### 0.6.0 (June 14, 2026)

* On a failed leak check, JMemoryBuddy now reads back the heap dump it creates and prints the strong-reference path from a GC root to each not-collected object — no need to open VisualVM/MAT for the common case. Dependency-free; disable with `-Djmemorybuddy.printPath=false`.

Also added new release process.

Author: FlorianKirmaier

.github/workflows/main.yml

@@ -12,6 +12,9 @@ jobs:
 
     steps:
       - uses: actions/checkout@v4
+        with:
+          # full history + tags, required for the git-derived version
+          fetch-depth: 0
       - uses: actions/setup-java@v4
         with:
           distribution: 'temurin'
@@ -22,3 +25,13 @@ jobs:
 
       - name: Run tests
         run: ./gradlew test
+
+      - name: Publish snapshot to Sandec Artifactory
+        if: matrix.jdk == 21 && github.ref == 'refs/heads/master' && github.event_name == 'push'
+        run: ./publishSandecArtifactory.sh --snapshot-only
+        env:
+          SANDEC_ARTIFACTORY_USERNAME: ${{secrets.SANDEC_ARTIFACTORY_USERNAME}}
+          SANDEC_ARTIFACTORY_PASSWORD: ${{secrets.SANDEC_ARTIFACTORY_PASSWORD}}
+          SANDEC_SIGNING_KEY_ID: ${{secrets.SANDEC_SIGNING_KEY_ID}}
+          SANDEC_SIGNING_SECRET_KEY: ${{secrets.SANDEC_SIGNING_SECRET_KEY}}
+          SANDEC_SIGNING_PASSWORD: ${{secrets.SANDEC_SIGNING_PASSWORD}}

.github/workflows/release.yml

@@ -0,0 +1,42 @@
+name: Release
+
+on:
+  push:
+    tags:
+      - '[0-9]*'
+  workflow_dispatch:
+
+env:
+  SANDEC_ARTIFACTORY_USERNAME: ${{secrets.SANDEC_ARTIFACTORY_USERNAME}}
+  SANDEC_ARTIFACTORY_PASSWORD: ${{secrets.SANDEC_ARTIFACTORY_PASSWORD}}
+  SANDEC_SIGNING_KEY_ID: ${{secrets.SANDEC_SIGNING_KEY_ID}}
+  SANDEC_SIGNING_SECRET_KEY: ${{secrets.SANDEC_SIGNING_SECRET_KEY}}
+  SANDEC_SIGNING_PASSWORD: ${{secrets.SANDEC_SIGNING_PASSWORD}}
+  SANDEC_SONATYPE_AUTH_TOKEN: ${{secrets.SANDEC_SONATYPE_AUTH_TOKEN}}
+
+jobs:
+  release:
+    name: 'Release'
+    runs-on: ubuntu-latest
+    if: github.repository_owner == 'Sandec'
+    steps:
+      - name: Checkout
+        uses: actions/checkout@v4
+        with:
+          # full history + tags, required for the git-derived version
+          fetch-depth: 0
+
+      - name: Setup Java 21
+        uses: actions/setup-java@v4
+        with:
+          distribution: 'temurin'
+          java-version: 21
+
+      - name: Print release version
+        run: ./gradlew help -q | grep "Version derived"
+
+      - name: Publish to Sandec Artifactory
+        run: ./publishSandecArtifactory.sh
+
+      - name: Publish to Maven Central
+        run: ./publishMavenCentral.sh

CHANGELOG.md

@@ -1,5 +1,5 @@
-### 0.5.7 (TBD)
-
+### 0.6.0 (June 14, 2026)
+* On a failed leak check, JMemoryBuddy now reads back the heap dump it creates and prints the strong-reference path from a GC root to each not-collected object — no need to open VisualVM/MAT for the common case. Dependency-free; disable with `-Djmemorybuddy.printPath=false`.
 
