++++++++++++
 .github/workflows/release.yml                | 27 ++++++
 lib/build.gradle                             | 16 ++--
 9 files changed, 343 insertions(+), 8 deletions(-)
 create mode 100644 .github/actions/get-prerelease/action.yml
 create mode 100644 .github/actions/get-release-notes/action.yml
 create mode 100644 .github/actions/get-version/action.yml
 create mode 100644 .github/actions/maven-publish/action.yml
 create mode 100644 .github/actions/release-create/action.yml
 create mode 100644 .github/actions/tag-exists/action.yml
 create mode 100644 .github/workflows/java-release.yml
 create mode 100644 .github/workflows/release.yml

diff --git a/.github/actions/get-prerelease/action.yml b/.github/actions/get-prerelease/action.yml
new file mode 100644
index 00000000..ce7acdc3
--- /dev/null
+++ b/.github/actions/get-prerelease/action.yml
@@ -0,0 +1,30 @@
+name: Return a boolean indicating if the version contains prerelease identifiers
+
+#
+# Returns a simple true/false boolean indicating whether the version indicates it's a prerelease or not.
+#
+# TODO: Remove once the common repo is public.
+#
+
+inputs:
+  version:
+    required: true
+
+outputs:
+  prerelease:
+    value: ${{ steps.get_prerelease.outputs.PRERELEASE }}
+
+runs:
+  using: composite
+
+  steps:
+    - id: get_prerelease
+      shell: bash
+      run: |
+        if [[ "${VERSION}" == *"beta"* || "${VERSION}" == *"alpha"* ]]; then
+          echo "PRERELEASE=true" >> $GITHUB_OUTPUT
+        else
+          echo "PRERELEASE=false" >> $GITHUB_OUTPUT
+        fi
+      env:
+        VERSION: ${{ inputs.version }}
diff --git a/.github/actions/get-release-notes/action.yml b/.github/actions/get-release-notes/action.yml
new file mode 100644
index 00000000..287d2066
--- /dev/null
+++ b/.github/actions/get-release-notes/action.yml
@@ -0,0 +1,42 @@
+name: Return the release notes extracted from the body of the PR associated with the release.
+
+#
+# Returns the release notes from the content of a pull request linked to a release branch. It expects the branch name to be in the format release/vX.Y.Z, release/X.Y.Z, release/vX.Y.Z-beta.N. etc.
+#
+# TODO: Remove once the common repo is public.
+#
+inputs:
+  version:
+    required: true
+  repo_name:
+    required: false
+  repo_owner:
+    required: true
+  token:
+    required: true
+
+outputs:
+  release-notes:
+    value: ${{ steps.get_release_notes.outputs.RELEASE_NOTES }}
+
+runs:
+  using: composite
+
+  steps:
+    - uses: actions/github-script@v7
+      id: get_release_notes
+      with:
+        result-encoding: string
+        script: |
+          const { data: pulls } = await github.rest.pulls.list({
+            owner: process.env.REPO_OWNER,
+            repo: process.env.REPO_NAME,
+            state: 'all',
+            head: `${process.env.REPO_OWNER}:release/${process.env.VERSION}`,
+          });
+          core.setOutput('RELEASE_NOTES', pulls[0].body);
+      env:
+        GITHUB_TOKEN: ${{ inputs.token }}
+        REPO_OWNER: ${{ inputs.repo_owner }}
+        REPO_NAME: ${{ inputs.repo_name }}
+        VERSION: ${{ inputs.version }}
diff --git a/.github/actions/get-version/action.yml b/.github/actions/get-version/action.yml
new file mode 100644
index 00000000..9440ec92
--- /dev/null
+++ b/.github/actions/get-version/action.yml
@@ -0,0 +1,21 @@
+name: Return the version extracted from the branch name
+
+#
+# Returns the version from the .version file.
+#
+# TODO: Remove once the common repo is public.
+#
+
+outputs:
+  version:
+    value: ${{ steps.get_version.outputs.VERSION }}
+
+runs:
+  using: composite
+
+  steps:
+    - id: get_version
+      shell: bash
+      run: |
+        VERSION=$(head -1 .version)
+        echo "VERSION=${VERSION}" >> $GITHUB_OUTPUT
diff --git a/.github/actions/maven-publish/action.yml b/.github/actions/maven-publish/action.yml
new file mode 100644
index 00000000..ee477061
--- /dev/null
+++ b/.github/actions/maven-publish/action.yml
@@ -0,0 +1,44 @@
+name: Publish release to Java
+
+inputs:
+  ossr-username:
+    required: true
+  ossr-password:
+    required: true
+  signing-key:
+    required: true
+  signing-password:
+    required: true
+  java-version:
+    required: true
