build: split bundled fonts into a separate artifact and slim the publication

Why: the published graph-compose artifact set was ~40 MB per release — the
~18 MB of bundled Google fonts shipped inside the main jar AND again in the
-sources jar, and the -tests classifier jar was deployed too. Fonts change
rarely, so re-shipping them on every engine release wasted Maven Central
storage and forced an engine-only upgrade to re-download fonts.

What:
- New io.github.demchaav:graph-compose-fonts module (independent 1.0.0 line)
  carries the fonts/google/** binaries; classpath paths preserved
  byte-for-byte so DefaultFonts resolves them unchanged. The engine depends on
  it at TEST scope only, so it never propagates to consumers.
- New io.github.demchaav:graph-compose-bundle (pom) aggregates engine + fonts
  for a one-line "batteries-included" install; tracks the engine version.
- The engine release no longer attaches or deploys the -tests jar (kept as a
  local build aid for the benchmarks module); with the fonts gone the -sources
  jar is lean too. Main jar drops from ~20 MB to ~2.6 MB.
- A missing fonts/google resource now fails with an actionable message naming
  the graph-compose-fonts dependency.
- Fonts publish on their own fonts-v* tag (publish-fonts.yml); the engine v*
  tag deploys engine + bundle and installs fonts first for the test-scope
  verify. cut-release.ps1 bumps the bundle in lockstep while fonts stays
  independent; VersionConsistencyGuardTest enforces both. CHANGELOG, README,
  and docs/migration/v1.8.0-fonts.md document the consumer-facing change.

Verification: ./mvnw clean verify -pl . green (1397 tests, including two new
font-degradation tests and the bundle/fonts version guards); the fonts and
bundle modules build and resolve; the release jar contains no fonts/google and
no -tests classifier; the CvSidebarPortrait example renders (Google fonts from
the fonts jar + portrait asset from the engine jar).

BREAKING CHANGE: bundled Google fonts are no longer inside graph-compose. To
keep them, add io.github.demchaav:graph-compose-fonts (or depend on
graph-compose-bundle). The FontName API and DefaultFonts catalog are unchanged
(source- and binary-compatible); standard-14 documents render with no extra
dependency. See docs/migration/v1.8.0-fonts.md.

Author: DemchaAV

.github/workflows/publish-fonts.yml

@@ -0,0 +1,67 @@
+name: Publish fonts to Maven Central
+
+# Publishes the graph-compose-fonts companion artifact to Maven Central,
+# independently of the engine. The bundled Google fonts change rarely, so
+# they release on their OWN tag line (fonts-v*) — pushing an engine v* tag
+# never touches them, and re-publishing fonts does not require an engine
+# release. This mirrors publish.yml (Track D4) but targets fonts/pom.xml.
+#
+# Tagging: fonts-vX.Y.Z (e.g. fonts-v1.0.0). The fonts artifact carries its
+# own independent version (see fonts/pom.xml) — keep it in sync with the tag.
+#
+# Human prerequisites are identical to publish.yml (GPG key + Central token
+# secrets). See docs/contributing/release-process.md for the runbook.
+
+on:
+  push:
+    tags:
+      - 'fonts-v*'
+  workflow_dispatch:
+    inputs:
+      tag:
+        description: 'Existing fonts-v*-prefixed tag to (re-)publish'
+        required: true
+        type: string
+
+permissions:
+  contents: read
+
+jobs:
+  publish-fonts:
+    name: Publish ${{ github.ref_name }} to Maven Central
+    runs-on: ubuntu-latest
+    # Only ship plain semver tags (fonts-vX.Y.Z) to Central; pre-release
+    # suffixes ship nowhere from here.
+    if: |
+      github.event_name == 'workflow_dispatch' ||
+      (!contains(github.ref, '-rc') && !contains(github.ref, '-alpha') && !contains(github.ref, '-beta') && !contains(github.ref, '-snapshot'))
+    env:
+      JAVA_TOOL_OPTIONS: -Djava.awt.headless=true
+
+    steps:
+      - name: Check out repository at tag
+        uses: actions/checkout@v6
+        with:
+          ref: ${{ github.event.inputs.tag || github.ref }}
+
+      - name: Set up Temurin JDK 17 with Central credentials and GPG key
+        uses: actions/setup-java@v5
+        with:
+          distribution: temurin
+          java-version: '17'
+          cache: maven
+          server-id: central
+          server-username: CENTRAL_USERNAME
+          server-password: CENTRAL_TOKEN
+          gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
+          gpg-passphrase: MAVEN_GPG_PASSPHRASE
+
+      - name: Publish fonts to Maven Central
+        # Activates the fonts module's release profile (sources + javadoc +
+        # gpg sign + central-publishing) and flips gpg.skip=false. Blocks
+        # until Sonatype's validator confirms validation.
+        run: ./mvnw -B -ntp -f fonts/pom.xml -P release -Dgpg.skip=false deploy
+        env:
+          CENTRAL_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
+          CENTRAL_TOKEN: ${{ secrets.CENTRAL_TOKEN }}
+          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}

