Publish every build to GitHub Packages, and only full releases to Maven Central

.github/workflows/on_push.yml

@@ -12,6 +12,10 @@ jobs:
   publish:
     needs: test
     uses: ./.github/workflows/publish.yml
+    # A called workflow's jobs can't have more permissions than the caller grants.
+    permissions:
+      contents: write
+      packages: write
     secrets:
       MAVEN_CENTRAL_USERNAME: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
       MAVEN_CENTRAL_PASSWORD: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}

.github/workflows/publish.yml

@@ -13,9 +13,15 @@ on:
       required: true
   workflow_dispatch:
 
+# Each destination is its own job, so "Re-run failed jobs" retries only the publish that failed.
+# Neither registry accepts a version twice, so rerunning one that succeeded fails.
 jobs:
-  publish:
+  build:
     runs-on: ubuntu-latest
+    outputs:
+      version: ${{ steps.get_version.outputs.version }}
+      prerelease: ${{ steps.get_version.outputs.prerelease }}
+      is_tagged: ${{ steps.get_version.outputs.is_tagged }}
     steps:
       - name: Checkout code
         uses: actions/checkout@v6
@@ -31,26 +37,42 @@ jobs:
       - name: Build
         run: ./gradlew assemble
 
-      # only publish main & release/* builds to maven central
-      - name: Publish to Maven Central
-        if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')
-        run: ./gradlew publishToMavenCentral
-        env:
-          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
-          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
-          ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.SIGNING_KEY }}
-          ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.SIGNING_KEY_PASSWORD }}
+      - name: Get Gradle project version
+        id: get_version
+        run: |
+          VERSION=$(./gradlew properties -q | grep '^version:' | awk '{print $2}')
+          TAGS=$(git tag --points-at HEAD)
+
+          echo "Project version: $VERSION, tags: $TAGS"
+
+          if [ -z "$TAGS" ]; then
+            echo "is_tagged=false" >> $GITHUB_OUTPUT
+          else
+            echo "is_tagged=true" >> $GITHUB_OUTPUT
+          fi
+
+          # A final release is bare semver (X.Y.Z); any suffix (-rc, -m, -a) is a prerelease.
+          if echo "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$'; then
+            echo "prerelease=false" >> $GITHUB_OUTPUT
+          else
+            echo "prerelease=true" >> $GITHUB_OUTPUT
+          fi
+          echo "version=$VERSION" >> $GITHUB_OUTPUT
 
       - name: Upload jars
         uses: actions/upload-artifact@v7
         with:
           name: jars
           path: transact*/build/libs/*.jar
 
-  release:
-    needs: [publish]
+  # Every main and release/* build goes to GitHub Packages
+  publish-github-packages:
+    needs: [build]
     runs-on: ubuntu-latest
-    if: startsWith(github.ref, 'refs/heads/release/')
+    if: github.ref == 'refs/heads/main' || startsWith(github.ref, 'refs/heads/release/')
+    permissions:
+      contents: read
+      packages: write
     steps:
       - name: Checkout code
         uses: actions/checkout@v6
@@ -63,48 +85,63 @@ jobs:
           java-version: '21'
           distribution: 'temurin'
 
-      - name: Get Gradle project version
-        id: get_version
-        run: |
-          VERSION=$(./gradlew properties -q | grep '^version:' | awk '{print $2}')
-          TAGS=$(git tag --points-at HEAD)
+      - name: Publish to GitHub Packages
+        run: ./gradlew publishAllPublicationsToGitHubPackagesRepository
+        env:
+          ORG_GRADLE_PROJECT_GitHubPackagesUsername: ${{ github.actor }}
+          ORG_GRADLE_PROJECT_GitHubPackagesPassword: ${{ secrets.GITHUB_TOKEN }}
 
-          echo "Project version: $VERSION, tags: $TAGS"
+  # Only full releases go to Maven Central
+  publish-maven-central:
+    needs: [build]
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/heads/release/') && needs.build.outputs.prerelease == 'false'
+    steps:
+      - name: Checkout code
+        uses: actions/checkout@v6
+        with:
+          fetch-depth: 0 # fetch-depth 0 needed for version calculation
 
-          if [ -z "$TAGS" ]; then
-            echo "is_tagged=false" >> $GITHUB_OUTPUT
-          else
-            echo "is_tagged=true" >> $GITHUB_OUTPUT
-          fi
+      - name: Set up OpenJDK 21
+        uses: actions/setup-java@v5
+        with:
+          java-version: '21'
+          distribution: 'temurin'
 
-          # A final release is bare semver (X.Y.Z); any suffix (-rc, -m, -a) is a prerelease.
-          if echo "$VERSION" | grep -qE '^[0-9]+\.[0-9]+\.[0-9]+$'; then
-            echo "prerelease=false" >> $GITHUB_OUTPUT
-          else
-            echo "prerelease=true" >> $GITHUB_OUTPUT
-          fi
-          echo "version=$VERSION" >> $GITHUB_OUTPUT
+      - name: Publish to Maven Central
+        run: ./gradlew publishToMavenCentral
+        env:
+          ORG_GRADLE_PROJECT_mavenCentralUsername: ${{ secrets.MAVEN_CENTRAL_USERNAME }}
+          ORG_GRADLE_PROJECT_mavenCentralPassword: ${{ secrets.MAVEN_CENTRAL_PASSWORD }}
+          ORG_GRADLE_PROJECT_signingInMemoryKey: ${{ secrets.SIGNING_KEY }}
+          ORG_GRADLE_PROJECT_signingInMemoryKeyPassword: ${{ secrets.SIGNING_KEY_PASSWORD }}
 
