Standardize release tooling and reviewed version PRs

.github/workflows/ci-lint.yml

@@ -19,7 +19,7 @@ jobs:
     name: Shared Maven policy
     uses: HauntedMC/HauntedPlatform/.github/workflows/maven-ci.yml@v1.6.8
     with:
-      maven-command: ./mvnw -U -B -ntp -DskipTests verify
+      maven-command: ./mvnw -U -B -ntp validate
     secrets:
       PACKAGES_USER: ${{ secrets.HAUNTEDMC_PACKAGES_USERNAME }}
       PACKAGES_TOKEN: ${{ secrets.HAUNTEDMC_PACKAGES_TOKEN }}
@@ -34,8 +34,12 @@ jobs:
       - uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+      - name: Install pinned release CLI
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh extension install HauntedMC/gh-haunted-release --pin ed440a0a2d5ab23af30c36bb22132f8ffa0ea33f
       - shell: bash
         run: |
           mapfile -d '' scripts < <(git ls-files -z '*.sh')
-          if (( ${#scripts[@]} > 0 )); then shellcheck "${scripts[@]}"; fi
-      - run: ./update_version.sh --dry-run major
+          if (( ${#scripts[@]} > 0 )); then shellcheck tools/release/update-version tools/release/prepare-version.sh "${scripts[@]}"; fi
+      - run: ./tools/release/update-version --dry-run major

.github/workflows/ci.yml

@@ -27,6 +27,10 @@ jobs:
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7.0.1
         with:
           persist-credentials: false
+      - name: Install pinned release CLI
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh extension install HauntedMC/gh-haunted-release --pin ed440a0a2d5ab23af30c36bb22132f8ffa0ea33f
       - name: Verify dependency version ownership
         run: python3 scripts/verify-version-ownership.py
 
@@ -44,7 +48,7 @@ jobs:
       - name: Verify architecture boundaries
         run: bash scripts/verify-architecture.sh
       - name: Verify release bump helper
-        run: ./update_version.sh --dry-run major
+        run: ./tools/release/update-version --dry-run major
       - name: Verify release-profile reactor
         run: ./mvnw -U -B -ntp -Prelease install
       - name: Verify external BOM consumer

.github/workflows/release.yml

@@ -25,12 +25,16 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
+      - name: Install pinned release CLI
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh extension install HauntedMC/gh-haunted-release --pin ed440a0a2d5ab23af30c36bb22132f8ffa0ea33f
       - id: version
         name: Detect a reviewed version change
         env:
           GITHUB_EVENT_BEFORE: ${{ github.event.before }}
           GITHUB_EVENT_NAME: ${{ github.event_name }}
-        run: python3 scripts/release-gate.py pom.xml
+        run: gh haunted-release gate
 
   publish:
     needs: gate
@@ -47,6 +51,10 @@ jobs:
         with:
           fetch-depth: 0
           persist-credentials: false
+      - name: Install pinned release CLI
+        env:
+          GH_TOKEN: ${{ github.token }}
+        run: gh extension install HauntedMC/gh-haunted-release --pin ed440a0a2d5ab23af30c36bb22132f8ffa0ea33f
       - name: Set up JDK 25 and Maven package credentials
         uses: actions/setup-java@de7274f081f381c8f8158605e0321c36c376e2e6 # v6.0.1
         with:
@@ -71,7 +79,7 @@ jobs:
       - name: Publish the verified reactor
         run: ./mvnw -U -B -ntp -DdeployAtEnd=true -Prelease deploy
       - name: Resolve every published artifact from a fresh Maven repository
-        run: python3 scripts/verify-published.py "${{ needs.gate.outputs.version }}" HauntedObservability
+        run: gh haunted-release verify-published "${{ needs.gate.outputs.version }}"
       - name: Create the release tag only after publication is resolvable
         run: gh release create "${{ needs.gate.outputs.tag }}" --target "$GITHUB_SHA" --title "HauntedObservability ${{ needs.gate.outputs.tag }}" --generate-notes
       - name: Create cross-repository GitHub App token