.github/workflows/publish.yml

@@ -79,20 +79,42 @@ jobs:
           gpg-private-key: ${{ secrets.MAVEN_GPG_PRIVATE_KEY }}
           gpg-passphrase: MAVEN_GPG_PASSPHRASE
 
+      - name: Install graph-compose-fonts into the local repo
+        # The engine's visual / snapshot suite renders with the bundled
+        # Google fonts, which now live in the separately-versioned
+        # graph-compose-fonts artifact (engine depends on it at test
+        # scope). Build + install it locally so the verify step below can
+        # resolve it even before it (or this engine version) is on Central.
+        run: ./mvnw -B -ntp -f fonts/pom.xml clean install
+
       - name: Verify (full canonical suite green at tagged commit)
         # Re-verify the tagged commit before publishing — defence in
         # depth against a tag pushed from a broken branch by mistake.
         # The publish step below would also fail at signing/upload,
         # but failing here surfaces a clearer error.
         run: ./mvnw -B -ntp clean verify -pl .
 
-      - name: Publish to Maven Central
+      - name: Publish engine to Maven Central
         # Activates the release profile (sources + javadoc + gpg sign +
         # central-publishing) and flips gpg.skip=false. The deploy
         # phase invokes central-publishing-maven-plugin's upload goal
         # which blocks until Sonatype's validator confirms validation.
+        # The release profile also disables the tests-jar execution, so
+        # only the main + sources + javadoc + pom artefacts are uploaded.
         run: ./mvnw -B -ntp -P release -DskipTests -Dgpg.skip=false deploy
         env:
           CENTRAL_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
           CENTRAL_TOKEN: ${{ secrets.CENTRAL_TOKEN }}
           MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}
+
+      - name: Publish bundle to Maven Central
+        # The graph-compose-bundle convenience aggregate pins this engine
+        # version + a compatible graph-compose-fonts version. It tracks the
+        # engine line, so it ships on the same v* tag. pom-packaged → only a
+        # signed .pom is uploaded; engine + fonts resolve from the local repo
+        # (installed by the engine deploy above and the fonts step earlier).
+        run: ./mvnw -B -ntp -f bundle/pom.xml -P release -DskipTests -Dgpg.skip=false deploy
+        env:
+          CENTRAL_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
+          CENTRAL_TOKEN: ${{ secrets.CENTRAL_TOKEN }}
+          MAVEN_GPG_PASSPHRASE: ${{ secrets.MAVEN_GPG_PASSPHRASE }}

CHANGELOG.md

@@ -237,6 +237,32 @@ Entries land here as they merge.
   node-label settings survive the toggle, `debug(none())` reliably disables
   everything — and disabled debug output stays byte-identical.
 
+### Build & distribution
+
+- **Bundled Google fonts moved to a separate, independently-versioned
+  artifact** (`io.github.demchaav:graph-compose-fonts`). **Breaking for
+  consumers who use the bundled families.** The ~18 MB of curated Google fonts
+  no longer ship inside the `graph-compose` jar, so an engine upgrade never
+  re-downloads them and the engine artifact drops from ~40 MB to a few MB. The
+  public `FontName` constants and the `DefaultFonts` catalog are unchanged
+  (source- and binary-compatible), and the classpath layout `fonts/google/...`
+  is preserved byte-for-byte. To keep the bundled fonts, add
+  `io.github.demchaav:graph-compose-fonts` (its own version line, starting at
+  `1.0.0`) to your build, or depend on the new "batteries-included"
+  `io.github.demchaav:graph-compose-bundle` (engine + fonts at compatible
+  versions). With neither on the classpath, standard-14 documents render
+  unchanged and requesting a bundled family fails fast with a message that
+  names the missing dependency. See
+  [docs/migration/v1.8.0-fonts.md](docs/migration/v1.8.0-fonts.md).
+- **Leaner Maven Central publication.** The release build no longer attaches or
+  uploads the `-tests` classifier jar (it stays a local-only build aid for the
+  benchmarks module), and with the fonts gone the `-sources.jar` no longer
+  carries font binaries either. The published artifact set is now just the
+  engine bytecode plus the small template assets.
+- **`graph-compose-fonts` releases on its own `fonts-v*` tag** via a dedicated
+  publish workflow, so the font set ships only when it actually changes,
+  independent of the engine's `v*` release cadence.
+
 ### Bug fixes
 
