maven-central-publish.yml

name: Publish package to the Maven Central Repository

# TODO This trigger should be automated to match merging release-PRs later on
on:
  workflow_dispatch

permissions:
  contents: read

jobs:
  publish:
    runs-on: ubuntu-latest
    environment: central
    steps:
      - name: Harden the runner (Audit all outbound calls)
        uses: step-security/harden-runner@20cf305ff2072d973412fa9b1e3a4f227bda3c76 # v2.14.0
        with:
          egress-policy: audit

      - uses: actions/checkout@8e8c483db84b4bee98b60c0593521ed34d9990e8 # v6.0.1
        with:
          persist-credentials: false

      - name: Set up Maven Central Repository
        uses: actions/setup-java@be666c2fcd27ec809703dec50e508c2fdc7f6654 # v5.2.0
        with:
          java-version: '17'
          distribution: 'temurin'
          server-id: central
          server-username: MAVEN_USERNAME
          server-password: MAVEN_PASSWORD
          gpg-private-key: ${{ secrets.GPG_SIGNING_KEY }}
          gpg-passphrase: MAVEN_GPG_PASSPHRASE
      - name: Publish package
        # First install the artifact to make it available for use by the project
        # Then prepare for release using changesets:release
        # Finally deploy to Maven Central
        run: |
          ./mvnw --batch-mode --no-transfer-progress install
          ./mvnw --batch-mode --no-transfer-progress se.fortnox.changesets:changesets-maven-plugin:release
          ./mvnw --batch-mode --no-transfer-progress -Ppublish deploy -DskipTests
        env:
          MAVEN_USERNAME: ${{ secrets.CENTRAL_TOKEN_USERNAME }}
          MAVEN_PASSWORD: ${{ secrets.CENTRAL_TOKEN_PASSWORD }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_SIGNING_KEY_PASSWORD }}