Add RELEASING.md

[Sekator778]

Writes down how a release is cut here, as I offered in #71. @nrayburn-tech @Thorsrud22 could one of you review? cc @wing328

---

Summary by cubic

Adds RELEASING.md to document how releases are cut for this repository.

• Covers release prerequisites, the three-pull-requests-and-one-tag flow, and recovery steps when a release run fails.

^{Written for commit 445ad7e. Summary will update on new commits.}

[cubic-dev-ai]

All reported issues were addressed across 1 file

<sub>Reply with feedback, questions, or to request a fix.

Re-trigger cubic</sub>

[nrayburn-tech]

I think it looks fine, but check the two comments. At least one of them looks like valid feedback.

[Thorsrud22]

Checked this against the workflow, pom.xml, the tags and the #71 convention. Steps 1–4 match how 0.2.12 went (#194 → v0.2.12 → #198 → OpenAPITools/openapi-generator#25096). A few things before it merges:

1. deploy environment: both bot comments hold. The repo has a deploy environment, but maven_release.yml never references it (no environment: key), so its protection rules don't apply to the publish job. Either drop "through the deploy environment", or add environment: deploy to publish-OSSRH, which would also let releases be gated on a required reviewer if that's wanted.
2. scm tag: the tag value is jackson-databind-nullable-0.2.N-SNAPSHOT → jackson-databind-nullable-0.2.N, so it's worth spelling out in step 1 (and step 3).
3. Between steps 1 and 3: the #71 convention lets anyone merge green Dependabot minor/patch bumps, and those are exactly what turned up during 0.2.12 (#195–#197). I'd say explicitly that the freeze includes Dependabot PRs.
4. "A failed run publishes nothing": true when the build job fails. With autoPublish on, though, the publish step uploads and then waits for validation, so if that step fails after the upload (e.g. a timeout), the deployment can still go through. Suggest: "if the publish step itself failed, check Maven Central and the Central Portal before pushing again."

Approving, since these are wording fixes.

[Sekator778]

Thanks both, all four are right. Pushed 445ad7e: the deploy environment is gone from the text, the scm tag is spelled out in steps 1 and 3, the freeze names Dependabot, and a failed publish step now says to check Central first. I'll merge tomorrow unless something else comes up.