+  # A GitHub Release for each full release, once it is on Maven Central
+  release:
+    needs: [build, publish-maven-central]
+    runs-on: ubuntu-latest
+    if: startsWith(github.ref, 'refs/heads/release/') && needs.build.outputs.is_tagged == 'true'
+    permissions:
+      contents: write
+    steps:
       - name: Download jars
         uses: actions/download-artifact@v7
         with:
           name: jars
           path: jars
 
       - name: Stage release assets
-        id: stage
         run: |
           mkdir -p release-assets
           find jars -name '*.jar' -exec cp {} release-assets/ \;
           ls -la release-assets
 
       - name: Github Release
-        if: steps.get_version.outputs.is_tagged == 'true'
         uses: softprops/action-gh-release@v2.1.0
         with:
-          name: ${{ steps.get_version.outputs.version }}
-          tag_name: ${{ steps.get_version.outputs.version }}
+          name: ${{ needs.build.outputs.version }}
+          tag_name: ${{ needs.build.outputs.version }}
           target_commitish: ${{ github.sha }}
-          prerelease: ${{ steps.get_version.outputs.prerelease }}
+          prerelease: ${{ needs.build.outputs.prerelease }}
           files: |
             release-assets/*

DEVELOPING.md

@@ -67,9 +67,46 @@ This will generate a report on the console and in `build/dependencyUpdates/repor
 
 DBOS Transact for Java follows the [Maven version order algorithm](https://maven.apache.org/pom.html#Version_Order_Specification).
 
-### Creating a Release
+### Where builds are published
+
+Every main and release branch build is published to
+[GitHub Packages](https://github.com/orgs/dbos-inc/packages?repo_name=dbos-transact-java).
+Full releases (a bare `X.Y.Z`, tagged on a release branch) are also published to Maven Central.
+New milestones (`-m`) and release candidates (`-rc`) are on GitHub Packages only; earlier ones
+remain on Maven Central.
+
+Each registry is published by its own job in the `Publish` workflow, so if one fails, "Re-run failed
+jobs" retries just that one. Neither registry accepts the same version twice, so rerunning a publish
+that succeeded fails.
+
+GitHub Packages needs a token to read packages, even public ones. To build against a milestone or
+release candidate, create a [personal access token (classic)](https://github.com/settings/tokens)
+with the `read:packages` scope (fine-grained tokens can't read GitHub Packages), and put it in
+`~/.gradle/gradle.properties`:
+
+```properties
+GitHubPackagesUsername=<your GitHub user name>
+GitHubPackagesPassword=<your token>
+```
+
+and add the repository to the consuming build:
+
+```kotlin
+repositories {
+  mavenCentral()
+  maven {
+    name = "GitHubPackages"
+    url = uri("https://maven.pkg.github.com/dbos-inc/dbos-transact-java")
+    credentials(PasswordCredentials::class)
+    content { includeGroup("dev.dbos") }
+  }
+}
+```
+
+Maven users add the same URL as a `<repository>` and put the token in a matching `<server>` in
+`~/.m2/settings.xml`.
 
-Release branch builds are published to Maven Central.
+### Creating a Release
 
 To create a new release, run this from the main branch
 
@@ -83,8 +120,6 @@ If `--push` option is provided, the tag and release branch are pushed to origin.
 
 ### Patching a release
 
-Release branch patch builds are published to Maven Central.
-
 To create a new release, run this from a release branch
 
 ```shell
@@ -95,16 +130,20 @@ This command tags the latest commit with the version number.
 The version number is generated by incrementing the last released patch version.
 If `--push` option is provided, the tag is pushed to origin.
 
+Pushing only a tag doesn't trigger a build, so the patch isn't published yet. To publish it, run the
+`Publish` workflow (Actions tab, `workflow_dispatch`) on the release branch. That run doesn't run
+the tests, so make sure the branch's last push passed them.
+
 ### Preview Versions
 
-Main branch builds may be published to Maven Central.
+Main branch builds are published to GitHub Packages.
 To facilitate publishing, main branch builds carry the automatically generated version number (i.e.incremented minor version )
 as well as a prerelease tag `-m<git-commit-count>.
 The git commit count is the number of commits since the last release.
 
 ### Feature Branch Versions
 
-Feature branch builds are not designed to be published to Maven Central.
+Feature branch builds are not published.
 Like main branch builds, feature branch builds carry the automatically generated version number
 and a prerelease tag `-a<git-commit-count>.
 In Maven version order algorithm, the `-a` prerelease prefix is lower priority than the `-m` prefix.

build-logic/src/main/kotlin/dbos.publishing-conventions.gradle.kts

@@ -14,6 +14,18 @@ tasks.withType<Javadoc> {
 
 tasks.named("build") { dependsOn("javadoc") }
 
+// Every main and release/* build goes to GitHub Packages; only full releases also go to Maven
+// Central. Credentials come from the GitHubPackagesUsername and GitHubPackagesPassword properties.
+extensions.configure<PublishingExtension> {
+  repositories {
+    maven {
+      name = "GitHubPackages"
+      url = uri("https://maven.pkg.github.com/dbos-inc/dbos-transact-java")
+      credentials(PasswordCredentials::class)
+    }
+  }
+}
+
 extensions.configure<com.vanniktech.maven.publish.MavenPublishBaseExtension> {
   publishToMavenCentral(automaticRelease = true, validateDeployment = DeploymentValidation.NONE)
   if (publishingToMavenCentral) signAllPublications()