+  is-android:
+    required: true
+  version:
+    required: true
+
+runs:
+  using: composite
+
+  steps:
+    - name: Checkout code
+      uses: actions/checkout@v4
+
+    - name: Setup Java
+      shell: bash
+      run: |
+        curl -s "https://get.sdkman.io" | bash
+        source "/home/runner/.sdkman/bin/sdkman-init.sh"
+        sdk list java
+        sdk install java ${{ inputs.java-version }} && sdk default java ${{ inputs.java-version }}
+
+    - uses: gradle/wrapper-validation-action@56b90f209b02bf6d1deae490e9ef18b21a389cd4 # pin@1.1.0
+
+    - name: Publish Java
+      shell: bash
+      if: inputs.is-android == 'false'
+      run: ./gradlew clean assemble sign publishMavenJavaPublicationToMavenRepository -PisSnapshot=false -Pversion="${{ inputs.version }}" -PossrhUsername="${{ inputs.ossr-username }}" -PossrhPassword="${{ inputs.ossr-password }}" -PsigningKey="${{ inputs.signing-key }}" -PsigningPassword="${{ inputs.signing-password }}"
+
+    - name: Publish Android
+      shell: bash
+      if: inputs.is-android == 'true'
+      run: ./gradlew clean assemble sign publishAndroidLibraryPublicationToMavenRepository -PisSnapshot=false -Pversion="${{ inputs.version }}" -PossrhUsername="${{ inputs.ossr-username }}" -PossrhPassword="${{ inputs.ossr-password }}" -PsigningKey="${{ inputs.signing-key }}" -PsigningPassword="${{ inputs.signing-password }}"
diff --git a/.github/actions/release-create/action.yml b/.github/actions/release-create/action.yml
new file mode 100644
index 00000000..6a2bf804
--- /dev/null
+++ b/.github/actions/release-create/action.yml
@@ -0,0 +1,47 @@
+name: Create a GitHub release
+
+#
+# Creates a GitHub release with the given version.
+#
+# TODO: Remove once the common repo is public.
+#
+
+inputs:
+  token:
+    required: true
+  files:
+    required: false
+  name:
+    required: true
+  body:
+    required: true
+  tag:
+    required: true
+  commit:
+    required: true
+  draft:
+    default: false
+    required: false
+  prerelease:
+    default: false
+    required: false
+  fail_on_unmatched_files:
+    default: true
+    required: false
+
+runs:
+  using: composite
+
+  steps:
+    - uses: softprops/action-gh-release@de2c0eb89ae2a093876385947365aca7b0e5f844
+      with:
+        body: ${{ inputs.body }}
+        name: ${{ inputs.name }}
+        tag_name: ${{ inputs.tag }}
+        target_commitish: ${{ inputs.commit }}
+        draft: ${{ inputs.draft }}
+        prerelease: ${{ inputs.prerelease }}
+        fail_on_unmatched_files: ${{ inputs.fail_on_unmatched_files }}
+        files: ${{ inputs.files }}
+      env:
+        GITHUB_TOKEN: ${{ inputs.token }}
diff --git a/.github/actions/tag-exists/action.yml b/.github/actions/tag-exists/action.yml
new file mode 100644
index 00000000..b5fbdb73
--- /dev/null
+++ b/.github/actions/tag-exists/action.yml
@@ -0,0 +1,36 @@
+name: Return a boolean indicating if a tag already exists for the repository
+
+#
+# Returns a simple true/false boolean indicating whether the tag exists or not.
+#
+# TODO: Remove once the common repo is public.
+#
+
+inputs:
+  token:
+    required: true
+  tag:
+    required: true
+
+outputs:
+  exists:
+    description: 'Whether the tag exists or not'
+    value: ${{ steps.tag-exists.outputs.EXISTS }}
+
+runs:
+  using: composite
+
+  steps:
+    - id: tag-exists
+      shell: bash
+      run: |
+        GET_API_URL="https://api.github.com/repos/${GITHUB_REPOSITORY}/git/ref/tags/${TAG_NAME}"
+        http_status_code=$(curl -LI $GET_API_URL -o /dev/null -w '%{http_code}\n' -s -H "Authorization: token ${GITHUB_TOKEN}")
+        if [ "$http_status_code" -ne "404" ] ; then
+          echo "EXISTS=true" >> $GITHUB_OUTPUT
+        else
+          echo "EXISTS=false" >> $GITHUB_OUTPUT
+        fi
+      env:
+        TAG_NAME: ${{ inputs.tag }}
+        GITHUB_TOKEN: ${{ inputs.token }}
diff --git a/.github/workflows/java-release.yml b/.github/workflows/java-release.yml
new file mode 100644
index 00000000..3f81eb14
--- /dev/null
+++ b/.github/workflows/java-release.yml
@@ -0,0 +1,88 @@
+name: Create Java and GitHub Release
+
+on:
+  workflow_call:
+    inputs:
+      java-version:
+        required: true
+        type: string
+      is-android:
