release.yml

# Publica a SDK no Maven Central quando uma tag v* e criada.
# Secrets necessarios no repositorio:
#   CENTRAL_TOKEN_USERNAME / CENTRAL_TOKEN_PASSWORD  -> User Token gerado em central.sonatype.com
#   GPG_PRIVATE_KEY                                  -> gpg --armor --export-secret-keys <KEY_ID>
#   GPG_PASSPHRASE                                   -> passphrase da chave

name: Release to Maven Central

on:
  push:
    tags: [ 'v*' ]
  workflow_dispatch:

jobs:
  publish:
    runs-on: ubuntu-latest
    permissions:
      contents: read

    steps:
      - uses: actions/checkout@v4

      - name: Set up JDK 17
        uses: actions/setup-java@v4
        with:
          java-version: '17'
          distribution: 'temurin'
          cache: maven
          server-id: central
          server-username: MAVEN_CENTRAL_USERNAME
          server-password: MAVEN_CENTRAL_PASSWORD
          gpg-private-key: ${{ secrets.GPG_PRIVATE_KEY }}
          gpg-passphrase: MAVEN_GPG_PASSPHRASE

      # Versao publicada e imutavel: se a tag nao bater com o pom, aborta antes do deploy.
      - name: Check tag matches pom version
        if: startsWith(github.ref, 'refs/tags/v')
        run: |
          POM_VERSION=$(mvn -q -B help:evaluate -Dexpression=project.version -DforceStdout)
          TAG_VERSION="${GITHUB_REF_NAME#v}"
          echo "pom=$POM_VERSION tag=$TAG_VERSION"
          test "$POM_VERSION" = "$TAG_VERSION"

      - name: Test
        run: mvn -B verify

      - name: Publish to Maven Central
        run: mvn -B -Prelease -DskipTests clean deploy
        env:
          MAVEN_CENTRAL_USERNAME: ${{ secrets.CENTRAL_TOKEN_USERNAME }}
          MAVEN_CENTRAL_PASSWORD: ${{ secrets.CENTRAL_TOKEN_PASSWORD }}
          MAVEN_GPG_PASSPHRASE: ${{ secrets.GPG_PASSPHRASE }}