From da7fd378933a6143fe17fe420e80ce4e5d8fa302 Mon Sep 17 00:00:00 2001
From: Claude <noreply@anthropic.com>
Date: Mon, 12 Oct 2026 03:39:22 +0000
Subject: [PATCH] Add GitHub Actions CI running mvn verify on JDK 27

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01G71TQ5jDETVwdUJxGAwaiT
---
 .github/workflows/ci.yml | 31 +++++++++++++++++++++++++++++++
 docs/PLAN.md             |  2 +-
 2 files changed, 32 insertions(+), 1 deletion(-)
 create mode 100644 .github/workflows/ci.yml

diff --git a/.github/workflows/ci.yml b/.github/workflows/ci.yml
new file mode 100644
index 0000000..eca744e
--- /dev/null
+++ b/.github/workflows/ci.yml
@@ -0,0 +1,31 @@
+name: CI
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+
+permissions:
+  contents: read
+
+jobs:
+  build:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: actions/setup-java@v4
+        with:
+          distribution: temurin
+          java-version: '27'
+          cache: maven
+
+      - name: Build and test
+        run: mvn -B -ntp verify
+
+      - name: Upload test reports
+        if: failure()
+        uses: actions/upload-artifact@v4
+        with:
+          name: surefire-reports
+          path: '**/target/surefire-reports/'
diff --git a/docs/PLAN.md b/docs/PLAN.md
index 487549d..955d355 100644
--- a/docs/PLAN.md
+++ b/docs/PLAN.md
@@ -173,7 +173,7 @@ Actuator is optional; when the `pgpkeys` endpoint is exposed
 Extension points: `KeyDiscoveryCustomizer` (wraps WKD discovery below the cache) and `SecureMailSenderCustomizer`.
 
 ## Milestones
-1. **Skeleton** — parent POM, modules, CI. ✅
+1. **Skeleton** — parent POM, modules, CI (GitHub Actions, `mvn verify` on Temurin 27). ✅
 2. **WKD discovery + cache** — `WkdKeyDiscovery`, `HttpWkdFetcher`, `CachingKeyDiscovery`, static/composite discovery,
    properties + autoconfig for discovery beans. Tests: z-base-32 vector, advanced/direct fallback matrix,
    size limit, no redirects, cache TTLs. ✅