+        required: true
+        type: string
+    secrets:
+      ossr-username:
+        required: true
+      ossr-password:
+        required: true
+      signing-key:
+        required: true
+      signing-password:
+        required: true
+      github-token:
+        required: true
+
+### TODO: Replace instances of './.github/actions/' w/ `auth0/dx-sdk-actions/` and append `@latest` after the common `dx-sdk-actions` repo is made public.
+### TODO: Also remove `get-prerelease`, `get-version`, `release-create`, `tag-create` and `tag-exists` actions from this repo's .github/actions folder once the repo is public.
+
+jobs:
+  release:
+    if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/'))
+    runs-on: ubuntu-latest
+    environment: release
+
+    steps:
+      # Checkout the code
+      - uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      # Get the version from the branch name
+      - id: get_version
+        uses: ./.github/actions/get-version
+
+      # Get the prerelease flag from the branch name
+      - id: get_prerelease
+        uses: ./.github/actions/get-prerelease
+        with:
+          version: ${{ steps.get_version.outputs.version }}
+
+      # Get the release notes
+      - id: get_release_notes
+        uses: ./.github/actions/get-release-notes
+        with:
+          token: ${{ secrets.github-token }}
+          version: ${{ steps.get_version.outputs.version }}
+          repo_owner: ${{ github.repository_owner }}
+          repo_name: ${{ github.event.repository.name }}
+
+      # Check if the tag already exists
+      - id: tag_exists
+        uses: ./.github/actions/tag-exists
+        with:
+          tag: ${{ steps.get_version.outputs.version }}
+          token: ${{ secrets.github-token }}
+
+      # If the tag already exists, exit with an error
+      - if: steps.tag_exists.outputs.exists == 'true'
+        run: exit 1
+
+      # Publish the release to Maven
+      - uses: ./.github/actions/maven-publish
+        with:
+          java-version: ${{ inputs.java-version }}
+          is-android: ${{ inputs.is-android }}
+          version: ${{ steps.get_version.outputs.version }}
+          ossr-username: ${{ secrets.ossr-username }}
+          ossr-password: ${{ secrets.ossr-password }}
+          signing-key: ${{ secrets.signing-key }}
+          signing-password: ${{ secrets.signing-password }}
+
+      # Create a release for the tag
+      - uses: ./.github/actions/release-create
+        with:
+          token: ${{ secrets.github-token }}
+          name: ${{ steps.get_version.outputs.version }}
+          body: ${{ steps.get_release_notes.outputs.release-notes }}
+          tag: ${{ steps.get_version.outputs.version }}
+          commit: ${{ github.sha }}
+          prerelease: ${{ steps.get_prerelease.outputs.prerelease }}
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
new file mode 100644
index 00000000..63482cca
--- /dev/null
+++ b/.github/workflows/release.yml
@@ -0,0 +1,27 @@
+name: Create GitHub Release
+
+on:
+  pull_request:
+    types:
+      - closed
+  workflow_dispatch:
+
+permissions:
+  contents: write
+
+### TODO: Replace instances of './.github/workflows/' w/ `auth0/dx-sdk-actions/workflows/` and append `@latest` after the common `dx-sdk-actions` repo is made public.
+### TODO: Also remove `get-prerelease`, `get-release-notes`, `get-version`, `maven-publish`, `release-create`, and `tag-exists` actions from this repo's .github/actions folder once the repo is public.
+### TODO: Also remove `java-release` workflow from this repo's .github/workflows folder once the repo is public.
+
+jobs:
+  release:
+    uses: ./.github/workflows/java-release.yml
+    with:
+      java-version: 8.0.382-tem
+      is-android: false
+    secrets:
+      ossr-username: ${{ secrets.OSSR_USERNAME }}
+      ossr-password: ${{ secrets.OSSR_PASSWORD }}
+      signing-key: ${{ secrets.SIGNING_KEY }}
+      signing-password: ${{ secrets.SIGNING_PASSWORD }}
+      github-token: ${{ secrets.GITHUB_TOKEN }}
diff --git a/lib/build.gradle b/lib/build.gradle
index c4e11764..aa134c32 100644
--- a/lib/build.gradle
+++ b/lib/build.gradle
@@ -31,12 +31,16 @@ tasks.named("checkstyleJmh").configure({
 
