feat(distribution): add pilot template sync automation

.github/workflows/sync-satellites.yml

@@ -0,0 +1,39 @@
+name: Sync template satellites
+
+on:
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  sync:
+    if: github.repository == 'Tuurio/auth_samples'
+    runs-on: ubuntu-latest
+    timeout-minutes: 20
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+        with:
+          persist-credentials: false
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: distribution/package-lock.json
+      - name: Require narrowly scoped satellite token
+        env:
+          SATELLITE_SYNC_TOKEN: ${{ secrets.SATELLITE_SYNC_TOKEN }}
+        run: |
+          if [ -z "$SATELLITE_SYNC_TOKEN" ]; then
+            echo "SATELLITE_SYNC_TOKEN is required and must be scoped only to the managed template repositories." >&2
+            exit 1
+          fi
+      - name: Install distribution tooling
+        working-directory: distribution
+        run: npm ci
+      - name: Sync pilot repositories
+        env:
+          GH_TOKEN: ${{ secrets.SATELLITE_SYNC_TOKEN }}
+        working-directory: distribution
+        run: npm run sync -- --id react-vite --id nextjs --id spring-boot --apply
+

.github/workflows/verify-satellites.yml

@@ -0,0 +1,30 @@
+name: Verify template satellites
+
+on:
+  workflow_dispatch:
+  schedule:
+    - cron: "17 5 * * 1"
+
+permissions:
+  contents: read
+
+jobs:
+  verify:
+    if: github.repository == 'Tuurio/auth_samples'
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - uses: actions/checkout@d23441a48e516b6c34aea4fa41551a30e30af803 # v6
+      - uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4
+        with:
+          node-version: 20
+          cache: npm
+          cache-dependency-path: distribution/package-lock.json
+      - name: Install distribution tooling
+        working-directory: distribution
+        run: npm ci
+      - name: Verify pilot repositories
+        env:
+          GH_TOKEN: ${{ github.token }}
+        working-directory: distribution
+        run: npm run verify:remotes -- --id react-vite --id nextjs --id spring-boot

.gitignore

@@ -1,11 +1,15 @@
 
-auth_samples_react/package-lock.json
 .env
 **/.env
 **/.env.local
 **/__pycache__/
 **/local.properties
 **/.idea/
 **/node_modules/
+**/.gradle/
+**/.next/
+**/build/
+**/dist/
+distribution/out/
 
 .DS_Store

auth_samples_java/.env.example

@@ -1,6 +1,6 @@
-TUURIO_ISSUER=https://test.id.tuurio.com
-TUURIO_CLIENT_ID=php-KQD8
-TUURIO_CLIENT_SECRET=YOUR_CLIENT_SECRET
+TUURIO_ISSUER=https://your-tenant.id.tuurio.com
+TUURIO_CLIENT_ID=replace-with-your-server-client-id
+TUURIO_CLIENT_SECRET=replace-with-your-client-secret
 TUURIO_REDIRECT_URI=http://localhost:8085/auth/callback
 TUURIO_POST_LOGOUT_REDIRECT_URI=http://localhost:8085/logout/callback
 TUURIO_SCOPE=openid,profile,email

auth_samples_java/README.md

@@ -11,8 +11,7 @@ A server-rendered Spring Boot demo that signs in with OAuth 2.0 / OpenID Connect
 
 ```bash
 cd auth_samples_java
-cp .env.example .env
-# edit .env with your tenant/client values
+npx manage-tuurio-id@1.1.6 init --framework spring --project-dir . --auth browser --yes --output json --campaign github_spring_boot --no-open --no-wait
 ./gradlew bootRun
 ```
 
@@ -30,9 +29,9 @@ Post-logout Redirect URI: http://localhost:8085/logout/callback
 ## `.env` keys
 
 ```env
-TUURIO_ISSUER=https://test.id.tuurio.com
-TUURIO_CLIENT_ID=php-KQD8
-TUURIO_CLIENT_SECRET=YOUR_CLIENT_SECRET
+TUURIO_ISSUER=https://your-tenant.id.tuurio.com
+TUURIO_CLIENT_ID=replace-with-your-server-client-id
+TUURIO_CLIENT_SECRET=replace-with-your-client-secret
 TUURIO_REDIRECT_URI=http://localhost:8085/auth/callback
 TUURIO_POST_LOGOUT_REDIRECT_URI=http://localhost:8085/logout/callback
 TUURIO_SCOPE=openid,profile,email

auth_samples_java/build.gradle

@@ -1,7 +1,7 @@
 plugins {
   id 'java'
-  id 'org.springframework.boot' version '3.3.2'
-  id 'io.spring.dependency-management' version '1.1.6'
+  id 'org.springframework.boot' version '4.0.7'
+  id 'io.spring.dependency-management' version '1.1.7'
 }
 
 group = 'com.tuurio'
@@ -19,6 +19,7 @@ java {
 
 dependencies {
   implementation 'org.springframework.boot:spring-boot-starter-web'
+  implementation 'org.springframework.boot:spring-boot-starter-jackson'
   implementation 'org.springframework.boot:spring-boot-starter-security'
   implementation 'org.springframework.boot:spring-boot-starter-oauth2-client'
   implementation 'org.springframework.boot:spring-boot-starter-thymeleaf'

auth_samples_java/gradle/wrapper/gradle-wrapper.properties

@@ -0,0 +1,7 @@
+distributionBase=GRADLE_USER_HOME
+distributionPath=wrapper/dists
+distributionUrl=https\://services.gradle.org/distributions/gradle-8.14.3-bin.zip
+networkTimeout=10000
+validateDistributionUrl=true
+zipStoreBase=GRADLE_USER_HOME
+zipStorePath=wrapper/dists