From b3b1a949b330b8aedf616cae9395a17795775061 Mon Sep 17 00:00:00 2001
From: Jonas Konrad <me@yawk.at>
Date: Fri, 25 Sep 2026 17:31:10 +0200
Subject: [PATCH] Only publish to Central from v* tags

Compute the publish condition once in the assemble job and require the
ref to be a v* tag for both release events and workflow_dispatch. A
publish request from any other ref now fails instead of deploying a
SNAPSHOT or commit-hash version.

Fixes #118

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
---
 .github/workflows/build-all-and-publish.yml | 18 ++++++++++++++----
 1 file changed, 14 insertions(+), 4 deletions(-)

diff --git a/.github/workflows/build-all-and-publish.yml b/.github/workflows/build-all-and-publish.yml
index 1ea603bd..3bc088c2 100644
--- a/.github/workflows/build-all-and-publish.yml
+++ b/.github/workflows/build-all-and-publish.yml
@@ -209,7 +209,17 @@ jobs:
     name: Assemble and deploy final all-platforms JAR
     runs-on: ubuntu-latest
     needs: [ linux, macos, windows ]
+    env:
+      # Only publish to Central from v* tags. Releases on Central cannot be removed, and branch or commit builds would
+      # otherwise deploy SNAPSHOT or commit-hash versions.
+      PUBLISH: ${{ startsWith(github.ref, 'refs/tags/v') && (github.event_name == 'release' || inputs.publish) }}
     steps:
+      - name: Check publish ref
+        if: (github.event_name == 'release' || inputs.publish) && env.PUBLISH != 'true'
+        run: |
+          echo "::error::Publishing is only allowed from v* tags, not ${GITHUB_REF}"
+          exit 1
+
       - name: Checkout
         uses: actions/checkout@3d3c42e5aac5ba805825da76410c181273ba90b1 # v7
         with:
@@ -225,7 +235,7 @@ jobs:
       # with central credentials
       - name: Setup Temurin JDK 25 (publish)
         uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
-        if: github.event_name == 'release' || inputs.publish
+        if: env.PUBLISH == 'true'
         with:
           distribution: temurin
           java-version: '25'
@@ -238,7 +248,7 @@ jobs:
       # without central credentials
       - name: Setup Temurin JDK 25
         uses: actions/setup-java@b6effb05e454b25005698d916606bdc6ffcbf961 # v5
-        if: github.event_name != 'release' && !inputs.publish
+        if: env.PUBLISH != 'true'
         with:
           distribution: temurin
           java-version: '25'
@@ -285,7 +295,7 @@ jobs:
       # with maven central
       - name: Build and deploy with Maven
         run: ./mvnw -B -V -Pdeploy,-native-linux deploy
-        if: github.event_name == 'release' || inputs.publish
+        if: env.PUBLISH == 'true'
         env:
           CENTRAL_TOKEN_USERNAME: ${{ secrets.CENTRAL_TOKEN_USERNAME }}
           CENTRAL_TOKEN_PASSWORD: ${{ secrets.CENTRAL_TOKEN_PASSWORD }}
@@ -294,7 +304,7 @@ jobs:
       # without maven central
       - name: Build with Maven
         run: ./mvnw -B -V -P-native-linux verify
-        if: github.event_name != 'release' && !inputs.publish
+        if: env.PUBLISH != 'true'
 
       - name: Upload final JAR
         uses: actions/upload-artifact@043fb46d1a93c77aae656e7c1c64a875d1fc6a0a # v7