 logger.lifecycle("Using version ${version} for ${group}.${name}")
 
+def signingKey = findProperty('signingKey')
+def signingKeyPwd = findProperty('signingPassword')
+
 oss {
     name "java jwt"
     repository "java-jwt"
     organization "auth0"
     description "Java implementation of JSON Web Token (JWT)"
     baselineCompareVersion "4.1.0"
+    skipAssertSigningConfiguration true
 
     developers {
         auth0 {
@@ -54,6 +58,10 @@ oss {
     }
 }
 
+signing {
+    useInMemoryPgpKeys(signingKey, signingKeyPwd)
+}
+
 java {
     toolchain {
         languageVersion = JavaLanguageVersion.of(11)
@@ -158,14 +166,6 @@ jar {
 compileModuleInfoJava.dependsOn compileJava
 classes.dependsOn compileModuleInfoJava
 
-// Creates a version.txt file containing the current version of the SDK.
-// This file is picked up and parsed by our Ship Orb to determine the version.
-task exportVersion()  {
-    doLast {
-        new File(rootDir, "version.txt").text = "$version"
-    }
-}
-
 // you can pass any arguments JMH accepts via Gradle args.
 // Example: ./gradlew runJMH --args="-lrf"
 tasks.register('runJMH', JavaExec) {

From f47001a1192dc3364b89d4764725f85562ed4045 Mon Sep 17 00:00:00 2001
From: Poovamraj T T <poovamraj@gmail.com>
Date: Tue, 19 Dec 2023 15:10:35 +0100
Subject: [PATCH 2/9] Add .version and modify .shiprc

---
 .shiprc  | 1 +
 .version | 1 +
 2 files changed, 2 insertions(+)
 create mode 100644 .version

diff --git a/.shiprc b/.shiprc
index fe59345e..1b83cc62 100644
--- a/.shiprc
+++ b/.shiprc
@@ -1,6 +1,7 @@
 {
   "files": {
     "README.md": [],
+    ".version": [],
     "lib/build.gradle": ["version = \"{MAJOR}.{MINOR}.{PATCH}\""]
   },
   "prefixVersion": false
diff --git a/.version b/.version
new file mode 100644
index 00000000..64b5ae39
--- /dev/null
+++ b/.version
@@ -0,0 +1 @@
+4.4.0
\ No newline at end of file

From 17b3f9608cab9bdccd1b6953fa938884274d1f71 Mon Sep 17 00:00:00 2001
From: Frederik Prijck <frederik.prijck@auth0.com>
Date: Wed, 20 Dec 2023 14:26:46 +0100
Subject: [PATCH 3/9] Update .github/workflows/release.yml

Co-authored-by: Jim Anderson <jim.anderson@auth0.com>
---
 .github/workflows/release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 63482cca..7a98f05e 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,7 +17,7 @@ jobs:
   release:
     uses: ./.github/workflows/java-release.yml
     with:
-      java-version: 8.0.382-tem
+      java-version: 11.0.21-tem
       is-android: false
     secrets:
       ossr-username: ${{ secrets.OSSR_USERNAME }}

From fbd2fe6a82e80da24541e1db692162208683bbed Mon Sep 17 00:00:00 2001
From: tanya-sinha_atko <“sinha.tanya26@gmail.com”>
Date: Tue, 29 Oct 2024 00:06:02 +0530
Subject: [PATCH 4/9] updated workflow to use ossr-token

---
 .github/actions/maven-publish/action.yml | 21 ++++++++-------------
 .github/workflows/java-release.yml       | 10 +++-------
 .github/workflows/release.yml            |  3 +--
 3 files changed, 12 insertions(+), 22 deletions(-)

diff --git a/.github/actions/maven-publish/action.yml b/.github/actions/maven-publish/action.yml
index ee477061..e2436c5b 100644
--- a/.github/actions/maven-publish/action.yml
+++ b/.github/actions/maven-publish/action.yml
@@ -3,7 +3,7 @@ name: Publish release to Java
 inputs:
   ossr-username:
     required: true
-  ossr-password:
+  ossr-token:
     required: true
   signing-key:
     required: true
@@ -11,10 +11,6 @@ inputs:
     required: true
   java-version:
     required: true
-  is-android:
-    required: true
-  version:
-    required: true
 
 runs:
   using: composite
@@ -33,12 +29,11 @@ runs:
 
     - uses: gradle/wrapper-validation-action@56b90f209b02bf6d1deae490e9ef18b21a389cd4 # pin@1.1.0
 
