ci: adopt release-please for automated versioning and Maven Central publishing

.github/dependabot.yml

@@ -5,11 +5,17 @@ updates:
     schedule:
       interval: "weekly"
     open-pull-requests-limit: 19
+    commit-message:
+      prefix: "chore"
+      prefix-development: "chore"
     labels:
       - "Type: dependencies"
   - package-ecosystem: "github-actions"
     directory: "/"
     schedule:
       interval: "daily"
+    commit-message:
+      prefix: "chore"
+      prefix-development: "chore"
     labels:
       - "Type: dependencies"

.github/workflows/development.yml

@@ -9,13 +9,11 @@ on:
       - '*'         # matches every branch that doesn't contain a '/'
       - '*/*'       # matches every branch containing a single '/'
       - '**'        # matches every branch
-      - '!master'
   pull_request:
     branches:
       - '*'         # matches every branch that doesn't contain a '/'
       - '*/*'       # matches every branch containing a single '/'
       - '**'        # matches every branch
-      - '!master'
   workflow_dispatch:
     inputs:
       skip_tests:

.github/workflows/pr-title.yml

@@ -0,0 +1,34 @@
+name: PR Title
+
+on:
+  pull_request:
+    types: [opened, edited, synchronize, reopened]
+
+permissions:
+  pull-requests: read
+
+concurrency:
+  group: pr-title-${{ github.event.pull_request.number }}
+  cancel-in-progress: true
+
+jobs:
+  validate-pr-title:
+    name: Validate PR title (Conventional Commits)
+    runs-on: ubuntu-latest
+    steps:
+      - uses: amannn/action-semantic-pull-request@48f256284bd46cdaab1048c3721360e808335d50 # v6.1.1
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        with:
+          validateSingleCommit: true
+          types: |
+            feat
+            fix
+            chore
+            docs
+            refactor
+            ci
+            build
+            test
+            perf
+            revert

.github/workflows/master.yml → .github/workflows/publish-maven.yml

@@ -1,22 +1,31 @@
-name: Produces and releases artifacts
+name: Publish to Maven Central
+
+on:
+  workflow_call:
+    inputs:
+      dry_run:
+        description: "Build & verify only, no real publish"
+        type: boolean
+        default: false
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "Build & verify only, no real publish"
+        type: boolean
+        default: false
 
 permissions:
   contents: read
 
-on:
-  push:
-    branches:
-      - master
-
 jobs:
-  build:
+  publish:
+    name: Build, sign & deploy
     runs-on: ubuntu-latest
-    name: Build and run tests
     steps:
       - name: Checkout code
         uses: actions/checkout@v7.0.0
 
-      # Setup JDK and .m2/settings.xml
+      # Setup JDK and .m2/settings.xml for Maven Central
       - name: Set up JDK
         uses: actions/setup-java@v5.4.0
         with:
@@ -27,30 +36,23 @@ jobs:
           server-username: OSS_CENTRAL_USERNAME # env variable for Maven Central
           server-password: OSS_CENTRAL_PASSWORD # env variable for Maven Central
 
-      # Prepare
       - name: Prepare Maven Wrapper
         run: chmod +x ./mvnw
 
-      # Build
       - name: Build with Maven
         run: ./mvnw clean verify -U -B -T4
 
-      # Get GPG private key into GPG
+      # Import the signing key into GPG
       - name: Import GPG Owner Trust
         run: echo "${{ secrets.GPG_OWNERTRUST }}" | base64 --decode | gpg --import-ownertrust
 
       - name: Import GPG key
         run: echo "${{ secrets.GPG_SECRET_KEYS }}" | base64 --decode | gpg --import --no-tty --batch --yes --always-trust
 
-      # Publish release
       - name: Deploy a new release version to Maven Central
+        if: ${{ !inputs.dry_run }}
         run: ./mvnw clean deploy -B -ntp -DskipTests -DskipExamples -Prelease -Dgpg.keyname="${{ secrets.GPG_KEYNAME }}"
         env:
           OSS_CENTRAL_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
           OSS_CENTRAL_PASSWORD: ${{ secrets.SONATYPE_PASSWORD }}
           MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
-
-      - name: Upload coverage information
-        uses: codecov/codecov-action@v7.0.0
-        with:
-          token: ${{ secrets.CODECOV_TOKEN }}

.github/workflows/release-please.yml

@@ -0,0 +1,46 @@
+name: Release
+
+on:
+  push:
+    branches: [develop]
+  workflow_dispatch:
+    inputs:
+      dry_run:
+        description: "Dry run (build & verify only — no PR, no release, no publish)"
+        type: boolean
+        default: false
+
+permissions:
+  contents: write
+  pull-requests: write
+
+jobs:
+  release-please:
+    name: Open or update Release PR
+    runs-on: ubuntu-latest
+    outputs:
+      release_created: ${{ steps.rp.outputs.release_created }}
+      tag_name: ${{ steps.rp.outputs.tag_name }}
+    steps:
+      - uses: actions/create-github-app-token@bcd2ba49218906704ab6c1aa796996da409d3eb1 # v3.2.0
+        id: app-token
+        with:
+          client-id: ${{ vars.RELEASE_PLEASE_APP_CLIENT_ID }}
+          private-key: ${{ secrets.RELEASE_PLEASE_APP_PRIVATE_KEY }}
+      - id: rp
+        uses: googleapis/release-please-action@45996ed1f6d02564a971a2fa1b5860e934307cf7 # v5.0.0
+        with:
+          token: ${{ steps.app-token.outputs.token }}
+          config-file: release-please-config.json
+          manifest-file: .release-please-manifest.json
+          skip-github-pull-request: ${{ inputs.dry_run || false }}
+          skip-github-release: ${{ inputs.dry_run || false }}
+
+  publish-maven:
+    name: Publish to Maven Central
+    needs: release-please
+    if: ${{ needs.release-please.outputs.release_created == 'true' || inputs.dry_run == true }}
+    uses: ./.github/workflows/publish-maven.yml
+    secrets: inherit
+    with:
+      dry_run: ${{ inputs.dry_run == true }}

.release-please-manifest.json

@@ -0,0 +1,3 @@
+{
+  ".": "1.7.0"
+}