 ### 0.5.6 (October 29, 2024)
 * Changed module name to `one.jpro.jmemorybuddy`.

README.md

@@ -60,7 +60,17 @@ You can also use the method `assertCollectable` and `assertNotCollectable` to ch
 
 
 #### Analyzing the heap dump:
-JMemoryBuddy makes it easy to analyze the heap dump because all problematic instances are wrapped inside a class with the name `AssertCollectable`. Just search your heap dump with your prefered tool for this class name:
+On a failed leak check JMemoryBuddy reads back the heap dump and prints the strong-reference path from a GC root to each not-collected object directly in the test output — usually enough to find the cause without opening any tool:
+
+```
+JMemoryBuddy — path to GC root for leak: PageDoc @58a903060:
+  GC root [Java frame] DataRepository
+    ↓ DataRepository.listeners
+  ...
+  PageDoc   ← leaked
+```
+
+Disable with `-Djmemorybuddy.printPath=false`. For a deeper look, open the dump in your preferred tool — all watched instances are referenced by a `TrackedWeakReference`, so you can search for that class name:
 ![visualvm](/screenshot-visualvm.png)
 
 
@@ -74,6 +84,8 @@ You can configure VisualVM with SystemProperties:
 | Tables        | Effect           | Default  |
 | ------------- |:-------------:| -----:|
 | -Djmemorybuddy.createHeapDump    | Should a heap dump created on failure? | true |
+| -Djmemorybuddy.printPath    | Print the path from a GC root to each not-collected object on failure. | true |
+| -Djmemorybuddy.maxObjects    | Skip the path analysis when the dump has more objects than this (avoids heavy in-process analysis). | 8000000 |
 | -Djmemorybuddy.output    | The folder where the heap dump gets saved. | if target exists, then "target" otherwise "build" |
 
 The following values usually shouldn't be changed but might be useful to make tests more stable or reduce the time required.

RELEASING.md

@@ -0,0 +1,42 @@
+# Releasing JMemoryBuddy
+
+The version is derived from the latest reachable git tag (`X.Y.Z`, no prefix):
+
+- HEAD exactly on tag `X.Y.Z`, clean tree → version `X.Y.Z`
+- commits after the tag, or a dirty tree → version `X.Y.(Z+1)-SNAPSHOT`
+- no tag → `0.5.7-SNAPSHOT` (fallback)
+
+The derived version is printed at the start of every build.
+
+## Releasing a version
+
+```bash
+./tagRelease.sh jmemorybuddy X.Y.Z
+```
+
+The first argument is the project name, guarding against running this in the wrong repo.
+The script only tags: it verifies a clean tree on an up-to-date `master` and a dated
+`### X.Y.Z` CHANGELOG entry, then tags and pushes `X.Y.Z`. The tag push triggers
+`.github/workflows/release.yml`, which builds and publishes via the scripts:
+
+| Script | Registry | Versions |
+|---|---|---|
+| `publishSandecArtifactory.sh` | Sandec Artifactory | snapshots (every `master` push, via CI) and releases |
+| `publishMavenCentral.sh` | Maven Central (Sonatype Central Portal) | releases only (refuses snapshots) |
+
+Maven Central publishing is `AUTOMATIC` (see `build.gradle`): the tag-triggered deployment
+is uploaded and released to Maven Central without a manual portal step — the tag is the gate,
+so don't tag until the CHANGELOG and version are right (releases can't be unpublished). There
+is no version bump and no bump-back — after the release, builds become `X.Y.(Z+1)-SNAPSHOT`.
+
+## Required repository secrets
+
+- `SANDEC_ARTIFACTORY_USERNAME` / `SANDEC_ARTIFACTORY_PASSWORD`
+- `SANDEC_SIGNING_KEY_ID` / `SANDEC_SIGNING_SECRET_KEY` / `SANDEC_SIGNING_PASSWORD` — GPG
+- `SANDEC_SONATYPE_AUTH_TOKEN` — Sonatype Central Portal token
+
+## Note on the first tag-derived release
+
+The latest existing tag is `0.5.5`, while `0.5.6` was published manually (untagged) — so until
+a new tag exists, builds derive `0.5.6-SNAPSHOT`. The next release should be `0.5.7`
+(`./tagRelease.sh jmemorybuddy 0.5.7`), which realigns the tags with the published versions.