-    - name: Publish Java
-      shell: bash
-      if: inputs.is-android == 'false'
-      run: ./gradlew clean assemble sign publishMavenJavaPublicationToMavenRepository -PisSnapshot=false -Pversion="${{ inputs.version }}" -PossrhUsername="${{ inputs.ossr-username }}" -PossrhPassword="${{ inputs.ossr-password }}" -PsigningKey="${{ inputs.signing-key }}" -PsigningPassword="${{ inputs.signing-password }}"
-
-    - name: Publish Android
+    - name: Publish Android/Java Packages to Maven
       shell: bash
-      if: inputs.is-android == 'true'
-      run: ./gradlew clean assemble sign publishAndroidLibraryPublicationToMavenRepository -PisSnapshot=false -Pversion="${{ inputs.version }}" -PossrhUsername="${{ inputs.ossr-username }}" -PossrhPassword="${{ inputs.ossr-password }}" -PsigningKey="${{ inputs.signing-key }}" -PsigningPassword="${{ inputs.signing-password }}"
+      run: ./gradlew publish -PisSnapshot=false --stacktrace
+      env:
+        MAVEN_USERNAME: ${{ inputs.ossr-username }}
+        MAVEN_PASSWORD: ${{ inputs.ossr-token }}
+        SIGNING_KEY: ${{ inputs.signing-key}}
+        SIGNING_PASSWORD: ${{ inputs.signing-password}}
\ No newline at end of file
diff --git a/.github/workflows/java-release.yml b/.github/workflows/java-release.yml
index 3f81eb14..cc38e928 100644
--- a/.github/workflows/java-release.yml
+++ b/.github/workflows/java-release.yml
@@ -6,13 +6,11 @@ on:
       java-version:
         required: true
         type: string
-      is-android:
-        required: true
-        type: string
+
     secrets:
       ossr-username:
         required: true
-      ossr-password:
+      ossr-token:
         required: true
       signing-key:
         required: true
@@ -70,10 +68,8 @@ jobs:
       - uses: ./.github/actions/maven-publish
         with:
           java-version: ${{ inputs.java-version }}
-          is-android: ${{ inputs.is-android }}
-          version: ${{ steps.get_version.outputs.version }}
           ossr-username: ${{ secrets.ossr-username }}
-          ossr-password: ${{ secrets.ossr-password }}
+          ossr-token: ${{ secrets.ossr-token }}
           signing-key: ${{ secrets.signing-key }}
           signing-password: ${{ secrets.signing-password }}
 
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 7a98f05e..ceb3695d 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -18,10 +18,9 @@ jobs:
     uses: ./.github/workflows/java-release.yml
     with:
       java-version: 11.0.21-tem
-      is-android: false
     secrets:
       ossr-username: ${{ secrets.OSSR_USERNAME }}
-      ossr-password: ${{ secrets.OSSR_PASSWORD }}
+      ossr-token: ${{ secrets.OSSR_TOKEN }}
       signing-key: ${{ secrets.SIGNING_KEY }}
       signing-password: ${{ secrets.SIGNING_PASSWORD }}
       github-token: ${{ secrets.GITHUB_TOKEN }}

From 61ec56a54ea70e711b02f7de444b30e038e4e97f Mon Sep 17 00:00:00 2001
From: tanya-sinha_atko <“sinha.tanya26@gmail.com”>
Date: Tue, 29 Oct 2024 11:35:38 +0530
Subject: [PATCH 5/9] added rl-scanner changes

---
 .github/actions/rl-scanner/action.yml | 66 +++++++++++++++++++++++
 .github/workflows/release.yml         | 17 +++++-
 .github/workflows/rl-secure.yml       | 77 +++++++++++++++++++++++++++
 3 files changed, 159 insertions(+), 1 deletion(-)
 create mode 100644 .github/actions/rl-scanner/action.yml
 create mode 100644 .github/workflows/rl-secure.yml

