release.yml

name: Release

on:
  push:
    tags:
      - 'v*.*.*'

jobs:
  release:
    name: Release
    runs-on: ubuntu-latest
    permissions:
      contents: write
      pull-requests: read
    steps:
      - name: Checkout project
        uses: actions/checkout@9c091bb21b7c1c1d1991bb908d89e4e9dddfe3e0 # v7
        with:
          persist-credentials: false

      - name: Set up JDK 17
        uses: actions/setup-java@1bcf9fb12cf4aa7d266a90ae39939e61372fe520 # v5
        with:
          java-version: '17'
          distribution: 'temurin'
          server-id: central
          server-username: SONATYPE_USERNAME
          server-password: SONATYPE_TOKEN
          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
          gpg-passphrase: MAVEN_GPG_PASSPHRASE

      - name: Deploy
        run: mvn -B clean deploy -DskipTests -Psign
        env:
          SONATYPE_USERNAME: ${{ secrets.SONATYPE_USERNAME }}
          SONATYPE_TOKEN: ${{ secrets.SONATYPE_TOKEN }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

      - name: Generate release changelog
        uses: mikepenz/release-changelog-builder-action@c9bcd8238b6f41e05561348339429d360b1c0247 # v6
        id: build_changelog
        with:
          configuration: 'changelog-builder.json'
        env:
          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

      - name: Create release
        # ncipollo/release-action v1.21.0 (pinned by SHA). Kept over `gh release` for its
        # allowUpdates support, which has no single-command equivalent.
        uses: ncipollo/release-action@339a81892b84b4eeb0f6e744e4574d79d0d9b8dd # zizmor: ignore[superfluous-actions]
        with:
          token: ${{ secrets.GITHUB_TOKEN }}
          body: ${{ steps.build_changelog.outputs.changelog }}
          draft: true
          prerelease: true
          allowUpdates: true