deploy.yml

name: Deploy
on:
  workflow_dispatch:
    inputs:
      previousVersion:
        description: "Previous version"
        required: true
      newVersion:
        description: "New version"
        required: true
permissions:
  contents: read
concurrency:
  group: ${{ github.workflow }}
  cancel-in-progress: false
jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    timeout-minutes: 60
    # Run in the `release` environment. Configure that environment with required reviewers (maintainers)
    # so a manual `workflow_dispatch` release pauses for approval before publishing.
    environment: release
    permissions:
      contents: write
    steps:
      - name: Check out Git repository
        uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
        with:
          fetch-depth: 0 # Needed for tags

      - name: Validate release inputs
        env:
          NEW_VERSION: ${{ github.event.inputs.newVersion }}
        run: |
          if ! echo "$NEW_VERSION" | grep -Eq '^[0-9]+\.[0-9]+\.[0-9]+$'; then
            echo "::error::newVersion '$NEW_VERSION' is not a valid version (expected X.Y.Z)"
            exit 1
          fi
          if git rev-parse -q --verify "refs/tags/$NEW_VERSION" >/dev/null; then
            echo "::error::Tag '$NEW_VERSION' already exists"
            exit 1
          fi

      - name: Install Java and Maven
        uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
        with:
          distribution: "temurin"
          java-version: 25
          cache: "maven"
          server-id: central
          server-username: MAVEN_USERNAME
          server-password: MAVEN_PASSWORD
          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
          gpg-passphrase: MAVEN_GPG_PASSPHRASE

      - name: Verify project version matches release version
        env:
          NEW_VERSION: ${{ github.event.inputs.newVersion }}
        run: |
          POM_VERSION=$(./mvnw -ntp -q help:evaluate -Dexpression=project.version -DforceStdout)
          if [ "$POM_VERSION" != "$NEW_VERSION" ]; then
            echo "::error::pom.xml version '$POM_VERSION' does not match newVersion '$NEW_VERSION'. Bump the project version before releasing."
            exit 1
          fi

      - name: Release Maven package
        run: ./mvnw -ntp --batch-mode clean deploy -P deploy -Djacoco.skip=true -DskipTests
        env:
          MAVEN_USERNAME: ${{ secrets.CENTRAL_TOKEN_USERNAME }}
          MAVEN_PASSWORD: ${{ secrets.CENTRAL_TOKEN_PASSWORD }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

      - name: Create and push tag
        env:
          TAG: ${{ github.event.inputs.newVersion }}
        run: |
          git config user.name "github-actions[bot]"
          git config user.email "41898282+github-actions[bot]@users.noreply.github.com"
          git tag -a "$TAG" -m "Release v$TAG"
          git push origin "$TAG"

      - name: Create Release on GitHub
        uses: softprops/action-gh-release@efb35369e0ad2afab669f228072c1b0d510eae64 # v3.0.3
        with:
          tag_name: ${{ github.event.inputs.newVersion }}
          name: Release v${{ github.event.inputs.newVersion }}
          generate_release_notes: true
          draft: true
          prerelease: false

      # Safety net: the release PR (scripts/release.sh prepare) already updates the README.
      - name: Update README
        env:
          NEW_VERSION: ${{ github.event.inputs.newVersion }}
        run: |
          scripts/set-version.sh --readme-only "$NEW_VERSION"
          git add README.md
          if git diff --cached --quiet; then
            echo "README already up to date, nothing to commit"
          else
            git commit -m "docs: update version to $NEW_VERSION in README"
            git push origin HEAD:master
          fi