diff --git a/.github/actions/rl-scanner/action.yml b/.github/actions/rl-scanner/action.yml
new file mode 100644
index 00000000..fbf81217
--- /dev/null
+++ b/.github/actions/rl-scanner/action.yml
@@ -0,0 +1,66 @@
+name: 'Reversing Labs Scanner'
+description: 'Runs the Reversing Labs scanner on a specified artifact.'
+inputs:
+  artifact-path:
+    description: 'Path to the artifact to be scanned.'
+    required: true
+  version:
+    description: 'Version of the artifact.'
+    required: true
+
+runs:
+  using: 'composite'
+  steps:
+    - name: Set up Python
+      uses: actions/setup-python@v4
+      with:
+        python-version: '3.10'
+
+    - name: Install Python dependencies
+      shell: bash
+      run: |
+        pip install boto3 requests
+    - name: Configure AWS credentials
+      uses: aws-actions/configure-aws-credentials@v1
+      with:
+        role-to-assume: ${{ env.PRODSEC_TOOLS_ARN }}
+        aws-region: us-east-1
+        mask-aws-account-id: true
+
+    - name: Install RL Wrapper
+      shell: bash
+      run: |
+        pip install rl-wrapper>=1.0.0 --index-url "https://${{ env.PRODSEC_TOOLS_USER }}:${{ env.PRODSEC_TOOLS_TOKEN }}@a0us.jfrog.io/artifactory/api/pypi/python-local/simple"
+    - name: Run RL Scanner
+      shell: bash
+      env:
+        RLSECURE_LICENSE: ${{ env.RLSECURE_LICENSE }}
+        RLSECURE_SITE_KEY: ${{ env.RLSECURE_SITE_KEY }}
+        SIGNAL_HANDLER_TOKEN: ${{ env.SIGNAL_HANDLER_TOKEN }}
+        PYTHONUNBUFFERED: 1
+      run: |
+        if [ ! -f "${{ inputs.artifact-path }}" ]; then
+          echo "Artifact not found: ${{ inputs.artifact-path }}"
+          exit 1
+        fi
+        rl-wrapper \
+          --artifact "${{ inputs.artifact-path }}" \
+          --name "${{ github.event.repository.name }}" \
+          --version "${{ inputs.version }}" \
+          --repository "${{ github.repository }}" \
+          --commit "${{ github.sha }}" \
+          --build-env "github_actions" \
+          --suppress_output
+        # Check the outcome of the scanner
+        if [ $? -ne 0 ]; then
+          echo "RL Scanner failed."
+          echo "scan-status=failed" >> $GITHUB_ENV
+          exit 1
+        else
+          echo "RL Scanner passed."
+          echo "scan-status=success" >> $GITHUB_ENV
+        fi
+outputs:
+  scan-status:
+    description: 'The outcome of the scan process.'
+    value: ${{ env.scan-status }}
\ No newline at end of file
diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ceb3695d..e470ad40 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -5,6 +5,9 @@ on:
     types:
       - closed
   workflow_dispatch:
+  push:
+    branches:
+      - 'add-reversing-lab'
 
 permissions:
   contents: write
@@ -14,10 +17,22 @@ permissions:
 ### TODO: Also remove `java-release` workflow from this repo's .github/workflows folder once the repo is public.
 
 jobs:
+  rl-scanner:
+    uses: ./.github/workflows/rl-secure.yml
+    with:
+      java-version: 8.0.382-tem
+      artifact-name: 'java-jwt.jar'
+    secrets:
+      RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
+      RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
+      SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
+      PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
+      PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
+      PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
   release:
     uses: ./.github/workflows/java-release.yml
     with:
-      java-version: 11.0.21-tem
+      java-version: 8.0.382-tem
     secrets:
       ossr-username: ${{ secrets.OSSR_USERNAME }}
       ossr-token: ${{ secrets.OSSR_TOKEN }}
diff --git a/.github/workflows/rl-secure.yml b/.github/workflows/rl-secure.yml
new file mode 100644
index 00000000..114e2468
--- /dev/null
+++ b/.github/workflows/rl-secure.yml
@@ -0,0 +1,77 @@
+name: RL-Secure Workflow
+
+on:
+  workflow_call:
+    inputs:
+      java-version:
+        required: true
+        type: string
+      artifact-name:
+        required: true
+        type: string
+    secrets:
+      RLSECURE_LICENSE:
+        required: true
+      RLSECURE_SITE_KEY:
+        required: true
+      SIGNAL_HANDLER_TOKEN:
+        required: true
+      PRODSEC_TOOLS_USER:
+        required: true
+      PRODSEC_TOOLS_TOKEN:
+        required: true
+      PRODSEC_TOOLS_ARN:
+        required: true
+
+jobs:
+  rl-scanner:
+    name: Run Reversing Labs Scanner
+    ### if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/'))
+    runs-on: ubuntu-latest
+    outputs:
+      scan-status: ${{ steps.rl-scan-conclusion.outcome }}
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Build with Gradle
+        uses: gradle/gradle-build-action@a4cf152f482c7ca97ef56ead29bf08bcd953284c
+        with:
+          arguments: assemble apiDiff check jacocoTestReport --continue --console=plain
+
+      - name: Get Artifact Version
+        id: get_version
+        run: echo "::set-output name=version::$(cat .version)"
+
+      - name: List build/libs contents
+        run: ls -la build/libs
+
+      - name: Output build artifact
+        id: output_build_artifact
+        run: |
+          echo "scanfile=$(pwd)/build/libs/java-jwt-${{ steps.get_version.outputs.version }}.jar" >> $GITHUB_OUTPUT
+      - name: Use scanfile
+        run: echo "The scanfile is ${{ steps.output_build_artifact.outputs.scanfile }}"
+
+      - name: Echo version
+        run: echo "The version is ${{ steps.get_version.outputs.version }}"
+
+      - name: Run RL Scanner
+        id: rl-scan-conclusion
+        uses: ./.github/actions/rl-scanner
+        with:
+          artifact-path: "$(pwd)/build/libs/java-jwt-${{ steps.get_version.outputs.version }}-SNAPSHOT.jar"
+          version: "${{ steps.get_version.outputs.version }}"
+        env:
+          RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
+          RLSECURE_SITE_KEY: ${{ secrets.RLSECURE_SITE_KEY }}
+          SIGNAL_HANDLER_TOKEN: ${{ secrets.SIGNAL_HANDLER_TOKEN }}
+          PRODSEC_TOOLS_USER: ${{ secrets.PRODSEC_TOOLS_USER }}
+          PRODSEC_TOOLS_TOKEN: ${{ secrets.PRODSEC_TOOLS_TOKEN }}
+          PRODSEC_TOOLS_ARN: ${{ secrets.PRODSEC_TOOLS_ARN }}
+
+      - name: Output scan result
+        run: echo "scan-status=${{ steps.rl-scan-conclusion.outcome }}" >> $GITHUB_ENV
\ No newline at end of file

