release.yml

name: Release

# Publishes the SDK (jar + sources + javadoc) to GitHub Packages when a version tag is pushed.
# Kept separate from CI so day-to-day builds retain read-only permissions.
on:
  push:
    tags:
      - "v*"
  workflow_dispatch:

permissions:
  contents: read
  packages: write

concurrency:
  group: release-${{ github.ref }}
  cancel-in-progress: false

jobs:
  publish:
    name: Publish to GitHub Packages
    runs-on: ubuntu-latest
    timeout-minutes: 20

    steps:
      - name: Check out repository
        # actions/checkout@v6.0.3
        uses: actions/checkout@df4cb1c069e1874edd31b4311f1884172cec0e10

      - name: Set up JDK
        # actions/setup-java@v5.2.0 — configures a settings.xml whose "github" server authenticates with the
        # workflow token granted by `packages: write` above.
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654
        with:
          distribution: temurin
          java-version: "21"
          cache: maven
          server-id: github
          server-username: GITHUB_ACTOR
          server-password: GITHUB_TOKEN

      - name: Verify
        run: mvn --batch-mode --no-transfer-progress verify

      - name: Deploy (sources + javadoc + jar)
        run: mvn --batch-mode --no-transfer-progress -DskipTests -Prelease deploy
        env:
          GITHUB_ACTOR: ${{ github.actor }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}