Simplify Brev Maven Central release

.github/workflows/publish.yml

@@ -1,67 +1,43 @@
-name: Publish
+name: Publish to Maven Central
 
 on:
   push:
     tags:
       - 'v*'
-  workflow_dispatch:
-    inputs:
-      automatic_release:
-        description: 'Automatically release the Central Portal deployment'
-        required: true
-        default: false
-        type: boolean
 
 permissions:
   contents: read
 
+concurrency:
+  group: maven-central-publish
+  cancel-in-progress: false
+
 jobs:
   publish:
-    name: Publish to Maven Central
-    runs-on: macos-latest
-    env:
-      ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
-      ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
-      ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.SIGNING_IN_MEMORY_KEY }}
-      ORG_GRADLE_PROJECT_signingInMemoryKeyId: ${{ secrets.SIGNING_IN_MEMORY_KEY_ID }}
-      ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.SIGNING_IN_MEMORY_KEY_PASSWORD }}
+    runs-on: ubuntu-latest
+    environment: maven-central
     steps:
-      - name: Checkout
-        uses: actions/checkout@v6
-
-      - name: Set up JDK
-        uses: actions/setup-java@v5
+      - uses: actions/checkout@v6
+      - uses: actions/setup-java@v5
         with:
-          distribution: oracle
+          distribution: temurin
           java-version: '26'
-
-      - name: Set up Gradle
-        uses: gradle/actions/setup-gradle@v5
-
+      - uses: gradle/actions/setup-gradle@v5
       - name: Check release version
         run: |
-          version="$(sed -n 's/^val releaseVersion = "\(.*\)"/\1/p' build.gradle.kts | head -n 1)"
-          test -n "$version"
-
-          if [[ "${GITHUB_REF}" == refs/tags/v* ]]; then
-            tag_version="${GITHUB_REF#refs/tags/v}"
-            if [[ "$tag_version" != "$version" ]]; then
-              echo "Tag version $tag_version does not match Gradle version $version" >&2
-              exit 1
-            fi
-          fi
-
-          if [[ "$version" == *-SNAPSHOT ]]; then
-            echo "Release publishing requires a non-SNAPSHOT version, found $version" >&2
+          version="$(./gradlew -q printReleaseVersion)"
+          tag_version="${GITHUB_REF_NAME#v}"
+          [[ "$tag_version" == "$version" ]] || {
+            echo "Tag version $tag_version does not match Gradle version $version" >&2
             exit 1
-          fi
-
+          }
+          [[ "$version" != *-SNAPSHOT ]] || exit 1
           echo "Publishing version $version"
-
-      - name: Publish
-        run: |
-          if [[ "${{ github.event_name }}" == "workflow_dispatch" && "${{ inputs.automatic_release }}" == "true" ]]; then
-            ./gradlew publishAndReleaseToMavenCentral
-          else
-            ./gradlew publishAndReleaseToMavenCentral
-          fi
+      - name: Build and publish
+        env:
+          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
+          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
+          ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.SIGNING_IN_MEMORY_KEY }}
+          ORG_GRADLE_PROJECT_signingInMemoryKeyId: ${{ secrets.SIGNING_IN_MEMORY_KEY_ID }}
+          ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.SIGNING_IN_MEMORY_KEY_PASSWORD }}
+        run: ./gradlew clean build publishAndReleaseToMavenCentral

PUBLISHING.md

@@ -21,19 +21,13 @@ Generate a Central Portal user token at
 
 ## Release
 
-Set `releaseVersion` in `build.gradle.kts`, then:
-
-```shell
-./gradlew clean build
-./gradlew publishAndReleaseToMavenCentral
-```
-
-The Central Portal typically takes 10–30 minutes after a successful deployment
-before the artifacts are downloadable from Maven Central.
-
-For a CI release, push a matching tag:
+Set `releaseVersion` in `build.gradle.kts`, merge the change to `main`, and push
+a matching tag:
 
 ```shell
 git tag v0.1.0
 git push origin v0.1.0
 ```
+
+GitHub Actions verifies that the tag matches the Gradle version, then builds
+and publishes that exact tagged commit. No local Maven credentials are needed.

build.gradle.kts

@@ -144,3 +144,8 @@ fun Project.hasInMemorySigningKey(): Boolean {
 tasks.named("build") {
     dependsOn(subprojects.map { it.tasks.named("build") })
 }
+
+tasks.register("printReleaseVersion") {
+    val release = releaseVersion
+    doLast { println(release) }
+}