From 580174a5722ce6a72619b6d6b07c257194d9bdeb Mon Sep 17 00:00:00 2001
From: Nathan Byrd <techy1@gmail.com>
Date: Sat, 4 Jul 2026 16:49:40 -0500
Subject: [PATCH] Fix release workflow secrets guard; bump version to 0.2.0
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

The secrets context is not allowed in step-level if: expressions — the
guards added in 7b30a2a made GitHub reject the whole workflow file at
plan time, so the v0.2.0 tag produced no release run (no jar upload, no
version bump). The presence check is hoisted into a job-level env var,
which IS allowed to read secrets.

The version bump the workflow would have pushed is included here since
the v0.2.0 tag event has already fired.

Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
---
 .github/workflows/release.yml | 9 +++++++--
 pom.xml                       | 2 +-
 2 files changed, 8 insertions(+), 3 deletions(-)

diff --git a/.github/workflows/release.yml b/.github/workflows/release.yml
index 75b3078..099661b 100644
--- a/.github/workflows/release.yml
+++ b/.github/workflows/release.yml
@@ -13,6 +13,11 @@ jobs:
   release:
     runs-on: ubuntu-latest
 
+    # The secrets context is not allowed in step `if:` expressions (the whole
+    # workflow fails to parse); hoist the presence check into an env var.
+    env:
+      HAS_SIGNING_KEY: ${{ secrets.GPG_PRIVATE_KEY != '' }}
+
     steps:
       - name: Checkout code
         uses: actions/checkout@v7
@@ -39,13 +44,13 @@ jobs:
       # secret is configured. Without it, a release still produces the GitHub
       # Release and attached jars above.
       - name: Set up GPG
-        if: ${{ secrets.GPG_PRIVATE_KEY != '' }}
+        if: env.HAS_SIGNING_KEY == 'true'
         run: |
           echo "${{ secrets.GPG_PRIVATE_KEY }}" | gpg --batch --import
           echo "${{ secrets.GPG_PASSPHRASE }}" | gpg --batch --import-ownertrust
 
       - name: Deploy to Maven Central
-        if: ${{ secrets.GPG_PRIVATE_KEY != '' }}
+        if: env.HAS_SIGNING_KEY == 'true'
         run: mvn deploy -P build-cli-jar -DskipTests --settings .github/maven-settings.xml
 
       - name: Update version in pom.xml
diff --git a/pom.xml b/pom.xml
index d14d486..968cc6e 100644
--- a/pom.xml
+++ b/pom.xml
@@ -6,7 +6,7 @@
     <artifactId>oashield</artifactId>
     <packaging>jar</packaging>
     <name>oashield</name>
-    <version>0.1.0</version>
+    <version>0.2.0</version>
     <build>
         <plugins>
             <plugin>