CI: Implement Automated Release Workflow for Maven Central Publishing

.github/workflows/release.yml

@@ -0,0 +1,148 @@
+name: Release
+
+on:
+  workflow_dispatch:
+    inputs:
+      version:
+        description: 'Release version (e.g., 7.0.5). Leave empty to use the current pom.xml version.'
+        required: false
+        type: string
+      skip-tests:
+        description: 'Skip running the test suite before deploying'
+        required: false
+        type: boolean
+        default: false
+
+permissions:
+  contents: write
+
+jobs:
+  release:
+    runs-on: ubuntu-latest
+
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v4
+        with:
+          fetch-depth: 0
+
+      - name: Verify required secrets are configured
+        env:
+          SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
+          SONATYPE_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
+          GPG_PRIVATE_KEY: ${{ secrets.GPG_PRIVATE_KEY }}
+          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+          GPG_KEYID: ${{ secrets.GPG_KEYID }}
+        run: |
+          missing=()
+
+          [ -z "$SONATYPE_USERNAME" ] && missing+=("SONATYPE_USERNAME")
+          [ -z "$SONATYPE_PASSWORD" ] && missing+=("SONATYPE_PASSWORD")
+          [ -z "$GPG_PRIVATE_KEY" ] && missing+=("GPG_PRIVATE_KEY")
+          [ -z "$GPG_PASSPHRASE" ] && missing+=("GPG_PASSPHRASE")
+          [ -z "$GPG_KEYID" ] && missing+=("GPG_KEYID")
+
+          if [ ${#missing[@]} -ne 0 ]; then
+            echo "::error::Missing required secrets: ${missing[*]}"
+            exit 1
+          fi
+
+          echo "All required secrets are configured."
+
+      - name: Set up JDK 11
+        uses: actions/setup-java@v6
+        with:
+          distribution: temurin
+          java-version: '11'
+          server-id: central
+          server-username: MAVEN_USERNAME
+          server-password: MAVEN_PASSWORD
+          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
+          gpg-passphrase-env-var: GPG_PASSPHRASE
+
+      - name: Grant execute permission to mvnw
+        run: chmod +x ./mvnw
+
+      - name: Cache Maven packages
+        uses: actions/cache@v4
+        with:
+          path: ~/.m2/repository
+          key: ${{ runner.os }}-maven-release-${{ hashFiles('**/pom.xml') }}
+          restore-keys: |
+            ${{ runner.os }}-maven-release-
+
+      - name: Set release version
+        if: ${{ inputs.version != '' }}
+        run: |
+          ./mvnw versions:set \
+            -DnewVersion="${{ inputs.version }}" \
+            -DgenerateBackupPoms=false
+
+      - name: Determine release version
+        id: release_version
+        run: |
+          VERSION=$(./mvnw help:evaluate \
+            -Dexpression=project.version \
+            -q \
+            -DforceStdout)
+
+          echo "version=$VERSION" >> "$GITHUB_OUTPUT"
+          echo "Releasing version: $VERSION"
+
+      - name: Check release tag does not already exist
+        env:
+          VERSION: ${{ steps.release_version.outputs.version }}
+        run: |
+          if git ls-remote --exit-code --tags origin "refs/tags/v$VERSION" >/dev/null 2>&1; then
+            echo "::error::Git tag v$VERSION already exists."
+            exit 1
+          fi
+
+      - name: Build and test
+        if: ${{ !inputs.skip-tests }}
+        run: ./mvnw clean verify -Pci-cd
+        env:
+          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+          GPG_KEYID: ${{ secrets.GPG_KEYID }}
+
+      - name: Deploy to Maven Central
+        run: ./mvnw clean deploy -Pci-cd -DskipTests
+        env:
+          MAVEN_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
+          MAVEN_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
+          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+          GPG_KEYID: ${{ secrets.GPG_KEYID }}
+
+      - name: Commit release version
+        if: ${{ inputs.version != '' }}
+        env:
+          VERSION: ${{ steps.release_version.outputs.version }}
+        run: |
+          git config user.name "github-actions[bot]"
+          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
+
+          git add pom.xml
+
+          if git diff --cached --quiet; then
+            echo "No pom.xml changes to commit."
+          else
+            git commit -m "Release v$VERSION"
+            git push origin HEAD:${{ github.ref_name }}
+          fi
+
+      - name: Create git tag
+        env:
+          VERSION: ${{ steps.release_version.outputs.version }}
+        run: |
+          git fetch --tags
+
+          git tag -a "v$VERSION" \
+            -m "Release v$VERSION"
+
+          git push origin "v$VERSION"
+
+      - name: Create GitHub Release
+        uses: softprops/action-gh-release@v2
+        with:
+          tag_name: v${{ steps.release_version.outputs.version }}
+          generate_release_notes: true