CONTRIBUTING.md

@@ -19,7 +19,7 @@ Before opening or updating a pull request, run:
 bash scripts/verify-architecture.sh
 ./mvnw -U -B -ntp -Prelease install
 bash scripts/verify-bom-consumer.sh
-./update_version.sh --dry-run patch
+./tools/release/update-version --dry-run patch
 ```
 
 If shell scripts changed, run ShellCheck over tracked `*.sh` files. CI repeats the architecture/privacy boundary checks, strict Java 25 build, release-profile sources/Javadocs, tests, external BOM consumer contract, and shared HauntedPlatform Maven policy.
@@ -44,10 +44,10 @@ Any change to telemetry attributes, span/log contents, metric dimensions, export
 Preview a bump without modifying the worktree:
 
 ```bash
-./update_version.sh --dry-run major
+./tools/release/update-version --dry-run major
 ```
 
-Run `./update_version.sh patch` (or an intentional minor/major bump) from a clean branch. The helper updates the reactor revision and timestamp and checks all module versions. Commit the changes in a reviewed PR. After merge, CI runs the release gate, publishes and resolves the package, then creates `vX.Y.Z`.
+Run `./tools/release/update-version patch` (or an intentional minor/major bump) from a clean branch. The helper updates the reactor revision and timestamp and checks all module versions. Commit the changes in a reviewed PR. After merge, CI runs the release gate, publishes and resolves the package, then creates `vX.Y.Z`.
 
 ## Pull request checklist
 

docs/RELEASE.md

@@ -2,7 +2,7 @@
 
 Observability publishes `haunted-observability-bom` for its own modules. Its optional DataProvider, DataRegistry, and FeatureFramework adapters compile against versions selected here.
 
-Prepare a reviewed PR from a clean worktree with `./update_version.sh patch` (or `minor`/`major` for an intentional API change). The helper updates version metadata and leaves the changes for review. Merge only after the repository's CI passes. Do not create or push a release tag manually.
+From clean, current `main`, run `./tools/release/update-version patch --pr` (or `minor`/`major` for an intentional API change). The command checks the project-specific version metadata, commits the changes, and opens a reviewed PR. Without `--pr`, it only prepares a local diff; `--dry-run` changes nothing. Merge after CI passes. Do not create or push a release tag manually.
 
 A version change on `main` starts `.github/workflows/release.yml`. The workflow runs the `release` release profiles, deploys the verified Maven reactor with `deployAtEnd`, resolves the published coordinates from an empty Maven repository, and only then creates tag `vX.Y.Z` and a GitHub Release. The release dispatches HauntedPlatform's dependency reconciler, which proposes reviewed downstream PRs only after the package is available.
 

tools/release/README.md

@@ -0,0 +1,7 @@
+# Version updates
+
+Install the pinned shared CLI once with `gh extension install HauntedMC/gh-haunted-release --pin v1.0.1`. This folder keeps the project-specific version adapter and its configuration.
+
+From clean, current `main`, run `./tools/release/update-version patch --pr` to prepare, commit, push, and open a reviewed PR. Omit `--pr` to prepare only a local diff; add `--dry-run` to inspect the next version without edits. The tool never merges, publishes, or tags.
+
+Enabled repositories use their pull-request CI as the merge gate.

update_version.sh → tools/release/prepare-version.sh

@@ -18,7 +18,7 @@ readonly MODULES=(
 die() { echo "Error: $*" >&2; exit 1; }
 usage() {
   cat >&2 <<'USAGE'
-Usage: ./update_version.sh [--dry-run] <major|minor|patch>
+Usage: ./tools/release/update-version [--dry-run] <major|minor|patch>
 
 Bumps HauntedObservability's reactor revision and reproducible-build timestamp,
 then leaves the changed files for review in a pull request.

tools/release/project.toml

@@ -0,0 +1,12 @@
+[project]
+name = "HauntedObservability"
+repository = "HauntedMC/HauntedObservability"
+tool_version = "1.0.1"
+mode = "bump"
+prepare = "tools/release/prepare-version.sh"
+verify = ["./mvnw", "-B", "-ntp", "verify"]
+verify_before_pr = false
+
+[components.default]
+pom = "pom.xml"
+tag_prefix = "v"

tools/release/update-version

@@ -0,0 +1,4 @@
+#!/usr/bin/env bash
+set -euo pipefail
+cd "$(git rev-parse --show-toplevel)"
+exec gh haunted-release version "$@"