ci: github action for automated releasing to stage

[karel-rehor]

Proposed Changes

Sets up automated releasing.

1. For uploads to Maven Central replaces nexus-staging-maven-plugin with recommended central-publishing-maven-plugin
2. Introduces a new Github Actions workflow maven-release.yml
   1. Verifies the action environment to ensure that all requred variables are present and valid.
   2. Executes the on-release.sh script which ensures values in pom.xml files and documentation match the release version and tag.
   3. Triggers the release process, which packages and then uploads the module to Maven Central.
   4. Automatically generates and then publishes Github pages. This will trigger a second Github Action "pages build and deployment".
   5. Autmatically updates CHANGELOG.md and pom.xml with the next release version. e.g. in pom.xml 1.11.0 is incremented to 1.12.0-SNAPSHOT.

Note this requires up-to-date values for action secrets

• GPG_PASSPHRASE
• GPG_PRIVATE_KEY (in tests using key for karel-rehor@users.noreply.github.com which is password protected and without expiration, so it could be used in production.)
• SONATYPE_PASSWORD
• SONATYPE_USERNAME

Nota Bene

replaces #440 - in order to test PR related changes before merging workflows into main.

Checklist

• CHANGELOG.md updated
• Rebased/mergeable
• [ ] A test has been added if appropriate N.A.
• Tests pass
• Commit messages are conventional
• Sign CLA (if not already signed)

[Copilot]

🟡 Changes recommended

Critical workflow and secret-exposure issues, along with additional documented fixes, remain unresolved.

Get a fresh assessment by requesting another Copilot review.

Pull request overview

Automates tagged Maven Central releases, GitHub Pages publishing, release validation, and next-cycle preparation.

Changes:

• Replaces Nexus staging with Central Publishing.
• Adds the release workflow and validation script.
• Updates release documentation, publishing configuration, and changelog.

File summaries

File	Summary and final findings
scripts/on-release.sh	Validates release metadata and versions. Critical: environment dumps may expose secrets. Moderate: Gradle dependency examples are not validated.
RELEASE.md	Documents release procedures. Nit: sample output incorrectly shows 1.12.0-SNAPSHOT.
pom.xml	Updates publishing and SCM configuration.
CHANGELOG.md	Records the release automation. Nit: superseded PR #440 link should point to #445.
.github/workflows/maven-release.yml	Automates validation, publishing, documentation, and next-cycle setup. Critical: URL condition exits on valid releases. Moderate: patch-release bypass behavior is undocumented or should be removed.

Review details

Suppressed comments (3)

.github/workflows/maven-release.yml:193

• For every non-zero patch tag this guard skips preparing the next-cycle branch (and the later hot-fix guard also skips Pages publication), but RELEASE.md documents only pre-releases as exceptions and says the workflow performs both actions. Either remove the hot-fix bypass or document this patch-release behavior so operators do not expect a branch/site update that will not occur.

          if [[ "${IS_HOT_FIX}" == "true" ]]
          then
            echo "This is a hot fix release ${RELEASE_TAG_NAME}, so next release cycle will not be prepared."
            exit 0

CHANGELOG.md:5

• This changelog entry still links to superseded PR #440, while the release work was moved to PR #445 for staging. Keeping #440 here will make the published release notes point at the closed predecessor instead of this change; update the link to #445.

1. [#440](https://github.com/InfluxCommunity/influxdb3-java/pull/440): Sets up automated releasing to Maven Central

RELEASE.md:24

• The documented command uses -DremoveSnapshot=true, but this sample output still says the project is being built as 1.12.0-SNAPSHOT. That contradicts the release procedure and would lead directly to the release script rejecting the version as a snapshot; the sample should show 1.12.0.

   [INFO] Building InfluxDB 3 Java Client 1.12.0-SNAPSHOT

• Files reviewed: 5/5 changed files
• Comments generated: 3
• Review effort level: Lite

---

💡 Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

[codecov]

Codecov Report

✅ All modified and coverable lines are covered by tests.
✅ Project coverage is 88.73%. Comparing base (db7a216) to head (7d2f3ca).

Additional details and impacted files

@@                      Coverage Diff                      @@
##           ci/stage-automated-releasing     #445   +/-   ##
=============================================================
  Coverage                         88.73%   88.73%           
=============================================================
  Files                                21       21           
  Lines                              1553     1553           
  Branches                            281      281           
=============================================================
  Hits                               1378     1378           
  Misses                               77       77           
  Partials                             98       98           

☔ View full report in Codecov by Harness.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

• ❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.

[Copilot]

🟡 Changes recommended

The release workflow and validation script contain verified version-handling/exit-path bugs that can generate incorrect next-cycle versions and allow releases to proceed despite README mismatches.

Get a fresh assessment by requesting another Copilot review.

Review details

• Files reviewed: 5/5 changed files
• Comments generated: 2
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

The release workflow/script contains concrete issues that can break releases (tag checkout with shallow fetch, documentation publishing content mismatch, and on-release validation gaps).

