fix: ensure release tag points to non-snapshot release commit

Signed-off-by: Lavanya N M <lavanyanm75@gmail.com>

Author: Lavanya-N24

.github/workflows/release-project-in-dir.yml

@@ -11,20 +11,35 @@ on:
         required: true
 
 env:
-#  set the target pom to use the input directory as root
+  # set the target pom to use the input directory as root
   MAVEN_ARGS: -V -ntp -e -f ${{ inputs.project_dir }}/pom.xml
 
 jobs:
   publish:
     runs-on: ubuntu-latest
+    permissions:
+      contents: write
     steps:
       - name: Checkout "${{inputs.version_branch}}" branch
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
         with:
           ref: "${{inputs.version_branch}}"
+          fetch-depth: 0
+
+      - name: Parse release version
+        id: vars
+        run: |
+          RAW_TAG="${{ github.event.release.tag_name }}"
+          STRIPPED="${RAW_TAG#v}"
+          FINAL_VERSION="${STRIPPED%-tmp}"
+          FINAL_TAG="v${FINAL_VERSION}"
+
+          echo "raw_tag=${RAW_TAG}" >> "$GITHUB_OUTPUT"
+          echo "final_version=${FINAL_VERSION}" >> "$GITHUB_OUTPUT"
+          echo "final_tag=${FINAL_TAG}" >> "$GITHUB_OUTPUT"
 
       - name: Set up Java and Maven
-        uses: actions/setup-java@v6
+        uses: actions/setup-java@v4
         with:
           java-version: 17
           distribution: temurin
@@ -36,11 +51,39 @@ jobs:
           gpg-passphrase: MAVEN_GPG_PASSPHRASE
 
       - name: Change version to release version
-        # Assume that RELEASE_VERSION will have form like: "v1.0.1". So we cut the "v"
         run: |
-          ./mvnw ${MAVEN_ARGS} versions:set -DnewVersion="${RELEASE_VERSION:1}" versions:commit -DprocessAllModules
+          ./mvnw ${MAVEN_ARGS} versions:set -DnewVersion="${{ steps.vars.outputs.final_version }}" versions:commit -DprocessAllModules
+
+      - name: Commit and push release version
+        run: |
+          git config --local user.email "action@github.com"
+          git config --local user.name "GitHub Action"
+          if git diff --quiet; then
+            echo "No version changes to commit."
+          else
+            git commit -am "Release ${{ steps.vars.outputs.final_tag }}"
+            git push origin HEAD:${{ inputs.version_branch }}
+          fi
+
+      - name: Re-tag commit and update GitHub Release
         env:
-          RELEASE_VERSION: ${{ github.event.release.tag_name }}
+          GH_TOKEN: ${{ secrets.GITHUB_TOKEN }}
+          GH_REPO: ${{ github.repository }}
+        run: |
+          RAW_TAG="${{ steps.vars.outputs.raw_tag }}"
+          FINAL_TAG="${{ steps.vars.outputs.final_tag }}"
+
+          if [ "$RAW_TAG" != "$FINAL_TAG" ]; then
+            echo "Creating final release tag: ${FINAL_TAG}"
+            git tag -a "${FINAL_TAG}" -m "Release ${FINAL_TAG}"
+            git push origin "${FINAL_TAG}"
+
+            echo "Pointing GitHub release to final tag ${FINAL_TAG}"
+            gh release edit "${RAW_TAG}" --tag "${FINAL_TAG}"
+
+            echo "Deleting temporary tag ${RAW_TAG}"
+            git push origin --delete "${RAW_TAG}" || true
+          fi
 
       - name: Publish to Apache Maven Central
         run: ./mvnw package deploy -Prelease
@@ -49,19 +92,20 @@ jobs:
           MAVEN_CENTRAL_TOKEN: ${{ secrets.NEXUS_PASSWORD }}
           MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}
 
