release.yml

name: Release
on: [ workflow_dispatch ]
permissions:
  contents: read
jobs:
  build:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout
        uses: actions/checkout@v7
      - name: Setup java
        uses: actions/setup-java@v6
        with:
          java-version: '11'
          distribution: 'temurin'
      - name: Build with Maven
        run: mvn --batch-mode --update-snapshots verify

  publish:
    runs-on: ubuntu-latest
    needs: build
    permissions:
      contents: write
      pull-requests: write
    steps:
      - name: Checkout
        uses: actions/checkout@v7
      - name: Setup Maven Central
        uses: actions/setup-java@v6
        with:
          java-version: '11'
          distribution: 'temurin'
          server-id: central
          server-username: MAVEN_USERNAME
          server-password: MAVEN_PASSWORD
          gpg-private-key: ${{ secrets.GPG_SIGNING_KEY }}
          gpg-passphrase: GPG_PASSPHRASE
      - name: Setup Maven 3.9
        # Under Maven 3.10, central-publishing-maven-plugin 0.11.0 adds maven-metadata-local.xml to the bundle, which Central rejects
        run: |
          curl -sSfL https://repo1.maven.org/maven2/org/apache/maven/apache-maven/3.9.16/apache-maven-3.9.16-bin.tar.gz | tar xz -C "$RUNNER_TEMP"
          echo "$RUNNER_TEMP/apache-maven-3.9.16/bin" >> "$GITHUB_PATH"
      - name: Publish release
        run: bash github-build.sh
        env:
          MAVEN_USERNAME: ${{ secrets.OSS_USER_TOKEN_KEY }}
          MAVEN_PASSWORD: ${{ secrets.OSS_USER_TOKEN_PASS }}
          GPG_PASSPHRASE: ${{ secrets.GPG_SIGNING_PASSWORD }}
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}
      - name: Create Release PR
        uses: peter-evans/create-pull-request@v8
        with:
          branch: version-release
          title: Version Release
          body: |
            Bumping project version after release.