 - **A stray non-drawing element no longer breaks a whole SVG icon.** A

README.md

@@ -63,6 +63,25 @@ Sits between **iText** (low-level page primitives) and **JasperReports** (XML-te
 dependencies { implementation("io.github.demchaav:graph-compose:1.7.1") }
 ```
 
+> **Bundled fonts (from v1.8.0).** The curated Google fonts no longer ship
+> inside the engine jar — they live in an independently-versioned
+> companion artifact so an engine upgrade never re-downloads ~18 MB of
+> fonts. Pure-text and standard-14 documents need nothing extra; to use the
+> bundled families, add:
+>
+> ```xml
+> <dependency>
+>     <groupId>io.github.demchaav</groupId>
+>     <artifactId>graph-compose-fonts</artifactId>
+>     <version>1.0.0</version>
+> </dependency>
+> ```
+>
+> Prefer a single "batteries-included" coordinate? Depend on
+> `io.github.demchaav:graph-compose-bundle` (same version as `graph-compose`
+> above) to pull the engine + fonts together. Full details and upgrade steps:
+> the [v1.8.0 fonts migration note](./docs/migration/v1.8.0-fonts.md).
+
 > **Distribution** &mdash; Maven Central is the canonical channel from **v1.6.6** onwards
 > (`io.github.demchaav:graph-compose:<version>`). Hosted Javadocs auto-publish to
 > [javadoc.io/doc/io.github.demchaav/graph-compose](https://javadoc.io/doc/io.github.demchaav/graph-compose)

aggregator/pom.xml

@@ -22,8 +22,38 @@
           mvn -f aggregator/pom.xml versions:set -DnewVersion=X # bump all modules
     </description>
 
+    <!--
+        Belt-and-braces: nothing aggregated here is meant to be deployed via the
+        reactor. The published artifacts (engine, fonts, bundle) are deployed by
+        their own targeted `-f <module>/pom.xml ... deploy` invocations in the
+        publish workflows. This skip stops an accidental aggregator `deploy` from
+        pushing the examples / benchmarks (which have no distributionManagement)
+        to anywhere. The standalone engine / fonts / bundle poms do not inherit
+        this and manage their own publication.
+    -->
+    <properties>
+        <maven.deploy.skip>true</maven.deploy.skip>
+        <!--
+            Bundled-fonts version inherited by the examples and benchmarks
+            modules (which render with the bundled Google families). Independent
+            of the engine line; bump only when the font set changes.
+        -->
+        <graphcompose.fonts.version>1.0.0</graphcompose.fonts.version>
+    </properties>
+
+    <!--
+        Reactor build order only. `../fonts` and `../bundle` are listed so a
+        full-reactor `install` builds them in dependency order (fonts before the
+        engine, which depends on fonts at test scope). They are NOT children of
+        this aggregator (no <parent> back-reference) and carry independent
+        versions, so the lockstep `versions:set` does not rewrite them: fonts is
+        at its own 1.0.0 line, and the bundle (== engine version) is bumped with
+        the engine on purpose.
+    -->
     <modules>
         <module>..</module>
+        <module>../fonts</module>
+        <module>../bundle</module>
         <module>../examples</module>
         <module>../benchmarks</module>
     </modules>

benchmarks/pom.xml

@@ -54,6 +54,18 @@
             <version>${graphcompose.version}</version>
         </dependency>
 
+        <!--
+            Bundled Google fonts, split out of the engine jar in v1.8.0. The
+            font-embed probes (FontEmbedProbe) and canonical benchmark fixtures
+            render in these families, so the harness pulls the companion
+            artifact explicitly at its own independent version.
+        -->
+        <dependency>
+            <groupId>io.github.demchaav</groupId>
+            <artifactId>graph-compose-fonts</artifactId>
+            <version>${graphcompose.fonts.version}</version>
+        </dependency>
+
         <!--
             graph-compose's test-only fixtures (com.demcha.mock.*) used by
             CanonicalBenchmarkSupport for CV / invoice / proposal sample

bundle/pom.xml

@@ -0,0 +1,138 @@
+<?xml version="1.0" encoding="UTF-8"?>
+<project xmlns="http://maven.apache.org/POM/4.0.0"
+         xmlns:xsi="http://www.w3.org/2001/XMLSchema-instance"
+         xsi:schemaLocation="http://maven.apache.org/POM/4.0.0 http://maven.apache.org/xsd/maven-4.0.0.xsd">
+    <modelVersion>4.0.0</modelVersion>
+
+    <!--
+        "Batteries-included" convenience aggregate. Depending on this single
+        artifact pulls the lean engine plus the bundled Google fonts at a
+        compatible, pinned pair of versions — the one-line install for newcomers
+        who want the pre-split behaviour back. Power users instead depend on
+        graph-compose directly and pick their own graph-compose-fonts version.
+
+        Versioning: this module tracks the ENGINE line (its version == the engine
+        version, bumped in lockstep), and pins a specific graph-compose-fonts
+        version. It is standalone (no Maven parent) and pom-packaged, so Maven
+        Central needs no sources/javadoc jars for it.
