publish.yml

name: Publish to Maven Central

on:
  push:
    tags:
      - 'v*'

permissions:
  contents: write

jobs:
  publish:
    runs-on: ubuntu-latest
    environment: maven
    steps:
      - name: Checkout (with zstd submodule)
        uses: actions/checkout@v4
        with:
          submodules: recursive

      - name: Set up JDK 25 with Maven Central publishing
        uses: actions/setup-java@v4
        with:
          java-version: '25'
          distribution: 'zulu'
          cache: 'maven'
          server-id: central
          server-username: CENTRAL_USERNAME
          server-password: CENTRAL_PASSWORD
          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
          gpg-passphrase: GPG_PASSPHRASE

      - name: Set up Zig
        uses: mlugg/setup-zig@d1434d08867e3ee9daa34448df10607b98908d29 # v2
        with:
          version: 0.16.0

      - name: Publish to Maven Central
        env:
          CENTRAL_USERNAME: ${{ secrets.CENTRAL_USERNAME }}
          CENTRAL_PASSWORD: ${{ secrets.CENTRAL_PASSWORD }}
          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
        # Exclude internal modules from the published reactor. The
        # central-publishing plugin aggregates the whole reactor and does not
        # honor maven.deploy.skip, so drop them here (belt-and-suspenders with
        # the plugin's excludeArtifacts in the root pom).
        run: ./mvnw deploy -Prelease -DskipTests --batch-mode -ntp -pl '!integration-tests,!benchmark'

      - name: Create GitHub release
        env:
          GH_TOKEN: ${{ github.token }}
        run: |
          VERSION="${GITHUB_REF_NAME#v}"
          NOTES=$(awk "/^## \[$VERSION\]/{found=1; next} found && /^## \[/{exit} found{print}" CHANGELOG.md)
          gh release create "$GITHUB_REF_NAME" \
            --title "$GITHUB_REF_NAME" \
            --notes "$NOTES" \
            --verify-tag