Release candidate

.github/workflows/cloud-51did.yml

@@ -3,17 +3,20 @@ name: Cloud 51Did Tests
 # Runs the live cloud 51Did integration test (pipeline/pipeline.did,
 # DidClientLiveTests) once for every _51DEGREES_RESOURCE_KEY* key passed in
 # below. Each run sets the single _51DEGREES_RESOURCE_KEY the test reads.
+# Only keys that carry the fodid product are passed in, because the tests ask
+# the cloud for a 51Did and fail, saying so, when a key gets an answer with no
+# identifier in it. That is entitlement working rather than a fault.
 #
 # The secrets are named one by one rather than passed as toJSON(secrets).
 # GitHub marks a workflow that hands every secret to a step as possibly
 # malicious and holds each run for manual approval, so the nightly never ran.
 # A new resource key therefore needs a line here as well as the organisation
 # secret.
 #
-# The test skips itself when no key is set, so a run with no secrets is green
-# and proves nothing. That is deliberate, because a pull request from a fork
-# has no secrets, and it is the reason the loop below reports which key each
-# run used.
+# A run with no key available fails. A cloud test that passes without
+# calling the cloud reports success having proved nothing, and that is worse
+# than a red job. A pull request from a fork gets no secrets, so run this
+# workflow from a branch in this repository.
 
 on:
   workflow_dispatch:
@@ -51,7 +54,6 @@ jobs:
       - name: Cloud 51Did test for each resource key secret
         shell: pwsh
         env:
-          _51DEGREES_RESOURCE_KEY_BASIC: ${{ vars._51DEGREES_RESOURCE_KEY_BASIC }}
           _51DEGREES_RESOURCE_KEY_BESPOKE: ${{ secrets._51DEGREES_RESOURCE_KEY_BESPOKE }}
           _51DEGREES_RESOURCE_KEY_51DID: ${{ vars._51DEGREES_RESOURCE_KEY_51DID }}
           # Without a license key the tests that redeem a sealed verdict skip.
@@ -63,8 +65,11 @@ jobs:
           $keys = Get-ChildItem env: |
             Where-Object { $_.Name -like '_51DEGREES_RESOURCE_KEY*' -and $_.Value }
           if (-not $keys) {
-            Write-Host 'No _51DEGREES_RESOURCE_KEY* secrets available; skipping.'
-            exit 0
+            throw ('No _51DEGREES_RESOURCE_KEY* secret is available, so the ' +
+              'live 51Did tests cannot call the cloud service. The keys ' +
+              'carry the fodid product these tests need. A pull request ' +
+              'from a fork gets no secrets, so run this workflow from a ' +
+              'branch in this repository.')
           }
           $failed = $false
           foreach ($k in $keys) {

.github/workflows/environment-variable-names.yml

@@ -0,0 +1,30 @@
+name: Environment variable names
+
+on:
+  pull_request:
+  push:
+    branches:
+      - main
+      - rc
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  environment-variable-names:
+    name: No tracked file names a variable starting with a digit or an old name
+    runs-on: ubuntu-latest
+    steps:
+      - name: Checkout repository
+        uses: actions/checkout@v4
+        with:
+          persist-credentials: false
+
+      - name: Test the check
+        shell: pwsh
+        run: Invoke-Pester -Path ./ci/check-environment-variable-names.Tests.ps1 -CI
+
+      - name: Check the names
+        shell: pwsh
+        run: ./ci/check-environment-variable-names.ps1

.github/workflows/monthly-copyright-update.yml

@@ -7,8 +7,8 @@ on:
         type: boolean
         default: false
   schedule:
-    # * is a special character in YAML so quote this string
-    - cron: '0 0 1 * *'
+    # The copyright year only changes once a year, so this runs on 1 January.
+    - cron: '0 0 1 1 *'
 
 jobs:
   Monthly_Copyright_Update:

.gitmodules

@@ -8,3 +8,6 @@
 	path = pipeline/owid-java
 	url = https://github.com/SWAN-community/owid-java.git
 	branch = main
+[submodule "pipeline/pipeline.core/configuration-validation"]
+	path = pipeline/pipeline.core/configuration-validation
+	url = ../configuration-validation

AGENTS.md

@@ -125,7 +125,7 @@ java -cp examples/ip-intelligence/console/target/ip-intelligence-java-examples.c
 ```
 
 The example downloads the Lite file first when it is not there. In place of
-the argument, the `51DEGREES_IPI_PATH` environment variable or system property
+the argument, the `_51DEGREES_IPI_PATH` environment variable or system property
 can give the absolute path of a data file that is already there.
 
 On Java 24 or later, add `--enable-native-access=ALL-UNNAMED` before the class
@@ -183,7 +183,7 @@ java -cp examples/device-detection/console/target/device-detection-java-examples
 
 It prints the same `Input values:` and `Results:` blocks as the on-premise
 example. The IP Intelligence cloud examples read their key from
-`51DEGREES_RESOURCE_KEY` first and `TestResourceKey` second, and
+`_51DEGREES_RESOURCE_KEY` first and `TestResourceKey` second, and
 `examples/ip-intelligence/README.md` gives the keys to create for them.
 
 ### Pitfalls
@@ -246,8 +246,11 @@ from wherever Maven is run. Do not add a `.mvn` folder below the root.
 
 Those folders are the data repository, a submodule of cxx, where each free
 data file is a `<file>.link` until `get-data-files.ps1` or `get-data-files.sh`
-downloads it. `ci/fetch-assets.ps1` runs the script, and the examples'
-`DataFileHelper.findDataFile` runs it for a file that is missing. Look for a
+downloads it. In CI, `ci/fetch-assets.ps1` puts every file there from
+common-ci's assets, which each run caches once, so no test job downloads a
+data file. A file added to the data repository needs an entry in
+common-ci's `steps/fetch-assets.ps1` before CI can use it. The examples'
+`DataFileHelper.findDataFile` runs the script for a file that is missing. Look for a
 free file by its folder and name, such as
 `device-detection/51Degrees-LiteV4.1.hash`, so the search does not stop at a
 file of the same name elsewhere, such as a Git LFS pointer in an old

CONTRIBUTING.md

@@ -1,4 +1,5 @@
 # Contributing
 
-If you wish to contribute to this project, please see the shared 51Degrees
-[guidance](https://github.com/51Degrees/common-ci/blob/main/CONTRIBUTING.md).
+Contributions are welcome. The [51Degrees contributing guide](https://github.com/51Degrees/.github/blob/main/CONTRIBUTING.md)
+explains where a change goes and how to propose it. It applies to every
+package in this repository.