+    -->
+    <groupId>io.github.demchaav</groupId>
+    <artifactId>graph-compose-bundle</artifactId>
+    <!--
+        Tracks the engine line. Currently 1.7.1 to match the engine version in
+        the repo; the release-cut `versions:set` bumps engine + bundle to the
+        release version in lockstep, while graph-compose-fonts stays on its own
+        line. The graph-compose dependency below uses ${project.version}, so it
+        follows automatically.
+    -->
+    <version>1.7.1</version>
+    <packaging>pom</packaging>
+
+    <name>GraphCompose Bundle</name>
+    <description>Batteries-included aggregate: the GraphCompose engine plus the bundled Google fonts at compatible versions.</description>
+    <url>https://github.com/DemchaAV/GraphCompose</url>
+
+    <licenses>
+        <license>
+            <name>MIT License</name>
+            <url>https://opensource.org/licenses/MIT</url>
+            <distribution>repo</distribution>
+        </license>
+    </licenses>
+
+    <developers>
+        <developer>
+            <id>DemchaAV</id>
+            <name>Artem Demchyshyn</name>
+            <email>demchishynartem@gmail.com</email>
+            <url>https://github.com/DemchaAV</url>
+            <roles>
+                <role>Lead Developer</role>
+                <role>Architect</role>
+            </roles>
+            <timezone>UTC 0</timezone>
+        </developer>
+    </developers>
+
+    <scm>
+        <connection>scm:git:https://github.com/DemchaAV/GraphCompose.git</connection>
+        <developerConnection>scm:git:ssh://git@github.com/DemchaAV/GraphCompose.git</developerConnection>
+        <url>https://github.com/DemchaAV/GraphCompose/tree/main</url>
+    </scm>
+
+    <properties>
+        <project.build.sourceEncoding>UTF-8</project.build.sourceEncoding>
+
+        <!-- Pinned bundled-fonts version this bundle ships with. -->
+        <graphcompose.fonts.version>1.0.0</graphcompose.fonts.version>
+
+        <maven.gpg.plugin.version>3.2.8</maven.gpg.plugin.version>
+        <central.publishing.plugin.version>0.10.0</central.publishing.plugin.version>
+
+        <gpg.skip>true</gpg.skip>
+    </properties>
+
+    <dependencies>
+        <!-- The engine, at this bundle's (== engine) version. -->
+        <dependency>
+            <groupId>io.github.demchaav</groupId>
+            <artifactId>graph-compose</artifactId>
+            <version>${project.version}</version>
+        </dependency>
+        <!-- The bundled fonts, at the pinned independent fonts version. -->
+        <dependency>
+            <groupId>io.github.demchaav</groupId>
+            <artifactId>graph-compose-fonts</artifactId>
+            <version>${graphcompose.fonts.version}</version>
+        </dependency>
+    </dependencies>
+
+    <profiles>
+        <!--
+            Maven Central release. A pom-packaged artifact needs no
+            sources/javadoc jars; it only requires a signed .pom uploaded via
+            central-publishing. Activated with `-P release`; the publish workflow
+            flips -Dgpg.skip=false on the engine `v*` tag (the bundle ships
+            together with the engine it pins).
+        -->
+        <profile>
+            <id>release</id>
+            <build>
+                <plugins>
+                    <plugin>
+                        <groupId>org.apache.maven.plugins</groupId>
+                        <artifactId>maven-gpg-plugin</artifactId>
+                        <version>${maven.gpg.plugin.version}</version>
+                        <executions>
+                            <execution>
+                                <id>sign-artifacts</id>
+                                <phase>verify</phase>
+                                <goals>
+                                    <goal>sign</goal>
+                                </goals>
+                                <configuration>
+                                    <skip>${gpg.skip}</skip>
+                                    <gpgArguments>
+                                        <arg>--pinentry-mode</arg>
+                                        <arg>loopback</arg>
+                                    </gpgArguments>
+                                </configuration>
+                            </execution>
+                        </executions>
+                    </plugin>
+                    <plugin>
+                        <groupId>org.sonatype.central</groupId>
+                        <artifactId>central-publishing-maven-plugin</artifactId>
+                        <version>${central.publishing.plugin.version}</version>
+                        <extensions>true</extensions>
+                        <configuration>
+                            <publishingServerId>central</publishingServerId>
+                            <autoPublish>false</autoPublish>
+                            <waitUntil>validated</waitUntil>
+                        </configuration>
+                    </plugin>
+                </plugins>
+            </build>
+        </profile>
+    </profiles>
+</project>