release.yml

name: Release to Maven Central

on:
  push:
    tags: ['v*']
  workflow_dispatch:
    inputs:
      dry_run:
        description: Build and sign without deploying
        type: boolean
        default: true

permissions:
  contents: read

jobs:
  publish:
    name: Publish
    runs-on: ubuntu-latest
    environment: maven-central
    # The last step creates the GitHub release and attaches the jars.
    permissions:
      contents: write

    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK 17 and the Central Portal credentials
        uses: actions/setup-java@v4
        with:
          distribution: temurin
          java-version: '17'
          cache: maven
          # Writes a settings.xml server entry with id "central", which the
          # central-publishing-maven-plugin reads.
          server-id: central
          server-username: CENTRAL_TOKEN_USERNAME
          server-password: CENTRAL_TOKEN_PASSWORD
          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
          gpg-passphrase: GPG_PASSPHRASE

      - name: Check the tag matches the project version
        if: startsWith(github.ref, 'refs/tags/v')
        run: |
          project=$(mvn -B -ntp -q help:evaluate -Dexpression=project.version -DforceStdout)
          tag=${GITHUB_REF_NAME#v}
          if [ "$project" != "$tag" ]; then
            echo "::error::tag $tag does not match project version $project"
            exit 1
          fi

      - name: Verify
        run: mvn -B -ntp verify

      - name: Build and sign only
        if: inputs.dry_run
        env:
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
        run: mvn -B -ntp -Prelease package

      - name: Deploy
        if: ${{ !inputs.dry_run }}
        env:
          CENTRAL_TOKEN_USERNAME: ${{ secrets.CENTRAL_TOKEN_USERNAME }}
          CENTRAL_TOKEN_PASSWORD: ${{ secrets.CENTRAL_TOKEN_PASSWORD }}
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
        # autoPublish is off in the pom, so this uploads and validates; releasing is a manual
        # step in the Central Portal.
        run: mvn -B -ntp -Prelease deploy

      - name: Attach the jars to the GitHub release
        if: startsWith(github.ref, 'refs/tags/v') && !inputs.dry_run
        uses: softprops/action-gh-release@v2
        with:
          files: |
            target/*.jar
            target/*.asc