Add legends and secure checkout SVG to checkout #7235

	name: Build payment-api

	on:
	pull_request:
	workflow_dispatch:
	push:
	branches:
	- main
	env:
	GU_SUPPORT_WORKERS_LOAD_S3_CONFIG: false

	jobs:
	payment_api_build:
	if: >-
	(github.actor != 'dependabot[bot]') &&
	(github.repository_owner == 'guardian' \|\|
	github.event_name == 'push')

	# Required by actions-assume-aws-role
	permissions:
	id-token: write
	contents: read

	name: payment-api build
	runs-on: ubuntu-latest
	steps:
	- name: Env
	run: env

	- name: Checkout repo
	uses: actions/checkout@v4

	- name: Setup Node for CDK
	uses: actions/setup-node@v4
	with:
	node-version: 18
	cache: "yarn"
	cache-dependency-path: cdk/yarn.lock

	- name: Build CFN from CDK
	run: ./script/ci
	working-directory: cdk

	# Required by sbt riffRaffUpload
	- name: Configure AWS credentials
	uses: aws-actions/configure-aws-credentials@v4
	with:
	role-to-assume: ${{ secrets.GU_RIFF_RAFF_ROLE_ARN }}
	aws-region: eu-west-1

	- name: Setup Java
	uses: actions/setup-java@v4
	with:
	java-version: "21"
	distribution: "corretto"
	cache: sbt

	- name: Build and upload to RiffRaff
	run: \|
	export LAST_TEAMCITY_BUILD=6000
	export GITHUB_RUN_NUMBER=$(( $GITHUB_RUN_NUMBER + $LAST_TEAMCITY_BUILD ))
	sbt "project support-payment-api" clean riffRaffUpload

Provide feedback