publish.yml

name: Publish

on:
  push:
    tags: ['v[0-9]+.[0-9]+.[0-9]+']

jobs:
  deploy:
    name: Deploy to Maven Central
    runs-on: ubuntu-latest
    environment: maven-central
    permissions:
      contents: read
    steps:
      - uses: actions/checkout@v7
        with:
          persist-credentials: false

      - uses: actions/setup-java@v5
        with:
          distribution: temurin
          java-version: '17'
          cache: maven
          # Writes ~/.m2/settings.xml with a <server><id>central</id> whose credentials come
          # from the two env vars below, and imports the GPG key into a throwaway keyring.
          # The id must match <publishingServerId> in the pom's release profile.
          server-id: central
          server-username-env-var: MAVEN_CENTRAL_USERNAME
          server-password-env-var: MAVEN_CENTRAL_PASSWORD
          gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
          gpg-passphrase-env-var: MAVEN_GPG_PASSPHRASE

      - name: Tag must match the pom version
        run: |
          tag="${GITHUB_REF_NAME#v}"
          ver="$(mvn -q -DforceStdout help:evaluate -Dexpression=project.version)"
          [ "$tag" = "$ver" ] || { echo "tag $tag != pom $ver"; exit 1; }

      # The suite runs against a JDK HTTP server, so it needs no API key and no network.
      - run: mvn -B test

      - name: Deploy
        # `deploy` runs package (jar + sources + javadoc), then verify (gpg:sign), then the
        # Central Portal plugin uploads the bundle. With autoPublish=false in the pom this
        # leaves it staged for review rather than releasing it — nothing on Maven Central
        # can ever be deleted, so the first release is confirmed by a human in the Portal.
        run: mvn -B -P release -DskipTests deploy
        env:
          MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
          MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}