Review details

Suppressed comments (5)

Previously missed (5) — in code that hasn't changed since the last review.

.github/workflows/maven-release.yml:24

• The workflow later runs git checkout "${RELEASE_TAG_NAME}", but actions/checkout defaults to a shallow clone that may not fetch tags. This can make the tag checkout fail even for valid releases; fetch full history (or at least tags) in the checkout step.
  pom.xml:643
• maven-release.yml generates the site with mvn ... site:stage (staging to ${project.build.directory}/staging), but the maven-scm-publish-plugin no longer specifies content. With the current workflow command (no -Dscmpublish.content=...), this risks publishing the wrong directory (often target/site) instead of the staged site.
  scripts/on-release.sh:73
• The accepted release tag pattern includes snapshot, but the script later refuses to release snapshot versions (and the workflow’s tag validation also rejects snapshot). Allowing -snapshot here makes the tag validation inconsistent and can lead to confusing failures later.
  scripts/on-release.sh:228
• If the Gradle example version in README.md is out of date, the script prints an error but does not exit 1, so the release can proceed with inconsistent documentation (unlike the Maven <version> check above, which fails fast).
  scripts/on-release.sh:243
• setup() is intended to validate that xmllint is available, but it is invoked after verify_example_pom / verify_version already call xmllint. As written, missing xmllint will fail earlier with command not found, and setup() never provides the intended error message.

• Files reviewed: 5/5 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🔵 Needs a closer look

The workflow configures git identity using a non-existent Actions variable and the release helper script’s tag parsing is fragile, either of which can break automated releases.

Review details

Suppressed comments (5)

Previously missed (3) — in code that hasn't changed since the last review.

.github/workflows/maven-release.yml:245

• GITHUB_TRIGGERING_ACTOR is not a default Actions environment variable, so this can resolve to an empty string and configure an invalid email ("@noreply.github.com"). Use GITHUB_ACTOR (or pass ${{ github.triggering_actor }} explicitly) and keep the standard @users.noreply.github.com domain.
  RELEASE.md:11
• Use the standard capitalization “GitHub” in user-facing messages/docs (this file currently uses “Github”).

This issue also appears on line 23 of the same file.
scripts/on-release.sh:31

• Use the standard capitalization “GitHub” in user-facing messages (this message currently says “Github”).

This issue also appears on line 102 of the same file.

scripts/on-release.sh:104

• set_release_number relies on sed's empty-regex s/// behavior (and mixes address + I modifier), which is hard to read and can break on different sed implementations. Use an explicit substitution to strip the optional -rcN/-betaN suffix after removing the leading v.

set_release_number(){
    RELEASE_NUM=$(echo "${RELEASE_TAG_NAME}" | sed -r "/-(rc|beta)[0-9]*/Is///" | sed -r "s/^v//")
}

RELEASE.md:25

• The example output contradicts the preceding command: after mvn versions:set -DremoveSnapshot=true, the build version shown should no longer include -SNAPSHOT. As written, this can confuse release operators about what a correct state looks like.

   [INFO] --------------------< com.influxdb:influxdb3-java >---------------------
   [INFO] Building InfluxDB 3 Java Client 1.12.0-SNAPSHOT
   [INFO] --------------------------------[ jar ]---------------------------------

• Files reviewed: 5/5 changed files
• Comments generated: 0 new
• Review effort level: Lite

[Copilot]

🟡 Changes recommended

The current workflow/script have release-blocking issues (incorrect CHANGELOG date parsing and Maven release deploy settings not being applied to the inner perform build), and the docs publish configuration is inconsistent with staged site output.

Get a fresh assessment by requesting another Copilot review.

Review details

Suppressed comments (3)

Previously missed (3) — in code that hasn't changed since the last review.

pom.xml:643

• The workflow builds docs with mvn ... site site:stage (staging output under target/staging), but the maven-scm-publish-plugin configuration no longer specifies content. This makes the publish step likely pick the default (commonly target/site) instead of the staged output, so the released docs could be incomplete/different from what was staged.
  scripts/on-release.sh:123
• HEADER_DATE is extracted with ${HEADER_LINE[2]:1:-2}, which removes two trailing characters. For dates like [2026-08-27] this truncates the day (becoming 2026-08-2) and the date --date=... check can still succeed while validating the wrong date. Also, the sed pattern uses unescaped . so it can match non-version lines unexpectedly.
  .github/workflows/maven-release.yml:245
• The publish-docs step configures git with ${GITHUB_ACTOR}@noreply.github.com, but other steps use the standard ${GITHUB_ACTOR}@users.noreply.github.com. @noreply.github.com is likely an invalid domain and makes commits/pushes harder to trace consistently.

• Files reviewed: 5/5 changed files
• Comments generated: 1
• Review effort level: Lite