-  # This is separate job because there were issues with git after release step, was not able to commit changes.
   update-working-version:
     runs-on: ubuntu-latest
     needs: publish
-    if: "!contains(github.event.release.tag_name, 'RC')" # not sure we should keep this the RC part
+    permissions:
+      contents: write
+    if: "!contains(github.event.release.tag_name, 'RC')"
     steps:
       - name: Checkout "${{inputs.version_branch}}" branch
-        uses: actions/checkout@v7
+        uses: actions/checkout@v4
         with:
           ref: "${{inputs.version_branch}}"
 
       - name: Set up Java and Maven
-        uses: actions/setup-java@v6
+        uses: actions/setup-java@v4
         with:
           java-version: 17
           distribution: temurin
@@ -73,11 +117,9 @@ jobs:
           git config --local user.email "action@github.com"
           git config --local user.name "GitHub Action"
           git commit -m "Set new SNAPSHOT version into pom files." -a
-        env:
-          RELEASE_VERSION: ${{ github.event.release.tag_name }}
 
       - name: Push changes to branch
         uses: ad-m/github-push-action@master
         with:
           branch: "${{inputs.version_branch}}"
-          github_token: ${{ secrets.GITHUB_TOKEN }}
+          github_token: ${{ secrets.GITHUB_TOKEN }}

.github/workflows/release.yml

@@ -10,8 +10,10 @@ jobs:
     runs-on: ubuntu-latest
     env:
       tmp_version_branch: ''
+      RAW_TAG: ${{ github.event.release.tag_name }}
     outputs:
       version_branch: ${{ steps.set-version-branch.outputs.version_branch }}
+      release_tag: ${{ steps.set-release-tag.outputs.release_tag }}
     steps:
       - if: ${{ startsWith(github.event.release.tag_name, 'v1.' ) }}
         run: |
@@ -31,8 +33,9 @@ jobs:
           echo "tmp_version_branch=v4" >> "$GITHUB_ENV"
       - if: ${{ startsWith(github.event.release.tag_name, 'v5.' ) }}
         run: |
-          RELEASE_VERSION="${{ github.event.release.tag_name }}"
-          RELEASE_VERSION="${RELEASE_VERSION#v}"
+          # Strip 'v' prefix and optional '-tmp' suffix
+          RELEASE_VERSION="${RAW_TAG#v}"
+          RELEASE_VERSION="${RELEASE_VERSION%-tmp}"
           RELEASE_MAJOR_MINOR=$(echo "$RELEASE_VERSION" | cut -d. -f1-2)
 
           MAIN_POM_VERSION=$(curl -fsSL "https://raw.githubusercontent.com/${{ github.repository }}/main/pom.xml" | yq -p xml '.project.version')
@@ -55,16 +58,22 @@ jobs:
       - if: ${{ env.tmp_version_branch == '' }}
         name: Fail if version_branch is not set
         run: |
-          echo "Failed to find appropriate branch to release ${{github.event.release.tag_name}} from"
+          echo "Failed to find appropriate branch to release $RAW_TAG from"
           exit 1
       - id: set-version-branch
         name: Set version_branch if matched
-        run: echo "version_branch=${{env.tmp_version_branch}}" >> $GITHUB_OUTPUT
+        run: echo "version_branch=${{ env.tmp_version_branch }}" >> "$GITHUB_OUTPUT"
+      - id: set-release-tag
+        name: Pass release tag
+        run: echo "release_tag=${RAW_TAG}" >> "$GITHUB_OUTPUT"
 
   release-sdk:
     needs: prepare-release
+    permissions:
+      contents: write
     uses: ./.github/workflows/release-project-in-dir.yml
     secrets: inherit
     with:
-      version_branch: ${{needs.prepare-release.outputs.version_branch}}
-      project_dir: '.'
+      version_branch: ${{ needs.prepare-release.outputs.version_branch }}
+      release_tag: ${{ needs.prepare-release.outputs.release_tag }}
+      project_dir: '.'