[devhawk]

Every push to main and release/* now publishes all modules to GitHub Packages (https://maven.pkg.github.com/dbos-inc/dbos-transact-java) with the workflow's GITHUB_TOKEN. Only a full release (a bare X.Y.Z, i.e. a tagged release/* commit) also goes to Maven Central. Milestones (-mN) and release candidates (-rcN) stop going to Central; the ones already there stay.

Changes

• dbos.publishing-conventions adds a GitHubPackages publishing repository. Its credentials come from the GitHubPackagesUsername / GitHubPackagesPassword Gradle properties, and are required only when a GitHub Packages publish task runs, so build and publishToMavenLocal are unaffected.

• publish.yml splits into four jobs:

  • build: assembles, computes the version, uploads the jars;
  • publish-github-packages: every main and release/* build;
  • publish-maven-central: full releases only, signed as before;
  • release: the GitHub Release, now after the Maven Central publish.

  Each registry is its own job, so "Re-run failed jobs" retries only the publish that failed. Neither registry accepts a version twice, so a combined job couldn't be rerun after one of them succeeded.

• on_push.yml grants the publish call contents: write and packages: write, since a called workflow can't have more permissions than its caller.

• DEVELOPING.md covers:

  • where builds go, and how to consume a milestone: a classic token with read:packages, plus the repository block;
  • that patching a release needs a manual Publish run, because createRelease --push on a release branch pushes only a tag, which triggers nothing.

Notes

• GitHub Packages needs a token to read Maven packages, even public ones. Anything that resolves dev.dbos:transact:+ from Maven Central alone will stop seeing new milestones; the Conductor, Cloud and interop test apps need the repository added. The demo apps pin releases, and test_demo_apps.yml uses Maven Local, so neither changes.
• Previews are no longer signed. Only full releases, which go to Central, carry signatures.

🤖 Generated with Claude Code

[Copilot]

🟡 Changes recommended

Publishing can recalculate a different version, and retries can fail after partial module publication.

2 open issues

• Use the captured version consistently across publishers · New
• Make partial module publishes safely retryable · New

What changed in this PR

Routes Java module builds to GitHub Packages while reserving Maven Central for full releases.

Changes:

• Separates build, registry publishing, and GitHub Release jobs.
• Adds GitHub Packages credentials and workflow permissions.
• Documents preview consumption and manual patch publishing.

File	Description
DEVELOPING.md	Documents publishing destinations, authentication, and patch releases.
build-logic/​src/​main/​kotlin/​dbos.publishing-conventions.gradle.kts	Adds the GitHub Packages publishing repository.
.github/​workflows/​publish.yml	Splits publishing jobs and limits Central publishing to full releases.
.github/​workflows/​on_push.yml	Grants the reusable workflow publishing permissions.

_{Review effort: Balanced}