From 6538668c043ac0e0813ce750565a1c28f4b76810 Mon Sep 17 00:00:00 2001
From: tanya732 <“sinha.tanya26@gmail.com”>
Date: Wed, 30 Oct 2024 00:09:11 +0530
Subject: [PATCH 6/9] added rl-scanner modifications

---
 .github/workflows/release.yml   |  5 +++--
 .github/workflows/rl-secure.yml | 26 +++++++++++---------------
 lib/build.gradle                |  4 ++--
 3 files changed, 16 insertions(+), 19 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index e470ad40..e34417d2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -11,6 +11,7 @@ on:
 
 permissions:
   contents: write
+  id-token: write # This is required for requesting the JWT
 
 ### TODO: Replace instances of './.github/workflows/' w/ `auth0/dx-sdk-actions/workflows/` and append `@latest` after the common `dx-sdk-actions` repo is made public.
 ### TODO: Also remove `get-prerelease`, `get-release-notes`, `get-version`, `maven-publish`, `release-create`, and `tag-exists` actions from this repo's .github/actions folder once the repo is public.
@@ -20,7 +21,7 @@ jobs:
   rl-scanner:
     uses: ./.github/workflows/rl-secure.yml
     with:
-      java-version: 8.0.382-tem
+      java-version: 11
       artifact-name: 'java-jwt.jar'
     secrets:
       RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
@@ -32,7 +33,7 @@ jobs:
   release:
     uses: ./.github/workflows/java-release.yml
     with:
-      java-version: 8.0.382-tem
+      java-version: 11.0.21-tem
     secrets:
       ossr-username: ${{ secrets.OSSR_USERNAME }}
       ossr-token: ${{ secrets.OSSR_TOKEN }}
diff --git a/.github/workflows/rl-secure.yml b/.github/workflows/rl-secure.yml
index 114e2468..6d620fbb 100644
--- a/.github/workflows/rl-secure.yml
+++ b/.github/workflows/rl-secure.yml
@@ -24,8 +24,7 @@ on:
         required: true
 
 jobs:
-  rl-scanner:
-    name: Run Reversing Labs Scanner
+  checkout-build-scan-only:
     ### if: github.event_name == 'workflow_dispatch' || (github.event_name == 'pull_request' && github.event.pull_request.merged && startsWith(github.event.pull_request.head.ref, 'release/'))
     runs-on: ubuntu-latest
     outputs:
@@ -37,6 +36,12 @@ jobs:
         with:
           fetch-depth: 0
 
+      - name: Set up Java
+        uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: ${{ inputs.java-version }}
+
       - name: Build with Gradle
         uses: gradle/gradle-build-action@a4cf152f482c7ca97ef56ead29bf08bcd953284c
         with:
@@ -44,26 +49,17 @@ jobs:
 
       - name: Get Artifact Version
         id: get_version
-        run: echo "::set-output name=version::$(cat .version)"
+        uses: ./.github/actions/get-version
 
