release.yml

name: Release

on:
  push:
    tags: [ 'v*' ]
  workflow_dispatch:

# See build.yml for the rationale on FORCE_JAVASCRIPT_ACTIONS_TO_NODE24.
env:
  FORCE_JAVASCRIPT_ACTIONS_TO_NODE24: 'true'

jobs:
  release:
    runs-on: ubuntu-latest

    steps:
      - name: Check out
        uses: actions/checkout@v5

      - name: Set up JDK 21 (with Central + GPG config)
        uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: '21'
          cache: maven
          server-id: central
          server-username: CENTRAL_USERNAME
          server-password: CENTRAL_PASSWORD
          # Import the secret key into the gpg-agent, but do NOT pass the
          # passphrase via settings.xml — maven-gpg-plugin reads it from
          # the MAVEN_GPG_PASSPHRASE env var below, which avoids the
          # "Sensitive content loaded from settings.xml" warning.
          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}

      - name: Verify tag matches pom.xml version
        run: |
          POM_VERSION=$(mvn -q -DforceStdout help:evaluate -Dexpression=project.version)
          TAG_VERSION="${GITHUB_REF_NAME#v}"
          if [ "$POM_VERSION" != "$TAG_VERSION" ]; then
            echo "::error::tag v$TAG_VERSION does not match pom.xml version $POM_VERSION"
            exit 1
          fi

      - name: Publish to Maven Central
        env:
          CENTRAL_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
          CENTRAL_PASSWORD: ${{ secrets.CENTRAL_PASSWORD }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
        run: mvn -B -ntp -Prelease deploy