Release on v#.#.# tag push instead of pom version change

CI detected a release by comparing pom.xml with HEAD~1, which misses
version bumps whenever a merge lands more than one commit (as happened
with 4.0.0). Publishing is now triggered by pushing a vX.Y.Z tag: the
Release workflow checks the tag matches the pom.xml version and is on
master, deploys to Maven Central, then creates the GitHub release.

CI keeps only the build matrix.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Claude-Session: https://claude.ai/code/session_01TXEoEctMzFSoGuySUsqtBJ

Author: claude

.github/workflows/ci.yml

@@ -27,66 +27,3 @@ jobs:
       - name: Build and test
         run: mvn -B verify
 
-  release:
-    needs: build
-    if: github.event_name == 'push' && github.ref == 'refs/heads/master'
-    runs-on: ubuntu-latest
-
-    outputs:
-      changed: ${{ steps.version.outputs.changed }}
-
-    steps:
-      - uses: actions/checkout@v7
-        with:
-          fetch-depth: 2
-
-      - name: Check for version change
-        id: version
-        run: |
-          CURRENT=$(grep -m1 '<version>' pom.xml | sed 's/.*<version>\(.*\)<\/version>.*/\1/')
-          PREVIOUS=$(git show HEAD~1:pom.xml | grep -m1 '<version>' | sed 's/.*<version>\(.*\)<\/version>.*/\1/')
-          echo "current=$CURRENT" >> "$GITHUB_OUTPUT"
-          echo "previous=$PREVIOUS" >> "$GITHUB_OUTPUT"
-          if [ "$CURRENT" != "$PREVIOUS" ] && [[ "$CURRENT" != *SNAPSHOT* ]]; then
-            echo "changed=true" >> "$GITHUB_OUTPUT"
-          else
-            echo "changed=false" >> "$GITHUB_OUTPUT"
-          fi
-
-      - name: Create GitHub release
-        if: steps.version.outputs.changed == 'true'
-        env:
-          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
-        run: |
-          VERSION=${{ steps.version.outputs.current }}
-          gh release create "v${VERSION}" \
-            --target master \
-            --title "${VERSION}" \
-            --generate-notes
-
-  deploy:
-    needs: release
-    if: needs.release.outputs.changed == 'true'
-    runs-on: ubuntu-latest
-
-    steps:
-      - uses: actions/checkout@v7
-
-      - name: Set up JDK 21
-        uses: actions/setup-java@v6
-        with:
-          java-version: 21
-          distribution: temurin
-          cache: maven
-          server-id: central
-          server-username: MAVEN_CENTRAL_USERNAME
-          server-password: MAVEN_CENTRAL_PASSWORD
-          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
-          gpg-passphrase: GPG_PASSPHRASE
-
-      - name: Deploy to Maven Central
-        run: mvn -B clean deploy -P release
-        env:
-          MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
-          MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
-          GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}

.github/workflows/release.yml

@@ -1,16 +1,35 @@
 name: Release
 
+# Publishes to Maven Central when a version tag is pushed:
+#   git tag v4.0.0 && git push origin v4.0.0
 on:
-  release:
-    types: [ published ]
-  workflow_dispatch:
+  push:
+    tags: [ 'v[0-9]+.[0-9]+.[0-9]+' ]
+
+permissions:
+  contents: write
 
 jobs:
-  deploy:
+  release:
     runs-on: ubuntu-latest
 
     steps:
       - uses: actions/checkout@v7
+        with:
+          fetch-depth: 0
+
+      - name: Check tag matches pom.xml and is on master
+        run: |
+          TAG_VERSION="${GITHUB_REF_NAME#v}"
+          POM_VERSION=$(grep -m1 '<version>' pom.xml | sed 's/.*<version>\(.*\)<\/version>.*/\1/')
+          if [ "$TAG_VERSION" != "$POM_VERSION" ]; then
+            echo "::error::Tag $GITHUB_REF_NAME does not match pom.xml version $POM_VERSION"
+            exit 1
+          fi
+          if ! git merge-base --is-ancestor "$GITHUB_SHA" origin/master; then
+            echo "::error::Tag $GITHUB_REF_NAME points to a commit that is not on master"
+            exit 1
+          fi
 
       - name: Set up JDK 21
         uses: actions/setup-java@v6
@@ -30,3 +49,12 @@ jobs:
           MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
           MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
           GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
+
+      - name: Create GitHub release
+        env:
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+        run: |
+          gh release create "$GITHUB_REF_NAME" \
+            --verify-tag \
+            --title "${GITHUB_REF_NAME#v}" \
+            --generate-notes

README.md

@@ -333,9 +333,14 @@ post("/upload", new Action() {
 
 ## Releasing
 
-1. Set the release version in `pom.xml` (remove `-SNAPSHOT`)
-2. Commit, push, and merge via PR
-3. CI detects the version change, creates a GitHub release, and deploys to Maven Central
+1. Set the release version in `pom.xml` (remove `-SNAPSHOT`) and merge it to `master` via PR
+2. Tag the merged commit on `master` and push the tag:
+   ```sh
+   git tag v4.0.0
+   git push origin v4.0.0
+   ```
+3. The Release workflow checks that the tag matches the `pom.xml` version and is on
+   `master`, deploys to Maven Central, and creates the GitHub release
 4. Publish the deployment at https://central.sonatype.com/publishing/deployments
 
 ## License