-      - name: List build/libs contents
-        run: ls -la build/libs
-
-      - name: Output build artifact
-        id: output_build_artifact
+      - name: Create tgz build artifact
         run: |
-          echo "scanfile=$(pwd)/build/libs/java-jwt-${{ steps.get_version.outputs.version }}.jar" >> $GITHUB_OUTPUT
-      - name: Use scanfile
-        run: echo "The scanfile is ${{ steps.output_build_artifact.outputs.scanfile }}"
-
-      - name: Echo version
-        run: echo "The version is ${{ steps.get_version.outputs.version }}"
+          tar -czvf ${{ inputs.artifact-name }} *
 
       - name: Run RL Scanner
         id: rl-scan-conclusion
         uses: ./.github/actions/rl-scanner
         with:
-          artifact-path: "$(pwd)/build/libs/java-jwt-${{ steps.get_version.outputs.version }}-SNAPSHOT.jar"
+          artifact-path: "$(pwd)/${{ inputs.artifact-name }}"
           version: "${{ steps.get_version.outputs.version }}"
         env:
           RLSECURE_LICENSE: ${{ secrets.RLSECURE_LICENSE }}
diff --git a/lib/build.gradle b/lib/build.gradle
index aa134c32..bcd26ee9 100644
--- a/lib/build.gradle
+++ b/lib/build.gradle
@@ -35,7 +35,7 @@ def signingKey = findProperty('signingKey')
 def signingKeyPwd = findProperty('signingPassword')
 
 oss {
-    name "java jwt"
+    name "java-jwt"
     repository "java-jwt"
     organization "auth0"
     description "Java implementation of JSON Web Token (JWT)"
@@ -64,7 +64,7 @@ signing {
 
 java {
     toolchain {
-        languageVersion = JavaLanguageVersion.of(11)
+        languageVersion = JavaLanguageVersion.of(8)
     }
 }
 

From bfcd56d6e792e9dcdd8ac3161da2c60a9a1da175 Mon Sep 17 00:00:00 2001
From: tanya732 <“sinha.tanya26@gmail.com”>
Date: Wed, 30 Oct 2024 16:35:38 +0530
Subject: [PATCH 7/9] changed java-version

---
 .github/workflows/release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index ceb3695d..715a0bc8 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -17,7 +17,7 @@ jobs:
   release:
     uses: ./.github/workflows/java-release.yml
     with:
-      java-version: 11.0.21-tem
+      java-version: 8.0.382-tem
     secrets:
       ossr-username: ${{ secrets.OSSR_USERNAME }}
       ossr-token: ${{ secrets.OSSR_TOKEN }}

From be1ed0e03c92f55405fa0a1a2d3367e00736ffb9 Mon Sep 17 00:00:00 2001
From: tanya732 <“sinha.tanya26@gmail.com”>
Date: Wed, 30 Oct 2024 16:47:34 +0530
Subject: [PATCH 8/9] Revert "changed java-version"

This reverts commit bfcd56d6e792e9dcdd8ac3161da2c60a9a1da175.
---
 .github/workflows/release.yml | 2 +-
 1 file changed, 1 insertion(+), 1 deletion(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 3e8eb83a..e34417d2 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -33,7 +33,7 @@ jobs:
   release:
     uses: ./.github/workflows/java-release.yml
     with:
-      java-version: 8.0.382-tem
+      java-version: 11.0.21-tem
     secrets:
       ossr-username: ${{ secrets.OSSR_USERNAME }}
       ossr-token: ${{ secrets.OSSR_TOKEN }}

From 45b2cbf7a75890884b08f1769c22474eb990b1d3 Mon Sep 17 00:00:00 2001
From: tanya732 <“sinha.tanya26@gmail.com”>
Date: Wed, 30 Oct 2024 17:22:22 +0530
Subject: [PATCH 9/9] updated toolchain to java 11

---
 lib/build.gradle | 6 +++---
 1 file changed, 3 insertions(+), 3 deletions(-)

diff --git a/lib/build.gradle b/lib/build.gradle
index bcd26ee9..972d9cb4 100644
--- a/lib/build.gradle
+++ b/lib/build.gradle
@@ -64,14 +64,14 @@ signing {
 
 java {
     toolchain {
-        languageVersion = JavaLanguageVersion.of(8)
+        languageVersion = JavaLanguageVersion.of(11)
     }
 }
 
 compileJava {
     exclude 'module-info.java'
     // Required to be compatible with JDK 8+
-    options.release = 8
+    options.release = 11
 }
 
 javadoc {
@@ -130,7 +130,7 @@ task compileModuleInfoJava(type: JavaCompile) {
 }
 
 compileTestJava {
-    options.release = 8
+    options.release = 11
     options.compilerArgs = ["-Xlint:deprecation"]
 }