build.gradle

@@ -6,7 +6,23 @@ plugins {
 }
 
 group = 'one.jpro'
-version = "$JMEMORYBUDDY_VERSION"
+
+// The version is derived from the latest reachable git tag (X.Y.Z, no prefix):
+//   - HEAD exactly on the tag, clean tree  -> X.Y.Z (release build)
+//   - commits after the tag, or dirty tree -> X.Y.(Z+1)-SNAPSHOT
+//   - no tag / no git                      -> 0.5.7-SNAPSHOT
+def gitDescribe = providers.exec {
+    commandLine 'git', 'describe', '--tags', '--dirty', '--match', '[0-9]*'
+    ignoreExitValue = true
+}.standardOutput.asText.map { it.trim() }
+version = {
+    def matcher = gitDescribe.getOrElse('') =~ /^(\d+)\.(\d+)\.(\d+)(-\d+-g[0-9a-f]+)?(-dirty)?$/
+    if (!matcher.matches()) return '0.5.7-SNAPSHOT'
+    def (major, minor, patch) = [matcher.group(1), matcher.group(2), matcher.group(3).toInteger()]
+    def isRelease = matcher.group(4) == null && matcher.group(5) == null
+    isRelease ? "${major}.${minor}.${patch}" : "${major}.${minor}.${patch + 1}-SNAPSHOT"
+}()
+logger.quiet("Version derived from git tags: {} (git describe: {})", version, gitDescribe.getOrElse('') ?: '<no tag found>')
 
 java {
     sourceCompatibility = 11
@@ -108,5 +124,5 @@ signing {
 mavenCentral {
     repoDir = layout.buildDirectory.dir('staging-deploy')
     authToken = System.getenv("SANDEC_SONATYPE_AUTH_TOKEN")
-    publishingType = 'USER_MANAGED'
+    publishingType = 'AUTOMATIC'
 }

gradle.properties

@@ -1,5 +1,3 @@
-JMEMORYBUDDY_VERSION=0.5.7-SNAPSHOT
-
 MAVEN_CENTRAL_PUBLISH_PLUGIN_VERSION=1.2.0
 JUNIT_VERSION=5.11.3
 LOGBACK_VERSION=1.5.12

publishMavenCentral.sh

@@ -0,0 +1,14 @@
+#!/bin/bash
+# Assembles the signed bundle and uploads it to Maven Central (Sonatype Central Portal).
+set -e
+cd "$(dirname "$0")"
+
+VERSION=$(./gradlew help -q 2>/dev/null | grep "Version derived" | sed -E 's/.*git tags: ([^ ]+).*/\1/')
+echo "Publishing version $VERSION to Maven Central"
+
+if [[ "$VERSION" == *-SNAPSHOT ]]; then
+    echo "error: $VERSION is a SNAPSHOT — Maven Central only takes releases (tag with ./tagRelease.sh)"
+    exit 1
+fi
+
+./gradlew "publishAllPublicationsToStaging-deployRepository" publishToMavenCentralPortal

publishSandecArtifactory.sh

@@ -0,0 +1,21 @@
+#!/bin/bash
+# Publishes to the Sandec Artifactory.
+# With --snapshot-only, refuses release versions (used by the per-commit CI job;
+# releases reach Artifactory through the tag-triggered release workflow).
+set -e
+cd "$(dirname "$0")"
+
+if [ -z "$SANDEC_ARTIFACTORY_USERNAME" ]; then
+    echo "error: SANDEC_ARTIFACTORY_USERNAME/PASSWORD not set"
+    exit 1
+fi
+
+VERSION=$(./gradlew help -q 2>/dev/null | grep "Version derived" | sed -E 's/.*git tags: ([^ ]+).*/\1/')
+echo "Publishing version $VERSION to Sandec Artifactory"
+
+if [ "$1" = "--snapshot-only" ] && [[ "$VERSION" != *-SNAPSHOT ]]; then
+    echo "Version $VERSION is a release — skipping (the release workflow publishes releases)."
+    exit 0
+fi
+
+./gradlew publishAllPublicationsToArtifactoryRepository